Function at 0x14005e710
Capabilities:
Delete file
Move file

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov qword [rbp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rdi, rcx
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x44], 0xffffffff
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
xor r15d, r15d
mov qword [rsp + 0x58], r15
mov byte [rsp + 0x48], r15b
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x78], r15
mov byte [rsp + 0x68], r15b
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x68], r15
mov byte [rbp - 0x78], r15b
mov dword [rbp - 0x58], r15d
mov dword [rbp - 0x54], 1
mov r14d, r15d
xor r8d, r8d
lea rdx, [rsp + 0x40]
call fcn.14005fe70
test al, al
jne 0x14005e7a5
mov r14d, dword [rdi + 0x30]
mov byte [rdi + 0x40], 0
cmp dword [rbp - 0x54], 2
jne 0x14005e87e
cmp qword [rsp + 0x58], 0
je 0x14005e87e
cmp dword [rdi + 0x30], 0
je 0x14005e825
mov dword [rdi + 0x30], r15d
mov byte [rdi + 0xf0], 0
mov rcx, rdi
call fcn.14005faa0
mov edx, 0x152
lea rcx, [rbp + 0x50]
call fcn.1400160a0
nop
mov r8d, r15d
cmp byte [rdi + 0x200], r8b
setne r8b
lea rcx, [rdi + 0x100]
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov rdx, rax
call fcn.140063660
nop
lea rcx, [rbp + 0x50]
call fcn.14000c7e0
cmp byte [rdi + 0xc], 0
je 0x14005e85b
lea rcx, [rdi + 0x128]
lea rdx, [rbp + 0x70]
call fcn.140061330
cmp qword [rax + 0x18], 0x10
jb 0x14005e845
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rbp + 0x70]
call fcn.14000c7e0
mov byte [rdi + 0xc], 0
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.14005f610
test al, al
je 0x14005ee23
mov byte [rdi + 0x5c], 1
jmp 0x14005ee23
lea rcx, [rdi + 0x1c0]
lea rax, [rbp - 0x78]
cmp rcx, rax
je 0x14005e89e
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x78]
call fcn.14000ca10
cmp byte [rdi + 0xc], 0
je 0x14005eb4d
lea rdx, [rbp + 0x30]
lea rcx, [rdi + 0x128]
call fcn.140052520
mov rbx, rax
lea rdx, [rbp - 0x50]
lea rcx, [rdi + 0x128]
call fcn.140061330
nop
mov rdx, rbx
mov rcx, rax
call fcn.1400385f0
movzx ebx, al
mov rcx, qword [rbp - 0x38]
cmp rcx, 0x10
jb 0x14005e934
inc rcx
mov rdx, qword [rbp - 0x50]
cmp rcx, 0x1000
jb 0x14005e92c
test dl, 0x1f
je 0x14005e8ff
call fcn.140128ff4
int3
mov rax, qword [rdx - 8]
cmp rax, rdx
jb 0x14005e90e
call fcn.140128ff4
int3
sub rdx, rax
cmp rdx, 8
jae 0x14005e91d
call fcn.140128ff4
int3
cmp rdx, 0x27
jbe 0x14005e929
call fcn.140128ff4
int3
mov rdx, rax
mov rcx, rdx
call fcn.1400eb7f4
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x40], r15
mov byte [rbp - 0x50], 0
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14005e9a5
mov rax, qword [rbp + 0x40]
sub rax, rcx
cmp rax, 0x1000
jb 0x14005e994
test cl, 0x1f
je 0x14005e967
call fcn.140128ff4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14005e976
call fcn.140128ff4
int3
sub rcx, rax
cmp rcx, 8
jae 0x14005e985
call fcn.140128ff4
int3
cmp rcx, 0x27
jbe 0x14005e991
call fcn.140128ff4
int3
mov rcx, rax
call fcn.1400eb7f4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r15
lea rcx, [rdi + 0x128]
test bl, bl
je 0x14005ea3b
lea rdx, [rbp - 0x30]
call fcn.140061450
cmp qword [rax + 0x18], 0x10
jb 0x14005e9c7
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rax, qword [rbp - 0x18]
cmp rax, 0x10
jb 0x14005ea26
inc rax
mov rcx, qword [rbp - 0x30]
cmp rax, 0x1000
jb 0x14005ea21
test cl, 0x1f
je 0x14005e9f4
call fcn.140128ff4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14005ea03
call fcn.140128ff4
int3
sub rcx, rax
cmp rcx, 8
jae 0x14005ea12
call fcn.140128ff4
int3
cmp rcx, 0x27
jbe 0x14005ea1e
call fcn.140128ff4
int3
mov rcx, rax
call fcn.1400eb7f4
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x20], r15
mov byte [rbp - 0x30], 0
jmp 0x14005eb49
lea rdx, [rbp + 0x10]
call fcn.140061330
mov rbx, rax
lea rdx, [rbp - 0x10]
lea rcx, [rdi + 0x128]
call fcn.140061450
cmp qword [rbx + 0x18], 0x10
jb 0x14005ea61
mov rbx, qword [rbx]
cmp qword [rax + 0x18], 0x10
jb 0x14005ea6b
mov rax, qword [rax]
mov r8d, 9
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov rax, qword [rbp + 8]
cmp rax, 0x10
jb 0x14005ead3
inc rax
mov rcx, qword [rbp - 0x10]
cmp rax, 0x1000
jb 0x14005eace
test cl, 0x1f
je 0x14005eaa1
call fcn.140128ff4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14005eab0
call fcn.140128ff4
int3
sub rcx, rax
cmp rcx, 8
jae 0x14005eabf
call fcn.140128ff4
int3
cmp rcx, 0x27
jbe 0x14005eacb
call fcn.140128ff4
int3
mov rcx, rax
call fcn.1400eb7f4
mov qword [rbp + 8], reloc.WS2_32.dll_ntohs
mov qword [rbp], r15
mov byte [rbp - 0x10], 0
mov rax, qword [rbp + 0x28]
cmp rax, 0x10
jb 0x14005eb39
inc rax
mov rcx, qword [rbp + 0x10]
cmp rax, 0x1000
jb 0x14005eb34
test cl, 0x1f
je 0x14005eb07
call fcn.140128ff4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14005eb16
call fcn.140128ff4
int3
sub rcx, rax
cmp rcx, 8
jae 0x14005eb25
call fcn.140128ff4
int3
cmp rcx, 0x27
jbe 0x14005eb31
call fcn.140128ff4
int3
mov rcx, rax
call fcn.1400eb7f4
mov qword [rbp + 0x28], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x20], r15
mov byte [rbp + 0x10], 0
mov byte [rdi + 0xc], 0
cmp dword [rbp - 0x54], 1
jne 0x14005eb91
mov r8d, dword [rsp + 0x44]
cmp dword [rdi + 0xa8], r8d
je 0x14005eb91
test r8d, r8d
jg 0x14005eb73
mov r8d, 0xe10
mov dword [rsp + 0x44], r8d
jmp 0x14005eb79
cmp r8d, 5
jl 0x14005eb80
mov dword [rdi + 0xa8], r8d
lea rcx, [rdi + 0x230]
mov edx, 3
call fcn.140060bd0
test r14d, r14d
setg al
mov byte [rdi + 0xac], al
mov byte [rdi + 0xad], 0
mov ebx, dword [rbp - 0x58]
cmp ebx, 0x64
jbe 0x14005ebaf
mov ebx, dword [rdi + 0x30]
mov dword [rdi + 0x3c], r15d
mov eax, dword [rdi + 0x30]
cmp eax, ebx
jne 0x14005ebcd
cmp byte [rdi + 0x41], 0
je 0x14005ee23
mov byte [rdi + 0x40], 1
jmp 0x14005ee23
mov rcx, rdi
test eax, eax
jne 0x14005ec91
mov edx, ebx
call fcn.14005fdb0
mov esi, eax
cmp eax, 1
jne 0x14005ec3e
mov edx, 0x150
lea rcx, [rbp + 0x90]
call fcn.1400160a0
nop
mov r8d, r15d
cmp byte [rdi + 0x200], r8b
setne r8b
lea rcx, [rdi + 0x100]
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov rdx, rax
call fcn.140063660
nop
lea rcx, [rbp + 0x90]
call fcn.14000c7e0
jmp 0x14005ee0c
mov edx, 0x151
lea rcx, [rbp + 0xb0]
call fcn.1400160a0
nop
mov r8d, r15d
cmp byte [rdi + 0x200], r8b
setne r8b
lea rcx, [rdi + 0x100]
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov rdx, rax
call fcn.140063660
nop
lea rcx, [rbp + 0xb0]
jmp 0x14005ee03
call fcn.14005faa0
test ebx, ebx
jne 0x14005ecf1
mov edx, 0x152
lea rcx, [rbp + 0xd0]
call fcn.1400160a0
nop
mov r8d, r15d
cmp byte [rdi + 0x200], r8b
setne r8b
lea rcx, [rdi + 0x100]
mov byte [rsp + 0x38], bl
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov rdx, rax
call fcn.140063660
nop
lea rcx, [rbp + 0xd0]
call fcn.14000c7e0
jmp 0x14005ee15
cmp byte [rdi + 0x5c], 0
je 0x14005ed4f
mov edx, 0x152
lea rcx, [rbp + 0xf0]
call fcn.1400160a0
nop
mov r8d, r15d
cmp byte [rdi + 0x200], r8b
setne r8b
lea rcx, [rdi + 0x100]
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov rdx, rax
call fcn.140063660
nop
lea rcx, [rbp + 0xf0]
call fcn.14000c7e0
jmp 0x14005ee23
mov edx, ebx
mov rcx, rdi
call fcn.14005fdb0
mov esi, eax
cmp eax, 1
jne 0x14005edb5
mov edx, 0x153
lea rcx, [rbp + 0x110]
call fcn.1400160a0
nop
mov r8d, r15d
cmp byte [rdi + 0x200], r8b
setne r8b
lea rcx, [rdi + 0x100]
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov rdx, rax
call fcn.140063660
nop
lea rcx, [rbp + 0x110]
call fcn.14000c7e0
jmp 0x14005ee0c
mov edx, 0x154
lea rcx, [rbp + 0x130]
call fcn.1400160a0
nop
mov r8d, r15d
cmp byte [rdi + 0x200], r8b
setne r8b
lea rcx, [rdi + 0x100]
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov rdx, rax
call fcn.140063660
nop
lea rcx, [rbp + 0x130]
call fcn.14000c7e0
mov dword [rdi + 0x30], r15d
cmp esi, 2
sete al
mov byte [rdi + 0x5c], al
mov dword [rdi + 0x30], ebx
test ebx, ebx
setg al
mov byte [rdi + 0xf0], al
lea rcx, [rbp - 0x78]
call fcn.14000c7e0
lea rcx, [rsp + 0x68]
call fcn.14000c7e0
lea rcx, [rsp + 0x48]
call fcn.14000c7e0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret