Function at 0x14004c340
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x140132040]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov r12, rcx
xor r13d, r13d
mov r8d, 0x104
lea rdx, [rbp + 0xc0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14004c7c7
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
lea rax, [rbp + 0xc0]
mov r15, 0xffffffffffffffff
mov r8, r15
inc r8
cmp byte [rax + r8], 0
jne 0x14004c3c4
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x60]
call fcn.14004cd10
nop
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
lea rbx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
setae r14b
mov rsi, qword [rsp + 0x60]
cmovae rbx, rsi
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x14004c4d3
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp - 0x40]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x140128de8]
lea rdx, [0x140128dea]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rbp + rax - 0x40], 1
inc rcx
cmp rcx, rdx
jne 0x14004c440
lea rax, [rdi - 1]
mov r8, r15
cmp rax, r15
cmovb r8, rax
add r8, rbx
movzx eax, byte [r8]
cmp byte [rbp + rax - 0x40], 0
jne 0x14004c483
nop dword [rax]
cmp r8, rbx
je 0x14004c4d3
dec r8
movzx eax, byte [r8]
cmp byte [rbp + rax - 0x40], 0
je 0x14004c470
sub r8, rbx
cmp r8, 0xffffffffffffffff
je 0x14004c4d3
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], 0xf
inc r8
cmp rdi, r8
cmovb r8, rdi
lea rdx, [rsp + 0x60]
test r14b, r14b
cmovne rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.14004cd10
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rbp - 0x50], xmm1
jmp 0x14004c4e9
mov r8d, 2
lea rdx, [0x140128dec]
lea rcx, [rbp - 0x60]
call fcn.14004cd10
mov r15, qword [r12 + 0x10]
movabs rdx, 0x7fffffffffffffff
mov rax, rdx
mov r14, qword [rbp - 0x50]
sub rax, r14
cmp rax, r15
jb 0x14004c7fd
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
setae byte [rsp + 0x30]
mov rsi, qword [rbp - 0x60]
cmovae rax, rsi
mov qword [rsp + 0x58], rax
cmp qword [r12 + 0x18], 0x10
jb 0x14004c532
mov r12, qword [r12]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
lea r13, [r14 + r15]
mov edi, 0xf
lea rbx, [rsp + 0x38]
cmp r13, rdi
jbe 0x14004c5dc
mov rdi, r13
or rdi, 0xf
cmp rdi, rdx
jbe 0x14004c569
mov rdi, rdx
jmp 0x14004c575
mov ecx, 0x16
cmp rdi, rcx
cmovb rdi, rcx
mov rcx, rdi
add rcx, 1
mov rdx, 0xffffffffffffffff
cmovb rcx, rdx
cmp rcx, 0x1000
jb 0x14004c5c1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004c7f7
mov rcx, rax
call fcn.1400521f4
test rax, rax
je 0x14004c6c1
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
mov rax, qword [rsp + 0x58]
jmp 0x14004c5d7
test rcx, rcx
je 0x14004c5d5
call fcn.1400521f4
mov rbx, rax
mov rax, qword [rsp + 0x58]
jmp 0x14004c5d7
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], rdi
mov r8, r14
mov rdx, rax
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + r14]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r13], 0
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x14004c649
lea rax, [rcx + 4]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0x38]
mov dword [rax + rcx], 0x6578652e
mov byte [rax + rcx + 4], 0
lea rax, [rsp + 0x38]
jmp 0x14004c661
mov qword [rsp + 0x20], 4
mov edx, 4
lea rcx, [rsp + 0x38]
call fcn.14004d000
xor edi, edi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], dil
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14004c6cd
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c6c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004c6c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140051fac
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rdx, qword [rbp - 0x80]
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
setne bl
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x14004c735
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c730
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004c730
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140051fac
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
cmp byte [rsp + 0x30], 0
je 0x14004c784
mov rdx, qword [rbp - 0x48]
inc rdx
mov rax, rsi
cmp rdx, 0x1000
jb 0x14004c77b
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004c77b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140051fac
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14004c7c4
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c7bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004c7bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140051fac
movzx eax, bl
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.140051e10
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14004c260
nop
call fcn.14004c300
int3