Function at 0x140036ff0
Capabilities:
Move file

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x7f0
mov rax, qword [0x1405c7418]
xor rax, rsp
mov qword [rsp + 0x7e0], rax
movzx r12d, r8b
mov r14, rdx
mov r15, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rdx
mov byte [rsp + 0x48], r12b
xor esi, esi
mov qword [r11 - 0x700], rsi
mov qword [r11 - 0x6f0], rsi
mov qword [r11 - 0x6e8], rsi
mov qword [r11 - 0x6f0], rsi
mov qword [r11 - 0x6e8], 0xf
mov byte [rsp + 0x118], sil
mov qword [r11 - 0x6f0], rsi
mov byte [rsp + 0x118], sil
mov qword [r11 - 0x680], rsi
mov qword [r11 - 0x670], rsi
mov qword [r11 - 0x668], rsi
mov qword [r11 - 0x670], rsi
mov qword [r11 - 0x668], 0xf
mov byte [rsp + 0x198], sil
mov qword [r11 - 0x670], 9
movsd xmm0, qword [0x1403ec460]
movsd qword [rsp + 0x198], xmm0
movzx eax, byte [0x1403ec468]
mov byte [rsp + 0x1a0], al
mov byte [rsp + 0x1a1], sil
lea r9, [r11 - 0x700]
mov r8d, 0x317
lea rdx, [r11 - 0x680]
lea rcx, [rsp + 0x50]
call fcn.14001aae0
nop
mov rdx, qword [rsp + 0x1b0]
cmp rdx, 0x10
jb 0x140037134
inc rdx
mov rcx, qword [rsp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003712f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037d62
call fcn.1400ab1c4
mov qword [rsp + 0x1a8], rsi
mov qword [rsp + 0x1b0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x198], 0
mov rdx, qword [rsp + 0x130]
cmp rdx, 0x10
jb 0x140037193
inc rdx
mov rcx, qword [rsp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003718e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037d68
call fcn.1400ab1c4
mov qword [rsp + 0x128], rsi
mov qword [rsp + 0x130], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x118], 0
lea rcx, [0x1400218e0]
call fcn.1400ac5d4
mov rdi, rax
mov qword [rsp + 0xd8], rax
mov edx, 1
lea rcx, [rsp + 0x178]
call fcn.14001a0b0
nop
mov rdx, r14
lea rcx, [rsp + 0x138]
call fcn.14002d4d0
mov rbx, rax
cmp qword [rax + 0x18], 8
jb 0x1400371f6
mov rbx, qword [rax]
mov rdx, r15
lea rcx, [rsp + 0x2b8]
call fcn.14002d4d0
nop
cmp qword [rax + 0x18], 8
jb 0x140037211
mov rax, qword [rax]
mov r8d, r12d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
mov rdx, qword [rsp + 0x2d0]
cmp rdx, 8
setae cl
test cl, cl
je 0x14003727f
lea rdx, [rdx*2 + 2]
mov qword [rsp + 0xa0], rdx
mov rcx, qword [rsp + 0x2b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003727a
add rdx, 0x27
mov qword [rsp + 0xa0], rdx
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037e2b
call fcn.1400ab1c4
mov qword [rsp + 0x2c8], rsi
mov qword [rsp + 0x2d0], 7
mov word [rsp + 0x2b8], si
mov rdx, qword [rsp + 0x150]
cmp rdx, 8
setae al
test al, al
je 0x1400372f8
lea rdx, [rdx*2 + 2]
mov qword [rsp + 0xa8], rdx
mov rcx, qword [rsp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400372f3
add rdx, 0x27
mov qword [rsp + 0xa8], rdx
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037e31
call fcn.1400ab1c4
mov qword [rsp + 0x148], rsi
mov qword [rsp + 0x150], 7
mov word [rsp + 0x138], si
test ebx, ebx
je 0x140037348
lea rcx, [rsp + 0x178]
call fcn.14001a0e0
nop
mov rcx, rdi
call fcn.1400ac5d4
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140037343
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x140037d34
mov byte [rsp + 0x41], 0
mov qword [rsp + 0x218], rsi
mov qword [rsp + 0x228], rsi
mov qword [rsp + 0x230], rsi
mov qword [rsp + 0x228], rsi
mov qword [rsp + 0x230], 7
mov word [rsp + 0x218], si
mov r8d, reloc.WS2_32.dll_send
lea rdx, [0x1403ec470]
lea rcx, [rsp + 0x218]
call fcn.140008280
nop
mov dl, 1
lea rcx, [rsp + 0x218]
call fcn.1400383d0
nop
mov rdx, qword [rsp + 0x230]
cmp rdx, 8
setae al
test al, al
je 0x140037409
lea rdx, [rdx*2 + 2]
mov qword [rsp + 0xb0], rdx
mov rcx, qword [rsp + 0x218]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037404
add rdx, 0x27
mov qword [rsp + 0xb0], rdx
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037e36
call fcn.1400ab1c4
mov qword [rsp + 0x228], rsi
mov qword [rsp + 0x230], 7
mov word [rsp + 0x218], si
mov qword [rsp + 0x238], rsi
mov qword [rsp + 0x248], rsi
mov qword [rsp + 0x250], rsi
mov qword [rsp + 0x248], rsi
mov qword [rsp + 0x250], 7
mov word [rsp + 0x238], si
mov r8d, reloc.WS2_32.dll_select
lea rdx, [0x1403ec498]
lea rcx, [rsp + 0x238]
call fcn.140008280
nop
mov dl, 1
lea rcx, [rsp + 0x238]
call fcn.1400383d0
nop
mov rdx, qword [rsp + 0x250]
cmp rdx, 8
setae al
test al, al
je 0x1400374e1
lea rdx, [rdx*2 + 2]
mov qword [rsp + 0xb8], rdx
mov rcx, qword [rsp + 0x238]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400374dc
add rdx, 0x27
mov qword [rsp + 0xb8], rdx
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037e3b
call fcn.1400ab1c4
mov qword [rsp + 0x248], rsi
mov qword [rsp + 0x250], 7
mov word [rsp + 0x238], si
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x68], rsi
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14003751c
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x68], rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xf]
mov rcx, r15
call fcn.1400337a0
mov byte [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.140046af0
test al, al
je 0x140037580
test r12b, r12b
je 0x140037d6e
cmp byte [rsp + 0x40], 0
jne 0x140037e41
mov r8, qword [rsp + 0x68]
mov edx, 4
mov rcx, r14
call fcn.140038260
jmp 0x1400375b4
mov dword [rsp + 0x198], 0x18
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x1a0], rax
mov dword [rsp + 0x1a8], esi
lea rdx, [rsp + 0x198]
mov rcx, r14
call fcn.140046630
mov byte [rsp + 0x41], 1
mov qword [rsp + 0x258], rsi
mov qword [rsp + 0x268], rsi
mov qword [rsp + 0x270], rsi
mov qword [rsp + 0x268], rsi
mov qword [rsp + 0x270], 7
mov word [rsp + 0x258], si
mov r8d, reloc.WS2_32.dll_select
lea rdx, [0x1403ec548]
lea rcx, [rsp + 0x258]
call fcn.140008280
nop
xor edx, edx
lea rcx, [rsp + 0x258]
call fcn.1400383d0
nop
mov rdx, qword [rsp + 0x270]
cmp rdx, 8
setae al
test al, al
je 0x140037670
lea rdx, [rdx*2 + 2]
mov qword [rsp + 0xc8], rdx
mov rcx, qword [rsp + 0x258]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003766b
add rdx, 0x27
mov qword [rsp + 0xc8], rdx
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037ef8
call fcn.1400ab1c4
mov qword [rsp + 0x268], rsi
mov qword [rsp + 0x270], 7
mov word [rsp + 0x258], si
mov qword [rsp + 0x278], rsi
mov qword [rsp + 0x288], rsi
mov qword [rsp + 0x290], rsi
mov qword [rsp + 0x288], rsi
mov qword [rsp + 0x290], 7
mov word [rsp + 0x278], si
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.SeSecurityPrivilege
lea rcx, [rsp + 0x278]
call fcn.140008280
nop
xor edx, edx
lea rcx, [rsp + 0x278]
call fcn.1400383d0
nop
mov rdx, qword [rsp + 0x290]
cmp rdx, 8
setae al
test al, al
je 0x140037748
lea rdx, [rdx*2 + 2]
mov qword [rsp + 0xd0], rdx
mov rcx, qword [rsp + 0x278]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037743
add rdx, 0x27
mov qword [rsp + 0xd0], rdx
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037efd
call fcn.1400ab1c4
mov qword [rsp + 0x288], rsi
mov qword [rsp + 0x290], 7
mov word [rsp + 0x278], si
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140037779
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
mov edx, 1
lea rcx, [rsp + 0x80]
call fcn.140031020
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rsi
mov edx, 1
lea rcx, [rsp + 0x90]
call fcn.140031020
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x118], rsi
mov qword [rsp + 0x128], rsi
mov qword [rsp + 0x130], rsi
mov qword [rsp + 0x128], rsi
mov qword [rsp + 0x130], 7
mov word [rsp + 0x118], si
mov qword [rsp + 0x1f8], rsi
mov qword [rsp + 0x208], rsi
mov qword [rsp + 0x210], rsi
mov qword [rsp + 0x208], rsi
mov qword [rsp + 0x210], 7
mov word [rsp + 0x1f8], si
mov qword [rsp + 0x1b8], rsi
mov qword [rsp + 0x1c8], rsi
mov qword [rsp + 0x1d0], rsi
mov qword [rsp + 0x1c8], rsi
mov qword [rsp + 0x1d0], 7
mov word [rsp + 0x1b8], si
lea rcx, [rsp + 0x580]
call fcn.140026200
nop
lea rdx, [0x1403ec598]
lea rcx, [rsp + 0x138]
call fcn.140005460
nop
lea r8, [rsp + 0x138]
mov rdx, r15
lea rcx, [rsp + 0x2b8]
call fcn.14002d800
nop
mov rdx, rax
lea rcx, [rsp + 0x580]
call fcn.1400264e0
movzx ebx, al
lea rcx, [rsp + 0x2b8]
call fcn.140007ea0
nop
lea rcx, [rsp + 0x138]
call fcn.140007ea0
test bl, bl
je 0x140037a5e
nop dword [rax]
lea rcx, [rsp + 0x580]
call fcn.140026830
test al, al
jne 0x140037a49
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0x580]
call fcn.140026480
nop
mov rdx, rax
lea rcx, [rsp + 0x1b8]
call fcn.1400068c0
nop
lea rcx, [rsp + 0x138]
call fcn.140007ea0
lea r8, [rsp + 0x1b8]
mov rdx, r15
lea rcx, [rsp + 0x2b8]
call fcn.14002d800
nop
mov rdx, rax
lea rcx, [rsp + 0x118]
call fcn.1400068c0
nop
lea rcx, [rsp + 0x2b8]
call fcn.140007ea0
lea r8, [rsp + 0x1b8]
mov rdx, r14
lea rcx, [rsp + 0x298]
call fcn.14002d800
nop
mov rdx, rax
lea rcx, [rsp + 0x1f8]
call fcn.1400068c0
nop
lea rcx, [rsp + 0x298]
call fcn.140007ea0
lea rcx, [rsp + 0x580]
call fcn.140026820
test al, al
je 0x1400379fc
mov rdx, r14
lea rcx, [rsp + 0x118]
call fcn.14002e0f0
test al, al
jne 0x140037a49
movzx r8d, r12b
lea rdx, [rsp + 0x1f8]
lea rcx, [rsp + 0x118]
call fcn.140036ff0
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x90]
call fcn.1400257d0
jmp 0x140037a49
mov r8d, 0x64
lea rdx, [rsp + 0x1f8]
lea rcx, [rsp + 0x118]
call fcn.140037f10
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x80]
call fcn.1400257d0
nop
jmp 0x140037a49
lea rcx, [rsp + 0x580]
call fcn.140026b90
test al, al
jne 0x1400378f0
mov rdx, r14
mov rcx, r15
call fcn.14002e0f0
test al, al
jne 0x140037a9a
mov rdx, r15
lea rcx, [rsp + 0x138]
call fcn.140033db0
nop
mov r8, rax
mov dl, 1
mov rcx, r15
call fcn.1400349f0
nop
lea rcx, [rsp + 0x138]
call fcn.140007ea0
nop
lea rcx, [rsp + 0x580]
call fcn.1400262a0
nop
mov rdx, qword [rsp + 0x1d0]
cmp rdx, 8
setae al
test al, al
je 0x140037b05
lea rdx, [rdx*2 + 2]
mov qword [rsp + 0xe0], rdx
mov rcx, qword [rsp + 0x1b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037b00
add rdx, 0x27
mov qword [rsp + 0xe0], rdx
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037f03
call fcn.1400ab1c4
mov qword [rsp + 0x1c8], rsi
mov qword [rsp + 0x1d0], 7
mov word [rsp + 0x1b8], si
mov rdx, qword [rsp + 0x210]
cmp rdx, 8
setae al
test al, al
je 0x140037b7e
lea rdx, [rdx*2 + 2]
mov qword [rsp + 0xe8], rdx
mov rcx, qword [rsp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037b79
add rdx, 0x27
mov qword [rsp + 0xe8], rdx
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037f09
call fcn.1400ab1c4
mov qword [rsp + 0x208], rsi
mov qword [rsp + 0x210], 7
mov word [rsp + 0x1f8], si
mov rdx, qword [rsp + 0x130]
cmp rdx, 8
setae al
test al, al
je 0x140037bf7
lea rdx, [rdx*2 + 2]
mov qword [rsp + 0xf0], rdx
mov rcx, qword [rsp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037bf2
add rdx, 0x27
mov qword [rsp + 0xf0], rdx
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037d5c
call fcn.1400ab1c4
mov qword [rsp + 0x128], rsi
mov qword [rsp + 0x130], 7
mov word [rsp + 0x118], si
lea rcx, [rsp + 0x90]
call fcn.1400063f0
nop
lea rcx, [rsp + 0x80]
call fcn.1400063f0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test al, al
je 0x140037d09
mov rbx, qword [rsp + 0x50]
mov rax, qword [rbx]
mov r12, qword [rax + 0x18]
mov r9, r14
mov r8, r15
lea rdx, [0x1403ec5a0]
lea rcx, [rsp + 0x158]
call fcn.140004fe0
nop
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x1d8]
call fcn.140019c30
mov r14, rax
mov qword [rsp + 0x298], rsi
mov qword [rsp + 0x2a8], rsi
mov qword [rsp + 0x2b0], rsi
mov qword [rsp + 0x2a8], rsi
mov qword [rsp + 0x2b0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x298], 0
mov r8d, 8
lea rdx, [0x1403ec5e8]
lea rcx, [rsp + 0x298]
call fcn.140008120
nop
mov r8, r14
lea rdx, [rsp + 0x298]
mov rcx, rbx
call r12
nop
lea rcx, [rsp + 0x298]
call fcn.140006290
nop
lea rcx, [rsp + 0x1d8]
call fcn.140006290
nop
lea rcx, [rsp + 0x158]
call fcn.140007ea0
nop
lea rcx, [rsp + 0x178]
call fcn.14001a0e0
nop
mov rcx, rdi
call fcn.1400ac5d4
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140037d34
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rcx, qword [rsp + 0x7e0]
xor rcx, rsp
call fcn.1400ab7b0
mov rbx, qword [rsp + 0x838]
add rsp, 0x7f0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.1400b1d8c
nop
call fcn.1400b1d8c
nop
call fcn.1400b1d8c
nop
lea rdx, [0x1403ec4c0]
lea rcx, [rsp + 0x138]
call fcn.140005380
nop
lea rcx, [rsp + 0x4c0]
call fcn.140005740
nop
mov r9d, 0x329
lea r8, [rsp + 0x138]
mov rdx, rax
lea rcx, [rsp + 0x300]
call fcn.1400057f0
mov rdi, rax
mov rcx, r14
call fcn.1400083b0
mov qword [rsp + 0xc0], rax
lea r8, [rsp + 0xc0]
lea rdx, [0x1403ec4d0]
lea rcx, [rsp + 0x560]
call fcn.1400048b0
mov rbx, rax
lea rcx, [rsp + 0x4e0]
call fcn.140005740
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x500]
call fcn.1400033e0
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x370]
call fcn.14001d280
lea rdx, [0x1405c2328]
lea rcx, [rsp + 0x370]
call fcn.1400ac6bc
nop
call fcn.1400b1d8c
nop
call fcn.1400b1d8c
call fcn.1400b1d8c
call fcn.1400b1d8c
nop
lea rdx, [0x1403ec508]
lea rcx, [rsp + 0x138]
call fcn.140005380
nop
lea rcx, [rsp + 0x520]
call fcn.140005740
nop
mov r9d, 0x32b
lea r8, [rsp + 0x138]
mov rdx, rax
lea rcx, [rsp + 0x300]
call fcn.1400057f0
mov rdi, rax
mov rcx, r14
call fcn.1400083b0
mov qword [rsp + 0x78], rax
lea r8, [rsp + 0x78]
lea rdx, str.File__s_already_exists
lea rcx, [rsp + 0x540]
call fcn.1400048b0
mov rbx, rax
lea rcx, [rsp + 0x350]
call fcn.140005740
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x2d8]
call fcn.1400033e0
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x3a8]
call fcn.14001d280
lea rdx, [0x1405c2328]
lea rcx, [rsp + 0x3a8]
call fcn.1400ac6bc
nop
call fcn.1400b1d8c
call fcn.1400b1d8c
nop
call fcn.1400b1d8c
nop
call fcn.1400b1d8c
int3