Function at 0x14002afec
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5e8]
sub rsp, 0x6c0
mov rax, qword [0x14003d0f8]
xor rax, rsp
mov qword [rbp + 0x5b8], rax
mov qword [rsp + 0x40], rcx
mov rdx, rsp
lea rcx, [0x14004ff50]
call sub.msvcrt.dll__setjmp
xor r12d, r12d
test eax, eax
jne 0x14002b81c
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0x78]
call fcn.14000d3f0
or r14, 0xffffffffffffffff
mov rbx, rax
mov rax, r14
inc rax
cmp word [rbx + rax*2], r12w
jne 0x14002b05f
lea rdi, [rbx + 2]
lea rdi, [rdi + rax*2]
cmp word [rbx], r12w
je 0x14002b868
cmp word [rdi], r12w
je 0x14002b868
mov rax, r14
inc rax
cmp word [rdi + rax*2], r12w
jne 0x14002b088
cmp word [rdi + rax*2 + 2], r12w
jne 0x14002b868
mov rcx, rbx
call fcn.140011ea0
mov rdx, r14
inc rdx
cmp word [rbx + rdx*2], r12w
jne 0x14002b0a9
inc rdx
mov r8, rax
mov rcx, rbx
call fcn.1400113e0
mov rcx, rdi
call fcn.140011ea0
mov rdx, r14
inc rdx
cmp word [rdi + rdx*2], r12w
jne 0x14002b0cc
inc rdx
mov r8, rax
mov rcx, rdi
call fcn.1400113e0
mov rcx, rbx
call fcn.1400091c0
mov rsi, rax
cmp rax, 1
jne 0x14002b101
mov ecx, dword [0x140045ba8]
call fcn.14002afbc
int3
mov r13d, 0x104
mov qword [rbp + 0x158], r12
mov r8d, r13d
mov byte [rbp + 0x160], 1
xor edx, edx
mov qword [rbp + 0x168], r13
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_memset
mov r8d, r13d
mov qword [rbp + 0x378], r12
xor edx, edx
mov byte [rbp + 0x380], 1
lea rcx, [rbp + 0x170]
mov qword [rbp + 0x388], r13
call sub.msvcrt.dll_memset
mov al, byte [rbp + 0x160]
lea rcx, [rsp + 0x50]
neg al
mov r15d, 0x7ee3
sbb rdx, rdx
and rdx, r15
add rdx, r13
call fcn.14000ca40
test eax, eax
js 0x14002b85d
mov al, byte [rbp + 0x380]
lea rcx, [rbp + 0x170]
neg al
sbb rdx, rdx
and rdx, r15
add rdx, r13
call fcn.14000ca40
test eax, eax
js 0x14002b85d
mov rax, qword [0x140058458]
lea r15, [0x140058250]
test rax, rax
lea rcx, [rsp + 0x50]
mov rdx, r15
cmovne rdx, rax
call fcn.14000b364
mov rax, qword [0x140058458]
lea rcx, [rbp + 0x170]
test rax, rax
mov rdx, r15
cmovne rdx, rax
call fcn.14000b364
mov rcx, qword [rbp + 0x158]
lea rax, [rsp + 0x50]
test rcx, rcx
cmovne rax, rcx
inc r14
cmp word [rax + r14*2], r12w
jne 0x14002b1f1
mov rax, qword [rsi + 0x30]
test byte [rax], 0x10
jne 0x14002b214
mov rdx, qword [rsi + 0x20]
lea rcx, [rsp + 0x50]
call fcn.140008940
jmp 0x14002b245
dec r14d
lea rax, [rsp + 0x50]
test rcx, rcx
movsxd rdx, r14d
cmovne rax, rcx
lea rcx, [rbp + 0x170]
mov word [rax + rdx*2], r12w
mov rax, qword [rbp + 0x378]
test rax, rax
cmovne rcx, rax
mov word [rcx + rdx*2], r12w
test byte [rsi + 0x38], 8
jne 0x14002b295
mov rax, qword [rbp + 0x158]
lea rcx, [rsp + 0x50]
test rax, rax
cmovne rcx, rax
call fcn.140011ea0
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov rcx, qword [rsi + 0x30]
mov dword [rcx], eax
mov rax, qword [rsi + 0x30]
cmp dword [rax], 0xffffffff
jne 0x14002b295
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
call fcn.14002afbc
int3
mov eax, 0x3a
cmp word [rdi + 2], ax
je 0x14002b852
lea edx, [rax + 0x22]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x14002b852
mov r8, r13
mov qword [rbp + 0x598], r12
xor edx, edx
mov byte [rbp + 0x5a0], 1
lea rcx, [rbp + 0x390]
mov qword [rbp + 0x5a8], r13
call sub.msvcrt.dll_memset
mov al, byte [rbp + 0x5a0]
lea rcx, [rbp + 0x390]
neg al
sbb rdx, rdx
and edx, 0x7ee3
add rdx, r13
call fcn.14000ca40
test eax, eax
jns 0x14002b314
mov ecx, 0x2374
call fcn.14002afbc
int3
mov rax, qword [0x140058458]
lea rcx, [rbp + 0x390]
test rax, rax
lea rdx, [rbp + 0x5b0]
cmovne r15, rax
mov rax, qword [rbp + 0x598]
test rax, rax
cmovne rcx, rax
movzx eax, word [r15]
mov word [rcx], ax
lea rcx, [rbp + 0x390]
mov rax, qword [rbp + 0x598]
test rax, rax
cmovne rcx, rax
mov eax, 0x3a
mov word [rcx + 2], ax
mov rcx, rbx
mov dword [rbp + 0x5b0], 0x3f002a
mov word [rbp + 0x5b4], r12w
call fcn.140013bac
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rbx + rcx*2], r12w
jne 0x14002b381
cmp rax, rcx
lea r8, [rsp + 0x38]
mov rax, qword [rbp + 0x158]
lea rdx, [rsp + 0x50]
mov ecx, 0x20
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x30], ecx
mov r8d, ecx
mov ebx, r12d
lea rcx, [0x140018590]
setb bl
test rax, rax
cmovne rdx, rax
mov rax, qword [rsi + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call fcn.14001823c
test al, al
jne 0x14002b455
mov rax, qword [rbp + 0x158]
lea rcx, [rsp + 0x38]
test rax, rax
mov qword [rsp + 0x28], rcx
mov r8d, 0x10
lea rdx, [rsp + 0x50]
cmovne rdx, rax
mov dword [rsp + 0x30], r8d
mov rax, qword [rsi + 0x30]
lea rcx, [0x140018590]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call fcn.14001823c
test al, al
jne 0x14002b43c
mov ecx, dword [0x140045ba8]
mov r12d, 2
cmp ecx, 0x12
cmove ecx, r12d
mov dword [0x140045ba8], ecx
call fcn.14002afbc
int3
test ebx, ebx
je 0x14002b455
mov rcx, qword [rsp + 0x38]
call fcn.140013a0c
mov ecx, 0x232a
call fcn.14002afbc
int3
mov rax, qword [rbp + 0x158]
lea rcx, [rsp + 0x50]
mov rbx, qword [rsp + 0x38]
test rax, rax
movsxd r13, r14d
mov r15d, r12d
cmovne rcx, rax
xor edx, edx
mov word [rcx + r13*2], r12w
mov r12d, 2
cmp dword [0x140041924], edx
jne 0x14002b7b0
mov rax, qword [rsi + 0x30]
test byte [rax], 0x10
je 0x14002b58a
mov rax, qword [rbp + 0x378]
lea rcx, [rbp + 0x170]
test rax, rax
cmovne rcx, rax
test rcx, rcx
je 0x14002b780
mov edx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
nop dword [rax + rax]
xor r8d, r8d
mov r9, rax
test rax, rax
je 0x14002b780
add r9, r12
lea rax, [rbp + 0x170]
mov word [r9], r8w
mov rdx, qword [rbp + 0x378]
test rdx, rdx
cmovne rax, rdx
or r10, 0xffffffffffffffff
mov rcx, r10
inc rcx
cmp word [rax + rcx*2], r8w
jne 0x14002b4fa
mov rax, r10
inc rax
cmp word [rdi + rax*2], r8w
jne 0x14002b507
inc rax
add rax, rcx
cmp rax, 0x7fe7
ja 0x14002b768
test rdx, rdx
lea rcx, [rbp + 0x170]
mov rax, r9
mov r8, rdi
cmovne rcx, rdx
mov rdx, qword [rbp + 0x388]
sub rax, rcx
mov rcx, r9
sar rax, 1
sub rdx, rax
call fcn.1400113e0
mov rax, qword [rbp + 0x378]
lea rdx, [rbp + 0x170]
xor r8d, r8d
lea rcx, [rbp + 0x170]
test rax, rax
cmovne rdx, rax
cmovne rcx, rax
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r8w
jne 0x14002b576
mov word [rdx + rax*2], r8w
jmp 0x14002b65f
mov rax, qword [rbp + 0x158]
lea rcx, [rsp + 0x50]
test rax, rax
cmovne rcx, rax
mov word [rcx + r13*2], dx
lea rcx, [rsp + 0x50]
mov rdx, qword [rsi + 0x30]
add rdx, 0x2c
call fcn.140008940
mov rax, qword [rbp + 0x158]
lea rdx, [rsp + 0x50]
test rax, rax
lea rcx, [rbp + 0x390]
mov r8, rdi
cmovne rdx, rax
mov rax, qword [rbp + 0x598]
test rax, rax
cmovne rcx, rax
lea r9, [rdx + r13*2]
mov edx, dword [rbp + 0x5a8]
call fcn.140004c18
mov r8, qword [rbp + 0x598]
lea rax, [rbp + 0x390]
xor r9d, r9d
test r8, r8
cmovne rax, r8
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], r9w
jne 0x14002b60a
lea eax, [r14 + 1]
movsxd rcx, eax
add rdx, rcx
cmp rdx, 0x7fe7
ja 0x14002b798
mov rax, qword [rbp + 0x378]
lea rcx, [rbp + 0x170]
test rax, rax
lea rdx, [rbp + 0x390]
cmovne rcx, rax
test r8, r8
cmovne rdx, r8
mov word [rcx + r13*2], r9w
lea rcx, [rbp + 0x170]
call fcn.140008940
mov rax, qword [rbp + 0x378]
lea rdx, [rbp + 0x170]
test rax, rax
mov dword [rsp + 0x20], r12d
lea rcx, [rsp + 0x50]
cmovne rdx, rax
mov rax, qword [rbp + 0x158]
test rax, rax
cmovne rcx, rax
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileWithProgressW]
nop dword [rax + rax]
test eax, eax
jne 0x14002b6cb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r15d, eax
mov eax, 0x234d
cmp r15d, 0xb7
cmove r15d, eax
xor edx, edx
mov ecx, r15d
call fcn.140003278
mov r8d, dword [rsp + 0x30]
lea rcx, [0x140018590]
mov rdx, qword [rsi + 0x30]
mov r9, rbx
call fcn.140018a70
xor edx, edx
test al, al
jne 0x14002b480
mov rcx, rbx
call fcn.140013a0c
call fcn.140007d00
mov rcx, qword [rbp + 0x598]
xor edi, edi
test r15d, r15d
mov qword [rbp + 0x598], rdi
mov ebx, edi
setne bl
test rcx, rcx
je 0x14002b723
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x378]
mov qword [rbp + 0x378], rdi
test rcx, rcx
je 0x14002b742
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], rdi
test rcx, rcx
je 0x14002b761
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov eax, ebx
jmp 0x14002b821
mov rcx, rbx
call fcn.140013a0c
call fcn.140007d00
mov ecx, 0x232e
call fcn.14002afbc
int3
mov rcx, rbx
call fcn.140013a0c
call fcn.140007d00
mov ecx, 0x232e
call fcn.14002afbc
int3
mov rcx, rbx
call fcn.140013a0c
call fcn.140007d00
mov ecx, 0x232e
call fcn.14002afbc
int3
mov rcx, rbx
call fcn.140013a0c
call fcn.140007d00
mov rcx, qword [rbp + 0x598]
xor ebx, ebx
mov qword [rbp + 0x598], rbx
test rcx, rcx
je 0x14002b7de
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x378]
mov qword [rbp + 0x378], rbx
test rcx, rcx
je 0x14002b7fd
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x158]
mov qword [rbp + 0x158], rbx
test rcx, rcx
je 0x14002b81c
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov eax, 1
mov rcx, qword [rbp + 0x5b8]
xor rcx, rsp
call fcn.140018f80
lea r11, [rsp + 0x6c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x232a
call fcn.14002afbc
int3
mov ecx, 0x2374
call fcn.14002afbc
int3
mov ecx, 0x232a
call fcn.14002afbc
int3