Function at 0x14000aa20
Capabilities:
Create directory
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
mov rdi, r9
mov r13, r8
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x140037010]
xor rax, rsp
mov qword [rsp + 0x2c8], rax
mov rcx, qword [r8 + 8]
mov r15b, 1
test rcx, rcx
je 0x14000aaa0
mov rdx, qword [r14 + 8]
test rdx, rdx
jne 0x14000aa88
mov rax, qword [r14]
movzx eax, word [rcx + rax*2]
cmp ax, 0x5c
setne cl
test ax, ax
setne r15b
and r15b, cl
jmp 0x14000aaa0
mov r8, qword [r14]
cmp r8, qword [r13]
ja 0x14000aaa0
call fcn.140017894
test eax, eax
jne 0x14000aaa0
mov rcx, qword [r13 + 8]
jmp 0x14000aa6e
mov eax, dword [rsi + 4]
cmp eax, 0xffffffff
je 0x14000ab39
mov ecx, eax
and ecx, 0x10
je 0x14000ab39
test eax, 0x400
jne 0x14000ab39
mov eax, dword [rsi]
add eax, 0xffffffff
cmp eax, 1
jbe 0x14000ab39
mov ebx, dword [rsp + 0x350]
mov rcx, rsi
mov rdx, r14
mov r8, rdi
call fcn.14000b590
test eax, eax
je 0x14000abd7
cmp ebx, 1
jne 0x14000aaf3
cmp eax, 2
je 0x14000abd7
xor ecx, ecx
cmp eax, 1
mov ebp, 0x80004005
cmove ebp, ecx
cmp qword [rsi + 8], 0xffffffffffffffff
je 0x14000ab30
mov eax, dword [rsi + 4]
cmp eax, 0xffffffff
setne cl
test al, 0x10
je 0x14000ab30
cmp eax, 0xffffffff
je 0x14000ab30
mov edx, dword [rsi]
cmp edx, 2
je 0x14000ab30
cmp edx, 1
je 0x14000ab30
shr eax, 0xa
and al, cl
je 0x14000ad34
test ebp, ebp
mov eax, 0x80004005
jmp 0x14000aba6
mov rcx, rsi
mov rdx, rdi
call fcn.14000b9b0
mov ebx, eax
mov ecx, dword [rsi + 4]
cmp ecx, 0xffffffff
setne dl
cmp ecx, 0xffffffff
je 0x14000ab6e
mov eax, dword [rsi]
cmp eax, 2
je 0x14000ab6e
cmp eax, 1
je 0x14000ab6e
shr ecx, 0xa
xor eax, eax
mov edi, 0
and cl, dl
je 0x14000ab7f
mov rcx, r14
mov rdx, rsi
call fcn.14000b890
test eax, eax
setns dil
test dil, dil
mov ebp, ebx
cmovne ebp, eax
test ebx, ebx
cmovns ebp, eax
test eax, eax
cmovs ebp, eax
or r15b, dil
jne 0x14000aba9
mov rcx, r14
mov rdx, rsi
xor r8d, r8d
call fcn.14000a670
test ebp, ebp
cmovns ebp, eax
mov rcx, qword [rsp + 0x2c8]
xor rcx, rsp
call fcn.1400192f0
mov eax, ebp
movaps xmm6, xmmword [rsp + 0x2d0]
add rsp, 0x2e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0xa0]
mov rdx, r14
call fcn.14000a910
test eax, eax
js 0x14000ac64
mov r12, qword [rsp + 0xa0]
test r12, r12
je 0x14000ac64
mov rcx, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
lea rax, [r12 - 1]
jmp 0x14000ac34
add rax, 0xffffffffffffffff
movzx edx, word [rbx + rax*2]
cmp dx, 0x5c
je 0x14000ac44
cmp dx, 0x2f
jne 0x14000ac73
cmp r12, rax
jb 0x14000ac30
mov word [rbx + rax*2], 0
mov rcx, rax
mov r12, rax
test rax, rax
jne 0x14000ac30
mov qword [rsp + 0xa0], rax
jmp 0x14000ac6c
test eax, eax
jns 0x14000aded
mov ebp, 0x80004005
jmp 0x14000acab
mov qword [rsp + 0xa0], rcx
mov rcx, rbx
mov dx, 0x2f
call fcn.140010054
mov rbp, rax
mov rcx, rbx
mov dx, 0x5c
call fcn.140010054
cmp rbp, rax
cmova rax, rbp
mov ebp, 0x80004005
test rax, rax
jne 0x14000af28
xor ebx, ebx
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x98], 0
test rcx, rcx
je 0x14000accb
call fcn.14000e248
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0xa8], 0
test rcx, rcx
je 0x14000ace9
call fcn.14000e248
test bl, bl
setne al
or r15b, al
jne 0x14000ad0b
mov rcx, r14
mov rdx, rsi
mov r8, r14
call fcn.14000a670
cmp qword [r14], 0
je 0x14000aba9
cmp qword [rsi + 8], 0xffffffffffffffff
jne 0x14000ab00
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
call fcn.14000b410
cmp qword [rsi + 8], 0xffffffffffffffff
jne 0x14000ab07
jmp 0x14000ab30
mov ecx, 0x20a
call fcn.14000e240
mov rbx, rax
lea rcx, [rax + 2]
mov r8d, 0x208
xor edx, edx
call fcn.14000fe30
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xa0], 0
mov word [rbx], 0
mov rdx, qword [r14 + 8]
lea rbx, [rsp + 0xb0]
mov rcx, rbx
call fcn.14000df80
call fcn.140014824
mov dword [rax], 0
mov rcx, rbx
call fcn.14000dff0
test rax, rax
jne 0x14000af94
mov ebx, ebp
call fcn.140014824
cmp dword [rax], 0
mov ebp, 0x80004005
cmove ebp, ebx
test ebx, ebx
cmovs ebp, ebx
mov rcx, qword [rsp + 0xb0]
cmp rcx, 0xffffffffffffffff
je 0x14000adc6
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0xa8], 0
test rcx, rcx
je 0x14000aba9
call fcn.14000e248
jmp 0x14000aba9
mov rbx, qword [rsp + 0xa8]
xor ebp, ebp
mov ecx, 0x20a
call fcn.14000e240
mov r12, rax
lea rcx, [rax + 2]
mov r8d, 0x208
xor edx, edx
call fcn.14000fe30
mov qword [rsp + 0x88], r12
mov qword [rsp + 0x80], 0
mov word [r12], 0
mov rcx, rbx
mov rdx, rbp
mov r8, r12
call fcn.14000e110
mov ebp, 0x80004005
test eax, eax
je 0x14000b0e9
mov rcx, r12
call fcn.1400173f8
mov qword [rsp + 0x80], rax
test rax, rax
je 0x14000b0e9
mov rcx, qword [rsi + 8]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14000ae78
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 8], 0xffffffffffffffff
mov rcx, qword [r14 + 8]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14000b0d5
lea rdx, [rdi + 0xc8]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000b0e9
mov qword [rsp + 0x30], r12
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
call fcn.14000b410
mov rcx, qword [rsi + 8]
cmp rcx, 0xffffffffffffffff
je 0x14000b0f8
mov eax, dword [rsi + 4]
cmp eax, 0xffffffff
setne dl
test al, 0x10
je 0x14000b0ff
cmp eax, 0xffffffff
je 0x14000b0ff
mov ebx, dword [rsi]
cmp ebx, 2
je 0x14000b0ff
cmp ebx, 1
je 0x14000b0ff
shr eax, 0xa
and al, dl
jne 0x14000b0ff
mov rcx, rsi
mov rdx, r14
mov r8, rdi
call fcn.14000b590
cmp eax, 1
je 0x14000b120
mov rcx, qword [rsi + 8]
jmp 0x14000b0ff
add rax, 2
lea rcx, [rsp + 0x90]
mov rdx, rax
call fcn.1400099b0
test eax, eax
js 0x14000acab
mov rax, qword [rsp + 0x90]
test rax, rax
je 0x14000acab
lea rcx, [rax + 1]
cmp r12, rcx
jb 0x14000acab
not rax
add rax, r12
cmp r12, rax
jb 0x14000af7e
mov qword [rsp + 0xa0], rax
mov word [rbx + rax*2], 0
mov r12, rax
test r12, r12
je 0x14000acab
mov rbp, qword [rsp + 0x98]
jmp 0x14000adf7
mov r15, rax
xorps xmm6, xmm6
jmp 0x14000b06a
mov r9, qword [r14 + 8]
mov qword [rsp + 0x20], r15
mov edx, 0x105
lea rbx, [rsp + 0xa0]
mov rcx, rbx
lea r8, [0x14002ff5a]
call fcn.14000b850
cmp qword [rsp + 0xa0], 0
jne 0x14000afe0
test ebp, ebp
mov eax, 0x8007006f
cmovns ebp, eax
mov ebx, ebp
jmp 0x14000b0b9
movabs rax, 0xffffffff00000002
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0xffffffffffffffff
lea rax, [rsp + 0x70]
movups xmmword [rax], xmm6
lea r15, [rsp + 0x60]
mov rcx, r15
mov rdx, rbx
xor r8d, r8d
call fcn.14000b410
mov dword [rsp + 0x20], r12d
mov rcx, rbx
mov rdx, r15
mov r8, r13
mov r9, rdi
call fcn.14000aa20
mov ebx, eax
test ebp, ebp
cmovs ebx, ebp
call fcn.140014824
mov dword [rax], 0
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x78], 0
test rcx, rcx
je 0x14000b053
call fcn.14000e248
mov rcx, qword [rsp + 0x68]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14000b0b9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000b0b9
mov rcx, r15
lea rdx, [0x140030406]
call fcn.1400173a4
test eax, eax
je 0x14000b0b7
mov rcx, r15
lea rdx, [0x140030404]
call fcn.1400173a4
test eax, eax
je 0x14000b0b7
cmp qword [rsi + 0x10], 0
mov r12d, dword [rsp + 0x350]
je 0x14000af9f
mov rdx, qword [rsi + 0x18]
mov rcx, r15
call fcn.1400173a4
test eax, eax
jne 0x14000af9f
mov ebx, ebp
lea rcx, [rsp + 0xb0]
call fcn.14000dff0
mov r15, rax
mov ebp, ebx
test rax, rax
jne 0x14000b06a
jmp 0x14000ad9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
xor ebx, ebx
mov rcx, r12
call fcn.14000e248
jmp 0x14000acad
mov rcx, 0xffffffffffffffff
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14000b10f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 8], 0xffffffffffffffff
xor ebx, ebx
mov r12, qword [rsp + 0x30]
jmp 0x14000b0eb
movabs rax, 0xffffffff00000002
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x80]
xor r8d, r8d
call fcn.14000b410
mov ebp, 0x80004005
cmp qword [rsp + 0x68], 0xffffffffffffffff
je 0x14000b2b3
mov eax, dword [rsp + 0x64]
cmp eax, 0xffffffff
setne cl
test al, 0x10
je 0x14000b2b3
cmp eax, 0xffffffff
je 0x14000b2b3
mov edx, dword [rsp + 0x60]
cmp edx, 2
je 0x14000b2b3
cmp edx, 1
je 0x14000b2b3
shr eax, 0xa
and al, cl
jne 0x14000b2b3
mov ecx, 0x20a
call fcn.14000e240
mov rbx, rax
lea rcx, [rax + 2]
mov dword [rsp + 0x2c], 0
mov r8d, 0x208
xor edx, edx
call fcn.14000fe30
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], 0
mov word [rbx], 0
mov ecx, 0x20a
call fcn.14000e240
mov rbx, rax
lea rcx, [rax + 2]
mov r8d, 0x208
xor edx, edx
call fcn.14000fe30
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], 0
mov word [rbx], 0
lea rbx, [rsp + 0xb0]
mov rcx, rbx
mov rdx, qword [rsp + 0x30]
call fcn.14000df80
call fcn.140014824
mov dword [rax], 0
mov rcx, rbx
call fcn.14000dff0
test rax, rax
jne 0x14000b2ec
call fcn.140014824
cmp dword [rax], 0
mov ebx, 0x80004005
mov eax, dword [rsp + 0x2c]
cmove ebx, eax
test eax, eax
cmovs ebx, eax
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x60]
call fcn.14000b890
mov ebp, eax
test ebx, ebx
cmovs ebp, ebx
mov rcx, qword [rsp + 0xb0]
cmp rcx, 0xffffffffffffffff
je 0x14000b283
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x48], 0
test rcx, rcx
je 0x14000b29b
call fcn.14000e248
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], 0
test rcx, rcx
je 0x14000b2b3
call fcn.14000e248
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x78], 0
test rcx, rcx
je 0x14000b2cb
call fcn.14000e248
mov rcx, qword [rsp + 0x68]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14000b2e0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov r12, qword [rsp + 0x30]
jmp 0x14000b0eb
mov rbp, rax
mov r12, qword [rsp + 0x70]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x2c], 0
lea rbx, [rsp + 0xb0]
mov rcx, rbp
lea rdx, [0x140030406]
call fcn.1400173a4
test eax, eax
je 0x14000b3ea
mov rcx, rbp
lea rdx, [0x140030404]
call fcn.1400173a4
test eax, eax
je 0x14000b3ea
test r12, r12
je 0x14000b356
mov rcx, rbp
mov rdx, qword [rsp + 0x38]
call fcn.1400173a4
test eax, eax
je 0x14000b3ea
mov qword [rsp + 0x20], rbp
mov edx, 0x105
lea rcx, [rsp + 0x50]
lea r8, [0x14002ff5a]
mov r9, qword [rsp + 0x30]
call fcn.14000b850
cmp qword [rsp + 0x50], 0
je 0x14000b3a5
mov r9, qword [r14 + 8]
mov qword [rsp + 0x20], rbp
mov edx, 0x105
lea rcx, [rsp + 0x40]
lea r8, [0x14002ff5a]
call fcn.14000b850
cmp qword [rsp + 0x40], 0
jne 0x14000b3b9
mov eax, dword [rsp + 0x2c]
test eax, eax
mov ecx, 0x8007006f
cmovns eax, ecx
mov dword [rsp + 0x2c], eax
jmp 0x14000b3ea
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov r8, rdi
call fcn.14000ba20
mov edx, dword [rsp + 0x2c]
test edx, edx
mov ecx, eax
cmovs ecx, edx
test eax, eax
cmovs edx, ecx
mov dword [rsp + 0x2c], edx
call fcn.140014824
mov dword [rax], 0
mov rcx, rbx
call fcn.14000dff0
mov rbp, rax
test rax, rax
jne 0x14000b30e
jmp 0x14000b23d