Function at 0x140032a40
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor edi, edi
mov rsi, rdx
mov ebp, edi
mov dword [rax + 0x18], edi
mov r15d, edi
mov r13, rcx
call fcn.14002ef04
lea r12d, [rdi + 1]
mov rbx, rax
test rax, rax
je 0x140032ab1
mov rax, qword [rbx]
or r9d, 0xffffffff
or dword [rsp + 0x28], 0xffffffff
mov r8, rsi
mov edx, r12d
mov qword [rsp + 0x20], rax
mov ecx, 0x409
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
je 0x140032b51
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x140032a77
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, rsi
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140032b07
mov rcx, rax
call fcn.14005d124
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test ebx, ebx
jne 0x140032b1d
mov rcx, rsi
call fcn.14000c064
test eax, eax
je 0x140033070
mov r12d, 2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x140032b5b
lea ebp, [rax + 0xe]
jmp 0x140033075
mov ebp, 0xb7
jmp 0x140033075
xorps xmm0, xmm0
mov rcx, rsi
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
call fcn.140030840
mov qword [r14], rax
mov dword [r14 + 8], r12d
call fcn.14003101c
mov rcx, r13
mov qword [r14 + 0x10], rax
call fcn.14002e128
mov rsi, rax
test rax, rax
jne 0x140032d61
xor edx, edx
xor ecx, ecx
mov esi, edi
mov rbx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
nop dword [rax + rax]
mov r12d, eax
test eax, eax
jne 0x140032bf6
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
jns 0x140032cce
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x140032cf6
lea ebx, [r12 + 1]
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140032c6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
jns 0x140032cce
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x140032cf6
mov rdx, rbx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
nop dword [rax + rax]
test eax, eax
jne 0x140032cc2
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
mov r12d, 0x80070000
movzx eax, ax
or eax, r12d
test ecx, ecx
cmovle eax, ecx
test eax, eax
jns 0x140032cec
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx esi, ax
or esi, r12d
test eax, eax
cmovle esi, eax
test esi, esi
js 0x140032cf6
cmp di, word [rbx]
jne 0x140032cf3
mov esi, 0x8007000d
jmp 0x140032cf6
mov ebp, 0x80004005
mov ecx, ebp
movzx eax, bp
and ecx, 0x1fff0000
cmp ecx, 0x70000
cmove ebp, eax
jmp 0x140033003
mov esi, 0x80004005
jmp 0x140032cf6
mov r15, rbx
test esi, esi
mov r12, rdi
cmovs r12, rbx
test r12, r12
je 0x140032d24
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test esi, esi
jns 0x140032d5e
mov ebp, esi
bt esi, 0x1c
jae 0x140032cd3
mov ecx, esi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
cmp eax, 0x13d
je 0x140033003
mov ecx, esi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ebp, eax
jmp 0x140033003
mov rsi, r15
mov ecx, dword [r14 + 8]
mov ebx, edi
sub ecx, 1
je 0x140032e34
cmp ecx, 1
je 0x140032d7f
mov ebx, 0xb
jmp 0x140032e5c
mov rcx, qword [r14]
lea rdx, str._filehashes_.dat
call fcn.14000c2d8
lea rdx, str._filehashes_.dat
mov qword [rsp + 0x98], rax
mov rcx, rsi
call fcn.14000c2d8
mov rcx, qword [rsp + 0x98]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov rdx, rax
mov qword [rsp + 0x20], rdi
mov r12, rax
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
nop dword [rax + rax]
test eax, eax
jne 0x140032de0
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test r12, r12
je 0x140032e05
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov r12, qword [rsp + 0x98]
test r12, r12
je 0x140032e58
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
jmp 0x140032e58
mov rcx, qword [r14]
lea rdx, str._filehashes_.dat
mov r8, rsi
call fcn.140033ce4
test eax, eax
jne 0x140032e7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test ebx, ebx
je 0x140032e7b
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
jmp 0x140032d57
lea rdx, str._filehashes_.dat
mov rcx, rsi
call fcn.14000c2d8
mov rsi, rax
test rax, rax
jne 0x140032e9a
lea ebp, [rax + 0xe]
jmp 0x140033003
lea rax, [rsp + 0x90]
mov rcx, rsi
mov qword [rsp + 0x30], rax
call fcn.1400966bc
mov rbx, rax
test rax, rax
jne 0x140032ec1
mov ebp, 0x490
jmp 0x140032f9e
mov r12, rbx
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], di
jne 0x140032ec8
lea rcx, [rax + 1]
lea rcx, [rbx + rcx*2]
mov qword [rsp + 0x98], rcx
cmp dword [rsp + 0x90], edi
jbe 0x140032f62
cmp word [r12], di
je 0x140032f62
mov edx, 0x3d
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcsrchr]
nop dword [rax + rax]
test rax, rax
je 0x140033066
lea r8, [rax + 2]
mov word [rax], di
mov rdx, r12
mov rcx, r14
call fcn.140033d7c
test eax, eax
je 0x140033053
mov rcx, qword [rsp + 0x98]
or rax, 0xffffffffffffffff
mov r12, rcx
inc rax
cmp word [rcx + rax*2], di
jne 0x140032f37
lea rcx, [rcx + rax*2]
mov rax, r12
sub rax, rbx
add rcx, 2
sar rax, 1
mov qword [rsp + 0x98], rcx
cmp eax, dword [rsp + 0x90]
jb 0x140032eea
mov rcx, r13
call fcn.14002ef04
mov qword [r14 + 0x28], rax
test r13, r13
je 0x140032f9b
cmp dword [r13], 0xfeedf001
je 0x140032f94
cmp dword [r13], 0xfeedf002
jne 0x140032f9b
call fcn.14002e0d0
mov r13, rax
test rax, rax
je 0x140032f9b
mov qword [r13 + 0x1d8], r14
mov r14, rdi
mov rcx, rsi
call fcn.14000c138
test eax, eax
je 0x140032fb9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test rbx, rbx
je 0x140032fde
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test rsi, rsi
je 0x140033003
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test r15, r15
je 0x140033028
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test r14, r14
je 0x14003304d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test ebp, ebp
je 0x140033085
jmp 0x140033075
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebp, eax
jmp 0x140032f9e
mov ebp, 0xd
jmp 0x140032f9e
mov ebp, 0xb
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
test ebp, ebp
mov rbx, qword [rsp + 0x80]
sete dil
mov eax, edi
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret