Function at 0x140004400
Capabilities:
Move file

Disassembly:
push rsi
push r12
mov eax, 0x1358
call fcn.140008650
sub rsp, rax
mov rax, qword [0x140030d00]
xor rax, rsp
mov qword [rsp + 0x1330], rax
mov r12d, ecx
mov rsi, rdx
mov rcx, rdx
call fcn.140001fb0
test eax, eax
jne 0x14000443f
mov eax, 1
jmp 0x140004741
mov qword [rsp + 0x1380], rbx
lea rcx, str.YMD
mov qword [rsp + 0x1388], rbp
xor edx, edx
mov qword [rsp + 0x1350], rdi
mov qword [rsp + 0x1348], r14
mov qword [rsp + 0x1340], r15
call fcn.1400066b0
mov ecx, 0x800
mov rbp, rax
call fcn.140001920
mov ecx, 0x800
mov rdi, rax
call fcn.140001920
mov ecx, 0x800
mov r14, rax
call fcn.140001920
mov ecx, 0x800
mov r15, rax
call fcn.140001920
lea rdx, [rsp + 0x50]
mov rcx, rsi
mov rbx, rax
call fcn.1400062c0
mov eax, 0x2d
mov r9, rsi
mov word [rsp + 0x14c], ax
mov r8, r15
mov eax, 0x2e
mov rdx, r14
mov rcx, rdi
mov word [rsp + 0x152], ax
mov word [rsp + 0x158], ax
call fcn.140001d00
movzx ecx, word [rdi + 2]
xor eax, eax
cmp cx, 0x3a
jne 0x140004505
cmp word [rdi + 4], 0x5c
mov edx, 2
cmove eax, edx
cmp word [rdi], 0x5c
jne 0x140004525
cmp cx, 0x5c
jne 0x140004525
cmp word [rdi + 4], 0x3f
jne 0x140004525
cmp word [rdi + 6], 0x5c
mov ecx, 6
cmove eax, ecx
mov r9, qword [0x140031870]
lea rcx, [rdi + rax*2]
lea rax, [rsp + 0x138]
mov edx, 0x400
test r9, r9
jne 0x14000456a
mov qword [rsp + 0x38], r15
lea r8, str._s_s_s__s_s
mov qword [rsp + 0x30], rax
mov r9, rbp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call fcn.140002c00
jmp 0x140004592
mov qword [rsp + 0x40], r15
lea r8, str._s_s_s_s__s_s
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rcx
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call fcn.140002c00
mov rcx, rbx
call fcn.140002000
mov r8d, 0xb
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebp, eax
test eax, eax
jne 0x14000461e
mov rcx, rbx
call fcn.140004180
lea r8d, [rbp + 0xb]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebp, eax
test eax, eax
jne 0x14000461e
call fcn.140005420
lea r8d, [rbp + 1]
mov rdx, rsi
lea rcx, str.MoveFileEx
call fcn.140002950
xor r8d, r8d
lea rcx, str.From:
mov rdx, rsi
call fcn.140002ba0
xor r8d, r8d
lea rcx, [0x140022e40]
mov rdx, rbx
call fcn.140002ba0
call fcn.1400054e0
lock inc qword [0x140032c80]
jmp 0x1400046f7
lea rdx, [rsp + 0x9c0]
mov rcx, rbx
call fcn.1400062c0
call fcn.140006970
test eax, eax
je 0x1400046e2
call fcn.140005420
call fcn.140006a50
test eax, eax
lea rax, [rsp + 0xb28]
je 0x14000469c
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x138]
lea rax, str._to
mov edx, r12d
mov qword [rsp + 0x30], rax
lea r8, str.MoveArc:
lea rax, [rsp + 0x1b8]
mov qword [rsp + 0x28], rax
lea rcx, str._2.2d.__11s__s__s__s_s_s_n
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
call fcn.140002c60
jmp 0x1400046dd
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0xb8]
lea rax, str._to
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x138]
lea rax, [rsp + 0x1b8]
lea rdx, str.MoveArc:
mov qword [rsp + 0x20], rax
lea rcx, str.__11s__s__s__s_s_s_n
call fcn.140002c60
call fcn.1400054e0
lock inc qword [0x140032c60]
mov rax, qword [rsp + 0x58]
lock add qword [0x140032c68], rax
mov rcx, rbx
call fcn.140001880
mov rcx, r15
call fcn.140001880
mov rcx, r14
call fcn.140001880
mov rcx, rdi
call fcn.140001880
mov r15, qword [rsp + 0x1340]
mov eax, ebp
mov rbp, qword [rsp + 0x1388]
mov r14, qword [rsp + 0x1348]
mov rdi, qword [rsp + 0x1350]
mov rbx, qword [rsp + 0x1380]
mov rcx, qword [rsp + 0x1330]
xor rcx, rsp
call fcn.1400086b0
add rsp, 0x1358
pop r12
pop rsi
ret