Function at 0x140006850
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x140023010]
xor rax, rsp
mov qword [rbp + 0x30], rax
movsxd rsi, edx
mov r13, rcx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
xor r15d, r15d
mov r14d, r15d
mov qword [rsp + 0x48], r15
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 0xe
mov qword [rbp - 0x38], 0xf
movsd xmm0, qword [str..dmp.split.tmp]
movsd qword [rbp - 0x50], xmm0
mov eax, dword [0x14001d7b8]
mov dword [rbp - 0x48], eax
movzx eax, word [0x14001d7bc]
mov word [rbp - 0x44], ax
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x10]
call fcn.140008c40
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140006915
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006910
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006910
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140017264
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 0xa
mov qword [rbp - 0x38], 0xf
movsd xmm0, qword [str..dmp.split]
movsd qword [rbp - 0x50], xmm0
movzx eax, word [0x14001d7d0]
mov word [rbp - 0x48], ax
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x10]
call fcn.140008c40
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140006990
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000698b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000698b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140017264
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov ebx, 1
mov rdi, qword [rsp + 0x40]
nop word [rax + rax]
mov rdx, r13
lea rcx, [rsp + 0x70]
call fcn.140002a70
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140005c90
nop
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140006c62
mov rdx, r13
lea rcx, [rsp + 0x50]
call fcn.140002a70
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
mov r9d, esi
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140005c90
nop
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrename]
test eax, eax
jne 0x140006b17
cmp rdi, r14
je 0x140006a64
lea rdx, [rbp - 0x30]
mov rcx, rdi
call fcn.140002a70
add rdi, 0x20
mov qword [rsp + 0x40], rdi
jmp 0x140006a7f
lea r8, [rbp - 0x30]
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.1400080b0
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140006abf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006aba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006b4e
call fcn.140017264
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x140006b10
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ca5
call fcn.140017264
inc ebx
jmp 0x1400069b0
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140006b5a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006b55
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140017264
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x140006bab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ba6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ca5
call fcn.140017264
mov r15, rdi
mov r12, qword [rsp + 0x38]
sub r15, r12
sar r15, 5
cmp rsi, r15
je 0x140006cfd
cmp ebx, esi
jg 0x140006cb3
mov rdx, r13
lea rcx, [rsp + 0x50]
call fcn.140002a70
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140005c90
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140006c1f
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x140006c5b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006c56
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006cac
call fcn.140017264
inc ebx
jmp 0x140006bc3
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x140006bab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ba6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006ba6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor r13d, r13d
mov esi, r13d
test r15, r15
je 0x140006cf9
mov rbx, r12
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140006cce
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140006ceb
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140006ce5
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
inc esi
add rbx, 0x20
movsxd rax, esi
cmp rax, r15
jb 0x140006cc1
xor bl, bl
jmp 0x140006d02
mov bl, 1
xor r13d, r13d
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x140006d45
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006d40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140017264
movdqa xmm0, xmmword [0x14001dd60]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], r13w
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x140006d9a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006d95
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140017264
movdqa xmm0, xmmword [0x14001dd60]
movdqu xmmword [rbp], xmm0
mov word [rbp - 0x10], r13w
test r12, r12
je 0x140006df7
mov rdx, rdi
mov rcx, r12
call fcn.140007c40
sub r14, r12
and r14, 0xffffffffffffffe0
mov rax, r12
cmp r14, 0x1000
jb 0x140006dec
add r14, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006dec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r14
mov rcx, r12
call fcn.140017264
movzx eax, bl
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140016f60
mov rbx, qword [rsp + 0x190]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret