Function at 0x14000a2f0
Capabilities:
Copy file
Create directory
Delete file
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2b8
mov r14, r8
mov rdi, rdx
mov r13, rcx
mov rax, qword [0x140037010]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rdx, qword [rdx + 8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
xor ebx, ebx
test eax, eax
jne 0x14000a5f1
movabs rsi, 0xffffffff00000002
lea rbx, [rsp + 0x78]
mov qword [rbx], rsi
mov qword [rbx + 8], 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rbx + 0x10], xmm0
mov rcx, rbx
mov rdx, r13
xor r8d, r8d
call fcn.140009d00
mov ebp, dword [rbx + 4]
cmp ebp, 0xffffffff
je 0x14000a50c
mov eax, ebp
and eax, 0x10
je 0x14000a50c
lea rdx, [r14 + 0xc8]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000a5a7
lea rcx, [rsp + 0x58]
mov qword [rcx], rsi
mov qword [rcx + 8], 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rcx + 0x10], xmm0
xor r15d, r15d
mov rdx, rdi
xor r8d, r8d
call fcn.140009d00
mov ecx, 0x20a
call fcn.14000e284
mov rbx, rax
lea rcx, [rax + 2]
mov r8d, 0x208
xor edx, edx
call fcn.14000feb0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], r15
mov word [rbx], r15w
mov ecx, 0x20a
call fcn.14000e284
mov rbx, rax
lea rcx, [rax + 2]
mov r8d, 0x208
xor edx, edx
call fcn.14000feb0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r15
mov word [rbx], r15w
cmp qword [rsp + 0x80], 0xffffffffffffffff
mov ebx, 0x80004005
je 0x14000a467
cmp qword [rsp + 0x60], 0xffffffffffffffff
je 0x14000a467
mov eax, dword [rsp + 0x5c]
test al, 0x10
je 0x14000a467
cmp eax, 0xffffffff
je 0x14000a467
bt eax, 0xa
jb 0x14000a467
mov ecx, dword [rsp + 0x58]
cmp ecx, 1
je 0x14000a467
cmp eax, 0xffffffff
je 0x14000a467
cmp ecx, 2
je 0x14000a467
xor ebx, ebx
bt ebp, 0xa
jb 0x14000a467
mov eax, dword [rsp + 0x78]
dec eax
cmp eax, 2
jae 0x14000a617
lea rdx, [rsp + 0x78]
mov rcx, r13
call fcn.14000a170
test eax, eax
jns 0x14000a4a6
mov rcx, qword [r13 + 8]
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test ebx, ebx
js 0x14000a4a6
test eax, eax
jne 0x14000a4a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x40], 0
test rcx, rcx
je 0x14000a4be
call fcn.14000e28c
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x50], 0
test rcx, rcx
je 0x14000a4d6
call fcn.14000e28c
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x70], 0
test rcx, rcx
je 0x14000a4ee
call fcn.14000e28c
mov rcx, qword [rsp + 0x60]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14000a5bb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000a5bb
mov rcx, qword [rsp + 0x80]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14000a524
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, 0xffffffff
setne al
xor ebx, ebx
mov qword [rsp + 0x80], 0xffffffffffffffff
cmp ebp, 0xffffffff
je 0x14000a57f
mov ecx, dword [rsp + 0x78]
cmp ecx, 2
je 0x14000a57f
shr ebp, 0xa
and bpl, al
jne 0x14000a57f
cmp ecx, 1
je 0x14000a57f
mov rdx, qword [rdi + 8]
mov rcx, qword [r13 + 8]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x14000a57f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [r13 + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000a5bb
mov rcx, qword [r13 + 8]
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test ebx, ebx
js 0x14000a5bb
test eax, eax
jne 0x14000a5bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x90], 0
test rcx, rcx
je 0x14000a5d9
call fcn.14000e28c
mov rcx, qword [rsp + 0x80]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14000a5f1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140019150
mov eax, ebx
add rsp, 0x2b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [r13 + 8]
lea rbx, [rsp + 0x98]
mov rcx, rbx
call fcn.14000d060
call fcn.1400148a4
mov dword [rax], 0
mov rcx, rbx
call fcn.14000d0d0
test rax, rax
je 0x14000a754
mov rbp, rax
mov rsi, qword [rsp + 0x88]
mov r15, qword [rsp + 0x90]
mov dword [rsp + 0x34], 0
lea r12, [0x1400304e0]
lea rbx, [rsp + 0x98]
mov rcx, rbp
mov rdx, r12
call fcn.140017208
test eax, eax
je 0x14000a6a7
mov rcx, rbp
lea rdx, [0x1400304de]
call fcn.140017208
test eax, eax
je 0x14000a6a7
test rsi, rsi
je 0x14000a6bc
mov rcx, rbp
mov rdx, r15
call fcn.140017208
test eax, eax
jne 0x14000a6bc
mov rcx, rbx
call fcn.14000d0d0
mov rbp, rax
test rax, rax
jne 0x14000a671
jmp 0x14000a75c
mov r9, qword [r13 + 8]
mov qword [rsp + 0x20], rbp
mov edx, 0x105
lea rcx, [rsp + 0x48]
lea r8, [0x14002ffc4]
call fcn.14000a130
cmp qword [rsp + 0x48], 0
jne 0x14000a6f7
mov eax, dword [rsp + 0x34]
test eax, eax
mov ecx, 0x8007006f
cmovns eax, ecx
mov dword [rsp + 0x34], eax
jmp 0x14000a6a7
mov r9, qword [rdi + 8]
mov qword [rsp + 0x20], rbp
mov edx, 0x105
lea rcx, [rsp + 0x38]
lea r8, [0x14002ffc4]
call fcn.14000a130
cmp qword [rsp + 0x38], 0
je 0x14000a6e3
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x38]
mov r8, r14
call fcn.14000a2f0
mov edx, dword [rsp + 0x34]
test edx, edx
mov ecx, eax
cmovs ecx, edx
test eax, eax
cmovs edx, ecx
mov dword [rsp + 0x34], edx
call fcn.1400148a4
mov dword [rax], 0
jmp 0x14000a6a7
mov dword [rsp + 0x34], 0
call fcn.1400148a4
cmp dword [rax], 0
mov ebx, 0x80004005
mov eax, dword [rsp + 0x34]
cmove ebx, eax
test eax, eax
cmovs ebx, eax
mov rcx, qword [rsp + 0x98]
cmp rcx, 0xffffffffffffffff
je 0x14000a467
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x14000a467