Function at 0x140049da0
Capabilities:
Delete file
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
cmp byte [rcx], 0
mov rdi, rcx
mov rbp, rdx
je 0x14004a1a0
mov rdx, rcx
xor eax, eax
jmp 0x140049ddb
cmp eax, 0x80000000
je 0x14004a1a0
add rdx, 1
add eax, 1
cmp byte [rdx], 0
jne 0x140049dd0
and eax, 0x7fffffff
lea r13d, [rax + 1]
mov rsi, r13
cmp byte [rbp], 0
je 0x14004a1b0
mov rdx, rbp
xor eax, eax
jmp 0x140049e13
cmp eax, 0x80000000
je 0x14004a1b0
add rdx, 1
add eax, 1
cmp byte [rdx], 0
jne 0x140049e08
and eax, 0x7fffffff
lea r14d, [rax + 1]
mov rbx, r14
lea rcx, [r13 + r14]
add rcx, rcx
call sub.msvcrt.dll_malloc
mov r12, rax
test rax, rax
je 0x14004a1ea
mov dword [rsp + 0x28], esi
mov r9d, esi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r15, [rax + r13*2]
mov r8, rdi
call rsi
test eax, eax
jne 0x140049fb0
lea rax, [r13 - 1]
cmp rax, 0xe
jbe 0x14004a1c7
mov rdx, r13
xor eax, eax
pxor xmm3, xmm3
and edx, 0xfffffff0
nop word cs:[rax + rax]
movdqu xmm0, xmmword [rdi + rax]
movdqa xmm1, xmm3
pcmpgtb xmm1, xmm0
movdqa xmm2, xmm0
punpcklbw xmm2, xmm1
punpckhbw xmm0, xmm1
movups xmmword [r12 + rax*2], xmm2
movups xmmword [r12 + rax*2 + 0x10], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x140049e90
mov rax, r13
and rax, 0xfffffffffffffff0
test r13b, 0xf
je 0x140049fb0
mov rdx, r13
sub rdx, rax
lea rcx, [rdx - 1]
cmp rcx, 6
jbe 0x140049f1c
movq xmm0, qword [rdi + rax]
pxor xmm1, xmm1
lea rcx, [r12 + rax*2]
pcmpgtb xmm1, xmm0
movdqa xmm2, xmm0
punpcklbw xmm0, xmm1
punpcklbw xmm2, xmm1
pshufd xmm0, xmm0, 0x4e
movq qword [rcx], xmm2
movq qword [rcx + 8], xmm0
mov rcx, rdx
and rcx, 0xfffffffffffffff8
add rax, rcx
and edx, 7
je 0x140049fb0
movsx cx, byte [rdi + rax]
lea rdx, [rax + rax]
mov word [r12 + rax*2], cx
lea rcx, [rax + 1]
cmp rcx, r13
jae 0x140049fb0
movsx cx, byte [rdi + rax + 1]
mov word [r12 + rdx + 2], cx
lea rcx, [rax + 2]
cmp rcx, r13
jae 0x140049fb0
movsx cx, byte [rdi + rax + 2]
mov word [r12 + rdx + 4], cx
lea rcx, [rax + 3]
cmp rcx, r13
jae 0x140049fb0
movsx cx, byte [rdi + rax + 3]
mov word [r12 + rdx + 6], cx
lea rcx, [rax + 4]
cmp rcx, r13
jae 0x140049fb0
movsx cx, byte [rdi + rax + 4]
mov word [r12 + rdx + 8], cx
lea rcx, [rax + 5]
cmp rcx, r13
jae 0x140049fb0
movsx cx, byte [rdi + rax + 5]
mov word [r12 + rdx + 0xa], cx
lea rcx, [rax + 6]
cmp rcx, r13
jae 0x140049fb0
movsx ax, byte [rdi + rax + 6]
mov word [r12 + rdx + 0xc], ax
nop dword [rax + rax]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov r9d, ebx
mov qword [rsp + 0x20], r15
mov r8, rbp
call rsi
test eax, eax
jne 0x14004a110
lea rax, [r14 - 1]
cmp rax, 0xe
jbe 0x14004a1c0
mov rdx, r14
xor eax, eax
pxor xmm3, xmm3
and edx, 0xfffffff0
nop word [rax + rax]
movdqu xmm0, xmmword [rbp + rax]
movdqa xmm1, xmm3
pcmpgtb xmm1, xmm0
movdqa xmm2, xmm0
punpcklbw xmm2, xmm1
punpckhbw xmm0, xmm1
movups xmmword [r15 + rax*2], xmm2
movups xmmword [r15 + rax*2 + 0x10], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x140049ff0
mov rax, r14
and rax, 0xfffffffffffffff0
test r14b, 0xf
je 0x14004a110
mov rdx, r14
sub rdx, rax
lea rcx, [rdx - 1]
cmp rcx, 6
jbe 0x14004a081
movq xmm0, qword [rbp + rax]
pxor xmm1, xmm1
add r13, rax
lea rcx, [r12 + r13*2]
pcmpgtb xmm1, xmm0
movdqa xmm2, xmm0
punpcklbw xmm0, xmm1
punpcklbw xmm2, xmm1
pshufd xmm0, xmm0, 0x4e
movq qword [rcx], xmm2
movq qword [rcx + 8], xmm0
mov rcx, rdx
and rcx, 0xfffffffffffffff8
add rax, rcx
and edx, 7
je 0x14004a110
movsx cx, byte [rbp + rax]
lea rdx, [rax + rax]
mov word [r15 + rax*2], cx
lea rcx, [rax + 1]
cmp rcx, r14
jae 0x14004a110
movsx cx, byte [rbp + rax + 1]
mov word [r15 + rdx + 2], cx
lea rcx, [rax + 2]
cmp rcx, r14
jae 0x14004a110
movsx cx, byte [rbp + rax + 2]
mov word [r15 + rdx + 4], cx
lea rcx, [rax + 3]
cmp rcx, r14
jae 0x14004a110
movsx cx, byte [rbp + rax + 3]
mov word [r15 + rdx + 6], cx
lea rcx, [rax + 4]
cmp rcx, r14
jae 0x14004a110
movsx cx, byte [rbp + rax + 4]
mov word [r15 + rdx + 8], cx
lea rcx, [rax + 5]
cmp rcx, r14
jae 0x14004a110
movsx cx, byte [rbp + rax + 5]
mov word [r15 + rdx + 0xa], cx
lea rcx, [rax + 6]
cmp rcx, r14
jae 0x14004a110
movsx ax, byte [rbp + rax + 6]
mov word [r15 + rdx + 0xc], ax
nop
mov rbx, qword [sym.imp.KERNEL32.dll_MoveFileW]
mov rdx, r15
mov rcx, r12
call rbx
test eax, eax
je 0x14004a140
xor ebx, ebx
cmp rdi, r12
jne 0x14004a190
mov eax, ebx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
cmp eax, 0xb7
je 0x14004a155
cmp eax, 0x50
jne 0x14004a170
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14004a16e
mov rdx, r15
mov rcx, r12
call rbx
test eax, eax
jne 0x14004a123
call rsi
lea edx, [rax - 2]
cmp edx, 1
jbe 0x14004a1dc
cmp eax, 5
je 0x14004a1ce
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
mov ebx, 0xffffffff
jmp 0x14004a125
mov rcx, r12
call sub.msvcrt.dll_free
jmp 0x14004a12a
mov r13d, 1
mov esi, 1
jmp 0x140049df3
mov r14d, 1
mov ebx, 1
jmp 0x140049e2b
xor eax, eax
jmp 0x14004a02f
xor eax, eax
jmp 0x140049ece
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0xd
jmp 0x14004a189
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 2
jmp 0x14004a189
or ebx, 0xffffffff
jmp 0x14004a12a