Function at 0x14002dba0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd0
mov rax, qword [0x140231ec8]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rbx, rdx
mov rdi, rcx
mov rsi, qword [rbp + 0x7f]
cmp r8d, 0x4e
jne 0x14002df25
mov rax, qword [rcx]
cmp qword [rsi], rax
jne 0x14002df25
xor r15d, r15d
mov qword [rbp - 0x79], r15
mov eax, dword [rsi + 0x10]
cmp eax, 0xfffffe34
je 0x14002e103
cmp eax, 0xfffffe35
je 0x14002dfe5
cmp eax, 0xfffffe36
je 0x14002df80
cmp eax, 0xfffffe38
je 0x14002dea7
cmp eax, 0xfffffe3a
je 0x14002ddfa
cmp eax, 0xfffffe3d
je 0x14002dd4c
cmp eax, 0xfffffe64
je 0x14002dd12
cmp eax, 0xfffffffb
jne 0x14002df25
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x71], rax
lea r9, [rbp - 0x71]
xor r8d, r8d
mov edx, 0x1111
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, qword [rbp - 0x61]
test r9, r9
je 0x14002df25
mov edx, 0x110b
lea r8d, [r15 + 9]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SendMessageW]
test byte [rbp - 0x69], 4
je 0x14002df25
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_ClientToScreen]
mov dword [rbp - 0x41], 4
mov rax, qword [rbp - 0x61]
mov qword [rbp - 0x39], rax
lea r9, [rbp - 0x41]
xor r8d, r8d
mov edx, 0x113e
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14002df25
mov r8, qword [rbp - 0x11]
test r8, r8
je 0x14002df25
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, qword [r8 + 8]
mov r8, qword [r8]
mov rdx, rbx
mov rcx, rdi
call fcn.14002c878
jmp 0x14002df25
cmp word [rsi + 0x18], 0x2e
je 0x14002dd42
cmp word [rsi + 0x18], 0x71
je 0x14002dd38
cmp word [rsi + 0x18], 0x74
jne 0x14002df25
mov dl, byte [rcx + 0x10]
call fcn.14002f340
jmp 0x14002df25
call fcn.14002eb2c
jmp 0x14002df25
call fcn.14002c6ac
jmp 0x14002df25
lea r8, [rsi + 0x58]
mov qword [rbp - 0x41], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x31], xmm0
movdqa xmm1, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x31], xmm1
mov word [rbp - 0x41], r15w
lea r9, [rbp - 0x41]
call fcn.14002d5b4
test al, al
je 0x14002dda7
lea rbx, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rbx, qword [rbp - 0x41]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetParent]
mov r9, rbx
xor r8d, r8d
mov edx, 0x800b
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
nop
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14002dde8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
mov ebx, 0x1000
cmp rdx, rbx
jb 0x14002dde3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e359
call fcn.1401af9bc
movdqa xmm0, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x31], xmm0
jmp 0x14002df20
test byte [rsi + 0x68], 0x40
jne 0x14002df25
mov rbx, qword [rsi + 0x88]
test rbx, rbx
je 0x14002df25
mov eax, dword [0x140232db0]
mov ecx, eax
inc eax
mov dword [0x140232db0], eax
test ecx, ecx
jne 0x14002df25
mov rcx, qword [rbx]
mov rax, qword [rcx]
lea rdx, [rbp - 0x79]
mov qword [rsp + 0x20], rdx
lea r9, [0x1401f53f0]
xor r8d, r8d
mov rdx, qword [rbx + 8]
mov rax, qword [rax + 0x28]
call qword [case.0x1400f1dc3.0]
test eax, eax
js 0x14002de73
mov rax, qword [rsi + 0x60]
mov qword [rsp + 0x20], rax
mov r9, qword [rbx + 0x10]
mov r8, qword [rbp - 0x79]
mov rdx, qword [rdi]
mov rcx, rdi
call fcn.14002cab4
mov rax, qword [rsi + 0x60]
mov qword [rbp - 0x59], rax
lea rax, [0x14002f310]
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x49], r15
lea r9, [rbp - 0x59]
xor r8d, r8d
mov edx, 0x1115
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SendMessageW]
dec dword [0x140232db0]
jmp 0x14002df25
mov qword [rbp - 0x41], r15
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x31], r15
mov r14d, 7
mov qword [rbp - 0x29], r14
mov word [rbp - 0x41], r15w
lea r8, [rsi + 0x58]
lea r9, [rbp - 0x41]
call fcn.14002d5b4
test al, al
jne 0x14002df4e
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14002df18
mov ebx, 0x1000
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
cmp rdx, rbx
mov rax, rcx
jb 0x14002df13
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e35f
call fcn.1401af9bc
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x29], r14
mov word [rbp - 0x41], r15w
xor eax, eax
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1401afad0
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp qword [rbp - 0x31], r15
jne 0x14002df6d
cmp byte [0x140233a44], r15b
je 0x14002df6d
lea rdx, [0x1401dc2f0]
lea rcx, [rbp - 0x41]
call fcn.140012fc0
lea rdx, [rbp - 0x41]
mov ecx, 1
call fcn.140029c98
jmp 0x14002ded7
mov rbx, qword [rsi + 0x50]
test rbx, rbx
je 0x14002df25
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400f1dc3.0]
mov rcx, qword [0x14025af80]
mov rax, qword [rcx]
mov rdx, qword [rbx + 8]
mov rax, qword [rax + 0x28]
call qword [case.0x1400f1dc3.0]
mov rcx, qword [0x14025af80]
mov rax, qword [rcx]
mov rdx, qword [rbx + 0x10]
mov rax, qword [rax + 0x28]
call qword [case.0x1400f1dc3.0]
mov rcx, qword [0x14025af80]
mov rax, qword [rcx]
mov rdx, rbx
mov rax, qword [rax + 0x28]
call qword [case.0x1400f1dc3.0]
jmp 0x14002df25
mov rcx, qword [rsi + 0x48]
test rcx, rcx
jne 0x14002dff6
lea eax, [rcx + 1]
jmp 0x14002df27
mov qword [rbp - 0x41], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x31], xmm0
movdqa xmm1, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x31], xmm1
mov word [rbp - 0x41], r15w
lea rdx, [rbp - 0x41]
mov rcx, qword [rcx + 0x10]
call fcn.1400e3ab4
test al, al
je 0x14002e0a2
lea rcx, [rbp - 0x41]
call fcn.1400cbff4
test al, al
je 0x14002e0a2
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 9]
call fcn.1400e393c
nop
mov rbx, qword [rax + 0x10]
lea rcx, [rbp - 9]
call fcn.140006b94
test rbx, rbx
je 0x14002e0a2
mov r8d, 1
mov byte [rdi + 0x11], r8b
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14002e09d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
mov ebx, 0x1000
cmp rdx, rbx
jb 0x14002e098
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e365
call fcn.1401af9bc
mov r8, r15
jmp 0x14002e0e9
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14002e0e3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
mov ebx, 0x1000
cmp rdx, rbx
jb 0x14002e0de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e365
call fcn.1401af9bc
mov r8d, 1
movdqa xmm0, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x31], xmm0
mov word [rbp - 0x41], r15w
mov rax, r8
jmp 0x14002df27
mov byte [rcx + 0x11], r15b
cmp qword [rsi + 0x30], r15
je 0x14002df25
mov rcx, qword [rsi + 0x48]
test rcx, rcx
je 0x14002df25
mov qword [rbp - 0x41], r15
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x31], r15
mov r14d, 7
mov qword [rbp - 0x29], r14
mov word [rbp - 0x41], r15w
lea rdx, [rbp - 0x41]
mov rcx, qword [rcx + 0x10]
call fcn.1400e3ab4
mov ebx, 0x1000
test al, al
je 0x14002e2e5
mov qword [rbp - 9], r15
mov qword [rbp + 7], r15
mov qword [rbp + 0xf], r15
mov r15, qword [rbp - 0x31]
lea r12, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae r12, qword [rbp - 0x41]
movabs r13, 0x7ffffffffffffffe
cmp r15, r13
ja 0x14002e36b
mov qword [rbp + 0xf], r14
cmp r15, 8
jae 0x14002e1a8
mov qword [rbp + 7], r15
lea r8d, [r14 + 9]
mov rdx, r12
lea rcx, [rbp - 9]
call fcn.1401b1b70
jmp 0x14002e226
mov rax, r15
or rax, r14
cmp rax, r13
jbe 0x14002e1c3
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14002e1f1
mov r13, rax
mov ecx, 0xa
cmp rax, rcx
cmovb r13, rcx
lea rcx, [r13 + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14002e347
add rcx, rcx
cmp rcx, rbx
jb 0x14002e1f8
call fcn.14000417c
jmp 0x14002e206
test rcx, rcx
je 0x14002e204
call fcn.1401af980
jmp 0x14002e206
xor eax, eax
mov qword [rbp - 9], rax
mov qword [rbp + 7], r15
mov qword [rbp + 0xf], r13
lea r8, [r15*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.1401b1b70
nop
lea rdx, [rbp - 9]
lea rcx, [rbp - 9]
call fcn.1400e1f54
mov rdx, qword [rsi + 0x30]
or r8, 0xffffffffffffffff
xor r15d, r15d
inc r8
cmp word [rdx + r8*2], r15w
jne 0x14002e23e
lea rcx, [rbp - 9]
call fcn.140006c24
lea rcx, [rbp - 9]
call fcn.1400cbff4
test al, al
je 0x14002e272
mov ecx, 0x50d
call fcn.1400f70b0
mov rcx, rax
call fcn.14016b72c
jmp 0x14002e29c
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rdx, qword [rbp - 9]
lea rcx, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x14002e325
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x14002e2d8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
cmp rdx, rbx
mov rax, rcx
jb 0x14002e2d3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e353
call fcn.1401af9bc
mov word [rbp - 9], r15w
mov qword [rbp + 0xf], r14
mov qword [rbp + 7], r15
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14002df18
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
cmp rdx, rbx
mov rax, rcx
jb 0x14002df13
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e34d
jmp 0x14002df13
mov dl, byte [rdi + 0x10]
mov rcx, rdi
call fcn.14002f340
mov r8d, 1
lea rdx, [rbp - 9]
mov rcx, rdi
call fcn.14002f178
jmp 0x14002e29c
call fcn.140006b74
nop
call fcn.1401b6b94
nop
call fcn.1401b6b94
nop
call fcn.1401b6b94
int3
call fcn.1401b6b94
int3
call fcn.1401b6b94
nop
call fcn.140006bf8
int3