Function at 0x10002ab8c
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x500
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov rax, qword [0x1000cc510]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov r13, r8
mov r12, rdx
mov rdi, rcx
mov qword [rsp + 0x90], rdx
xor ebx, ebx
mov dword [rsp + 0x8c], ebx
mov word [rsp + 0xd0], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xd2]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x88], ebx
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x1000aa388]
xor edx, edx
lea r8d, [rbx + 1]
lea rcx, [0x1000aa308]
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x1000461b9
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x70], rbx
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], ebx
mov esi, 0x80000000
mov r9d, esi
xor r8d, r8d
mov rdx, rdi
call qword [rax + 0x18]
cmp eax, ebx
jl 0x1000461ea
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], ebx
mov r9d, esi
xor r8d, r8d
mov rdx, r12
call qword [rax + 0x18]
cmp eax, ebx
jl 0x100046219
movdqu xmm0, xmmword [0x1000a9d70]
movdqu xmmword [rsp + 0xb8], xmm0
movdqu xmmword [rsp + 0xa8], xmm0
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0xb8]
call qword [rax + 0x28]
cmp eax, ebx
jl 0x100046248
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rsp + 0xa8]
call qword [rax + 0x28]
cmp eax, ebx
jl 0x100046268
lea rax, [rsp + 0xb8]
lea rcx, [rsp + 0xa8]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x100046288
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x100046288
mov eax, ebx
jmp 0x10002ad09
cmp eax, ebx
jne 0x100046292
lea rdx, [rsp + 0x2e0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebx
je 0x1000462a2
lea r8, [rsp + 0x2e0]
lea rdx, [rsp + 0xd0]
mov rcx, r12
call fcn.100029f08
jmp 0x10002ad46
cmp eax, ebx
je 0x1000462a9
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + 0x70]
cmp eax, ebx
jl 0x1000462b9
mov dword [rsp + 0x88], 1
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov edi, 0x40000000
mov r8d, edi
lea rdx, [rsp + 0xd0]
call qword [rax + 0x78]
cmp eax, ebx
jl 0x1000462d6
mov dword [rsp + 0x60], ebx
xor eax, eax
mov dword [rsp + 0x64], eax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x28]
cmp eax, ebx
jl 0x1000462f9
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea r9, [rsp + 0x48]
lea r8, [0x1000aa318]
lea rdx, [rsp + 0xa8]
call qword [rax + 0x40]
cmp eax, ebx
jl 0x10004631c
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov edi, 2
mov r8d, edi
mov rdx, qword [rsp + 0x50]
call qword [rax + 0x18]
cmp eax, ebx
jl 0x100046348
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
cmp rdi, rbx
je 0x100046368
cmp rsi, rbx
je 0x100046378
mov rcx, rbx
mov qword [rsp + 0x80], rbx
cmp rdi, rbx
je 0x10002ae58
mov rax, qword [rdi]
lea r8, [rsp + 0x80]
lea rdx, [0x1000aa368]
mov rcx, rdi
call qword [rax]
mov rcx, qword [rsp + 0x80]
cmp rcx, rbx
jne 0x10002afcd
cmp rcx, rbx
jne 0x10002b036
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x68], ebx
mov rdi, qword [rsp + 0x58]
mov rax, qword [rdi]
lea rdx, [rsp + 0x78]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, ebx
jl 0x1000463c4
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
call qword [rax + 0x60]
cmp eax, ebx
jl 0x1000463e1
mov eax, dword [rsp + 0x68]
cmp dword [rsp + 0x78], eax
jne 0x1000463fe
mov edi, ebx
cmp edi, dword [rsp + 0x68]
jae 0x10002aeee
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], edi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa8]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
call fcn.10002a6dc
inc edi
jmp 0x10002aeb5
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x58]
cmp eax, ebx
jl 0x10004640e
mov dword [rsp + 0x8c], 1
mov rcx, qword [rsp + 0x48]
cmp rcx, rbx
je 0x10002af1d
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, rbx
je 0x10002af2e
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x70]
cmp rcx, rbx
je 0x10002af3f
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x58]
cmp rcx, rbx
je 0x10002af50
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x40]
cmp rcx, rbx
je 0x10002af61
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x10002af63
mov r8d, 3
mov rdx, r12
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, eax
cmp eax, ebx
je 0x100046440
mov eax, edi
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.1000010a0
add rsp, 0x500
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rax, rbx
mov qword [rsp + 0x60], rbx
cmp rsi, rbx
je 0x10002affb
mov rax, qword [rsi]
lea r8, [rsp + 0x60]
lea rdx, [0x1000aa378]
mov rcx, rsi
call qword [rax]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x60]
cmp rax, rbx
je 0x100046388
mov r8, qword [rax]
mov rdx, rcx
mov rcx, rax
call qword [r8 + 0x38]
cmp eax, ebx
jl 0x1000463a4
mov rcx, qword [rsp + 0x60]
cmp rcx, rbx
je 0x10002b029
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x80]
jmp 0x10002ae61
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x10002ae6a
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x1000aa388]
xor edx, edx
lea r8d, [rbx + 1]
lea rcx, [0x1000aa308]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, eax
call fcn.1000885ac
nop
jmp 0x10002ac28
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], ebx
mov r9d, esi
xor r8d, r8d
mov rdx, rdi
call qword [rax + 0x18]
mov ecx, eax
call fcn.1000885ac
nop
jmp 0x10002ac61
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], ebx
mov r9d, esi
xor r8d, r8d
mov rdx, r12
call qword [rax + 0x18]
mov ecx, eax
call fcn.1000885ac
nop
jmp 0x10002ac8b
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0xb8]
call qword [rax + 0x28]
mov ecx, eax
call fcn.1000885ac
nop
jmp 0x10002acc0
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rsp + 0xa8]
call qword [rax + 0x28]
mov ecx, eax
call fcn.1000885ac
nop
jmp 0x10002acdb
sbb eax, eax
sbb eax, 0xffffffff
jmp 0x10002ad09
mov ecx, 0x80070057
call fcn.1000885ac
nop
jmp 0x10002ad11
mov eax, ebx
jmp 0x10002ad46
mov ecx, 0x8000ffff
call fcn.1000885ac
nop
jmp 0x10002ad4e
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + 0x70]
mov ecx, eax
call fcn.1000885ac
nop
jmp 0x10002ad6b
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov r8d, edi
lea rdx, [rsp + 0xd0]
call qword [rax + 0x78]
mov ecx, eax
call fcn.1000885ac
nop
jmp 0x10002ad99
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
call qword [rax + 0x28]
mov ecx, eax
call fcn.1000885ac
nop
jmp 0x10002adc1
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea r9, [rsp + 0x48]
lea r8, [0x1000aa318]
lea rdx, [rsp + 0xa8]
call qword [rax + 0x40]
mov ecx, eax
call fcn.1000885ac
nop
jmp 0x10002aded
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov r8d, edi
mov rdx, qword [rsp + 0x50]
call qword [rax + 0x18]
mov ecx, eax
call fcn.1000885ac
nop
jmp 0x10002ae0d
mov ecx, 0x80004003
call fcn.1000885ac
nop
jmp 0x10002ae20
mov ecx, 0x80004003
call fcn.1000885ac
nop
jmp 0x10002ae29
mov ecx, 0x80004002
call fcn.1000885ac
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x60]
jmp 0x10002b004
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x80]
call qword [rax + 0x38]
mov ecx, eax
call fcn.1000885ac
nop
jmp 0x10002b019
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0x78]
call qword [rax + 0x60]
mov ecx, eax
call fcn.1000885ac
nop
jmp 0x10002ae8d
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
call qword [rax + 0x60]
mov ecx, eax
call fcn.1000885ac
nop
jmp 0x10002aea5
mov ecx, 0x80070057
call fcn.1000885ac
nop
jmp 0x10002aeb3
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov ecx, eax
call fcn.1000885ac
nop
jmp 0x10002af01
cmp dword [rsp + 0x88], ebx
je 0x10002af84
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
jmp 0x10002af84