Function at 0x1400305cc
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push rbp
push rbx
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x140045008]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov rdi, rcx
xor r13d, r13d
mov rbx, r9
mov r12d, r8d
mov r15, rdx
mov ecx, r13d
mov r9d, 0x104
test rdi, rdi
je 0x140030636
mov eax, r9d
mov rcx, rdi
mov r8d, r13d
cmp word [rcx], r13w
je 0x14003062e
add rcx, 2
sub rax, 1
jne 0x14003061e
test rax, rax
jne 0x140030695
mov rcx, r13
mov r8d, 0x80070057
lea rdx, [rcx + rcx]
test r8d, r8d
jns 0x14003069d
mov rdx, r13
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030b49
test byte [rcx + 0x1c], 1
je 0x140030b49
cmp byte [rcx + 0x19], 2
jb 0x140030b49
mov edx, 0xa
mov r9, rdi
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x14003d4f0]
call fcn.1400042f4
jmp 0x140030b49
mov rcx, r9
sub rcx, rax
jmp 0x14003063c
mov rax, r13
test rbx, rbx
je 0x1400306c6
mov rcx, r9
mov rax, rbx
mov r8d, r13d
cmp word [rax], r13w
je 0x1400306be
add rax, 2
sub rcx, 1
jne 0x1400306ae
test rcx, rcx
jne 0x14003072a
mov rax, r13
mov r8d, 0x80070057
lea r14, [rax + rax]
test r8d, r8d
jns 0x140030732
mov r14, r13
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030b49
test byte [rcx + 0x1c], 1
je 0x140030b49
cmp byte [rcx + 0x19], 2
jb 0x140030b49
mov edx, 0xb
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], rdi
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003d4f0]
mov r9, rbx
call fcn.1400304cc
jmp 0x140030b49
mov rax, r9
sub rax, rcx
jmp 0x1400306cc
lea rax, [r14 + rdx]
cmp rax, 0x206
jb 0x14003078b
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030b49
test byte [rcx + 0x1c], 1
je 0x140030b49
cmp byte [rcx + 0x19], 2
jb 0x140030b49
mov edx, 0xc
mov qword [rsp + 0x20], rdi
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003d4f0]
mov r9, rbx
call fcn.140004180
jmp 0x140030b49
mov r8, rdi
lea rcx, [rbp + 0x140]
mov edx, 0x208
call fcn.140003c48
mov r8d, eax
test eax, eax
jns 0x1400307db
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030b49
test byte [rcx + 0x1c], 1
je 0x140030b49
cmp byte [rcx + 0x19], 2
jb 0x140030b49
mov edx, 0xd
jmp 0x140030708
mov r8, rbx
lea rcx, [rbp + 0x140]
call fcn.14003161c
mov r8d, eax
test eax, eax
jns 0x140030826
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030b49
test byte [rcx + 0x1c], 1
je 0x140030b49
cmp byte [rcx + 0x19], 2
jb 0x140030b49
mov edx, 0xe
jmp 0x140030708
test r12d, r12d
je 0x140030aab
mov rax, r13
test r15, r15
je 0x14003085c
mov edx, 0x104
mov rax, r15
mov ecx, edx
mov r8d, r13d
cmp word [rax], r13w
je 0x140030854
add rax, 2
sub rcx, 1
jne 0x140030844
test rcx, rcx
jne 0x14003086c
mov rax, r13
mov r8d, 0x80070057
test r8d, r8d
js 0x140030874
add rax, rax
jmp 0x140030877
mov rax, rdx
sub rax, rcx
jmp 0x140030862
mov rax, r13
test r8d, r8d
jns 0x1400308b4
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030b49
test byte [rcx + 0x1c], 1
je 0x140030b49
cmp byte [rcx + 0x19], 2
jb 0x140030b49
mov edx, 0xf
mov r9, r15
jmp 0x14003067b
add rax, r14
cmp rax, 0x206
jb 0x1400308f9
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030b49
test byte [rcx + 0x1c], 1
je 0x140030b49
cmp byte [rcx + 0x19], 2
jb 0x140030b49
mov edx, 0x10
mov qword [rsp + 0x20], r15
jmp 0x140030773
mov r8, r15
lea rcx, [rsp + 0x30]
mov edx, 0x208
call fcn.140003c48
mov r8d, eax
test eax, eax
jns 0x140030951
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030b49
test byte [rcx + 0x1c], 1
je 0x140030b49
cmp byte [rcx + 0x19], 2
jb 0x140030b49
mov edx, 0x11
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r15
jmp 0x140030712
mov r8, rbx
lea rcx, [rsp + 0x30]
call fcn.14003161c
mov r8d, eax
test eax, eax
jns 0x140030997
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030b49
test byte [rcx + 0x1c], 1
je 0x140030b49
cmp byte [rcx + 0x19], 2
jb 0x140030b49
mov edx, 0x12
jmp 0x140030942
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x140]
cmp r12d, 2
jne 0x140030a2f
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_file_l2_1_2.dll_CopyFileW]
test eax, eax
je 0x1400309ec
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030b49
test byte [rcx + 0x1c], 1
je 0x140030b49
cmp byte [rcx + 0x19], 4
jb 0x140030b49
lea edx, [r12 + 0x11]
jmp 0x140030a69
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030b49
test byte [rcx + 0x1c], 1
je 0x140030b49
cmp byte [rcx + 0x19], 2
jb 0x140030b49
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edx, 0x14
mov r9d, eax
lea rax, [rsp + 0x30]
jmp 0x140030b2d
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_1.dll_MoveFileW]
test eax, eax
je 0x140030a70
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030b49
test byte [rcx + 0x1c], 1
je 0x140030b49
cmp byte [rcx + 0x19], 4
jb 0x140030b49
mov edx, 0x15
lea r9, [rsp + 0x30]
jmp 0x140030ae7
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030b49
test byte [rcx + 0x1c], 1
je 0x140030b49
cmp byte [rcx + 0x19], 2
jb 0x140030b49
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edx, 0x16
jmp 0x140030a22
lea rcx, [rbp + 0x140]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_DeleteFileW]
test eax, eax
je 0x140030af9
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030b49
test byte [rcx + 0x1c], 1
je 0x140030b49
cmp byte [rcx + 0x19], 3
jb 0x140030b49
mov edx, 0x17
lea r9, [rbp + 0x140]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003d4f0]
call fcn.140004060
jmp 0x140030b49
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030b49
test byte [rcx + 0x1c], 1
je 0x140030b49
cmp byte [rcx + 0x19], 2
jb 0x140030b49
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov r9d, eax
mov edx, 0x18
lea rax, [rbp + 0x140]
mov rcx, qword [0x140045158]
lea r8, [0x14003d4f0]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x10]
call fcn.140003f38
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.140039130
add rsp, 0x460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret