Function at 0x14003b530
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rsi, r8
mov rdi, rcx
mov r11, rdx
test rdx, rdx
je 0x14003b59c
mov r10d, dword [rdx]
test r10d, r10d
je 0x14003b59c
mov eax, r10d
nop dword [rax + rax]
cmp eax, 1
je 0x14003b5ef
mov eax, dword [r11 + 4]
add r11, 8
add r11, rax
mov eax, dword [r11]
test eax, eax
jne 0x14003b560
test r10d, r10d
je 0x14003b59c
cmp r10d, 1
je 0x14003b7d5
mov eax, dword [rdx + 4]
add rdx, 8
add rdx, rax
mov r10d, dword [rdx]
test r10d, r10d
jne 0x14003b580
test r9, r9
je 0x14003b5cb
mov eax, dword [r9]
test eax, eax
je 0x14003b5cb
nop dword [rax + rax]
cmp eax, 1
je 0x14003b7d5
mov eax, dword [r9 + 4]
add r9, 8
add r9, rax
mov eax, dword [r9]
test eax, eax
jne 0x14003b5b0
mov rdx, rsi
mov rcx, rdi
mov rbx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14003b79e
xor ebp, ebp
mov ebx, ebp
jmp 0x14003b7d1
mov rcx, r9
test r9, r9
je 0x14003b57b
mov eax, dword [r9]
test eax, eax
je 0x14003b57b
cmp eax, 1
je 0x14003b620
mov eax, dword [rcx + 4]
add rcx, 8
add rcx, rax
mov eax, dword [rcx]
test eax, eax
jne 0x14003b606
jmp 0x14003b57b
mov qword [rsp + 0xa8], r14
test rdi, rdi
je 0x14003b782
test rsi, rsi
je 0x14003b782
mov rdx, rdi
lea rcx, [rsp + 0x30]
call qword [0x140098040]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 0x4020
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
xor ebp, ebp
mov dword [rsp + 0x50], 0x30
lea r9, [rsp + 0x40]
mov qword [rsp + 0x58], rbp
lea r8, [rsp + 0x50]
mov dword [rsp + 0x68], 0x40
mov edx, 0x110000
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0xa0]
movdqu xmmword [rsp + 0x70], xmm0
call qword [0x140098010]
test eax, eax
jns 0x14003b6b5
lfence
mov ecx, eax
call qword [0x140098038]
mov ecx, eax
jmp 0x14003b787
mov rbx, 0xffffffffffffffff
mov rdi, rbx
nop
inc rdi
cmp word [rsi + rdi*2], bp
jne 0x14003b6c0
add rdi, rdi
lea rcx, [rdi + 0x18]
call fcn.14004fe74
mov r14, rax
test rax, rax
jne 0x14003b701
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0xa0]
call qword [section..data]
mov r14, qword [rsp + 0xa8]
jmp 0x14003b7d1
lea rcx, [rax + 0x14]
mov r8, rdi
mov rdx, rsi
call fcn.14004f4b0
movzx eax, byte [rsp + 0xc0]
lea r9d, [rdi + 0x18]
mov rcx, qword [rsp + 0xa0]
lea rdx, [rsp + 0x40]
and al, 1
mov qword [r14 + 8], rbp
mov r8, r14
mov byte [r14], al
mov dword [r14 + 0x10], edi
mov dword [rsp + 0x20], 0xa
call qword [0x140098030]
mov rcx, r14
mov ebx, eax
call fcn.14004fe60
mov ecx, ebx
call qword [0x140098038]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0xa0]
call qword [section..data]
mov r14, qword [rsp + 0xa8]
test ebx, ebx
setns bpl
lea ebx, [rbp - 1]
jmp 0x14003b7d1
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rsp + 0xa8]
mov rbx, 0xffffffffffffffff
jmp 0x14003b7d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14003b7d1
test byte [rsp + 0xc0], 1
je 0x14003b7d1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
xor ebp, ebp
test eax, eax
cmovne ebx, ebp
test ebx, ebx
je 0x14003b7e3
call fcn.14003cef0
mov ecx, eax
call fcn.14003ce30
jmp 0x14003b7e5
xor eax, eax
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret