Function at 0x140275d80
Capabilities:
Copy file
Delete file
Get file attributes
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, r8
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x38]
call fcn.1402750d0
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.1402750d0
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, 0x410
je 0x140275df3
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x140275fc3
jmp 0x140275fc8
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call fcn.1402c1174
lea r14, [rax + 1]
lea r12, [rax*2 - 2]
mov ecx, 2
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
mov r8, rax
add r8, rdx
js 0x140275f90
movzx r8d, word [rsi + r12]
dec r14
dec rcx
add r12, 0xfffffffffffffffe
cmp r8d, 0x5c
je 0x140275e4a
dec rdx
cmp r8d, 0x2f
jne 0x140275e20
add r12, 6
add rax, rcx
mov r15, 0xffffffffffffffff
cmovs r12, r15
mov rcx, r12
call fcn.14029fa30
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call fcn.1402a4b90
mov rcx, rbx
mov rdx, rsi
mov r8, r14
call fcn.1402c57e0
mov dword [rsp + 0x44], 0
lea rdx, [rsp + 0x44]
mov ecx, 4
call fcn.14026af30
test al, al
je 0x140275f5e
mov rcx, rbx
call fcn.1402c1174
mov r12, rax
lea rax, [rax*2 + 0x12]
add r12, 9
cmovns r15, rax
mov rcx, r15
call fcn.14029fa30
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.1402a4b90
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x20], eax
lea r8, str._s_x
mov rcx, r14
mov rdx, r12
mov r9, rbx
call fcn.140276d50
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
je 0x140275f56
mov rcx, rbx
call fcn.14029f9fc
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1402b2644
test eax, eax
jne 0x1402760dd
movzx eax, word [rsp + 0x56]
and eax, 0xf000
neg ax
jno 0x1402760d2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1402760dd
mov rcx, r14
call fcn.14029f9fc
lea rcx, [rsp + 0x50]
call qword [sym.imp.RPCRT4.dll_UuidCreateSequential]
cmp eax, 0x720
je 0x140275f74
test eax, eax
jne 0x140275f88
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x48]
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
je 0x140276006
mov rcx, rbx
call fcn.14029f9fc
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
setne sil
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140275fc8
call fcn.14029f9fc
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140275fd7
call fcn.14029f9fc
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x140276000
mov eax, esi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14029fd30
int3
mov r15, qword [rsp + 0x48]
test r15, r15
je 0x140275f88
mov rcx, rbx
call fcn.1402c1174
mov r14, rax
mov rcx, r15
call fcn.1402c1174
lea rcx, [r14 + rax]
lea r12, [r14 + rax]
inc r12
lea rax, [rcx*2 + 2]
test r12, r12
mov r13, 0xffffffffffffffff
cmovns r13, rax
mov rcx, r13
call fcn.14029fa30
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call fcn.1402a4b90
mov qword [rsp + 0x20], r15
lea r8, str._s_s
mov rcx, r14
mov rdx, r12
mov r9, rbx
call fcn.140276d50
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
jne 0x1402760ac
mov rcx, r14
call fcn.14029f9fc
xor r14d, r14d
mov qword [rsp + 0x50], r15
lea rcx, [rsp + 0x50]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov rcx, rbx
call fcn.14029f9fc
test r14, r14
jne 0x140275f20
jmp 0x140275f90
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r14
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne sil
jne 0x14027610a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r14
call fcn.14029f9fc
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x140275fc3
jmp 0x140275fc8