Function at 0x14002dbd0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd0
mov rax, qword [0x140231eb8]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rbx, rdx
mov rdi, rcx
mov rsi, qword [rbp + 0x7f]
cmp r8d, 0x4e
jne 0x14002df55
mov rax, qword [rcx]
cmp qword [rsi], rax
jne 0x14002df55
xor r15d, r15d
mov qword [rbp - 0x79], r15
mov eax, dword [rsi + 0x10]
cmp eax, 0xfffffe34
je 0x14002e133
cmp eax, 0xfffffe35
je 0x14002e015
cmp eax, 0xfffffe36
je 0x14002dfb0
cmp eax, 0xfffffe38
je 0x14002ded7
cmp eax, 0xfffffe3a
je 0x14002de2a
cmp eax, 0xfffffe3d
je 0x14002dd7c
cmp eax, 0xfffffe64
je 0x14002dd42
cmp eax, 0xfffffffb
jne 0x14002df55
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x71], rax
lea r9, [rbp - 0x71]
xor r8d, r8d
mov edx, 0x1111
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, qword [rbp - 0x61]
test r9, r9
je 0x14002df55
mov edx, 0x110b
lea r8d, [r15 + 9]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SendMessageW]
test byte [rbp - 0x69], 4
je 0x14002df55
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_ClientToScreen]
mov dword [rbp - 0x41], 4
mov rax, qword [rbp - 0x61]
mov qword [rbp - 0x39], rax
lea r9, [rbp - 0x41]
xor r8d, r8d
mov edx, 0x113e
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14002df55
mov r8, qword [rbp - 0x11]
test r8, r8
je 0x14002df55
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, qword [r8 + 8]
mov r8, qword [r8]
mov rdx, rbx
mov rcx, rdi
call fcn.14002c8a8
jmp 0x14002df55
cmp word [rsi + 0x18], 0x2e
je 0x14002dd72
cmp word [rsi + 0x18], 0x71
je 0x14002dd68
cmp word [rsi + 0x18], 0x74
jne 0x14002df55
mov dl, byte [rcx + 0x10]
call fcn.14002f370
jmp 0x14002df55
call fcn.14002eb5c
jmp 0x14002df55
call fcn.14002c6dc
jmp 0x14002df55
lea r8, [rsi + 0x58]
mov qword [rbp - 0x41], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x31], xmm0
movdqa xmm1, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x31], xmm1
mov word [rbp - 0x41], r15w
lea r9, [rbp - 0x41]
call fcn.14002d5e4
test al, al
je 0x14002ddd7
lea rbx, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rbx, qword [rbp - 0x41]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetParent]
mov r9, rbx
xor r8d, r8d
mov edx, 0x800b
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
nop
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14002de18
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
mov ebx, 0x1000
cmp rdx, rbx
jb 0x14002de13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e389
call fcn.1401af36c
movdqa xmm0, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x31], xmm0
jmp 0x14002df50
test byte [rsi + 0x68], 0x40
jne 0x14002df55
mov rbx, qword [rsi + 0x88]
test rbx, rbx
je 0x14002df55
mov eax, dword [0x140232da0]
mov ecx, eax
inc eax
mov dword [0x140232da0], eax
test ecx, ecx
jne 0x14002df55
mov rcx, qword [rbx]
mov rax, qword [rcx]
lea rdx, [rbp - 0x79]
mov qword [rsp + 0x20], rdx
lea r9, [0x1401f5400]
xor r8d, r8d
mov rdx, qword [rbx + 8]
mov rax, qword [rax + 0x28]
call qword [case.0x1400f17b3.0]
test eax, eax
js 0x14002dea3
mov rax, qword [rsi + 0x60]
mov qword [rsp + 0x20], rax
mov r9, qword [rbx + 0x10]
mov r8, qword [rbp - 0x79]
mov rdx, qword [rdi]
mov rcx, rdi
call fcn.14002cae4
mov rax, qword [rsi + 0x60]
mov qword [rbp - 0x59], rax
lea rax, [0x14002f340]
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x49], r15
lea r9, [rbp - 0x59]
xor r8d, r8d
mov edx, 0x1115
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SendMessageW]
dec dword [0x140232da0]
jmp 0x14002df55
mov qword [rbp - 0x41], r15
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x31], r15
mov r14d, 7
mov qword [rbp - 0x29], r14
mov word [rbp - 0x41], r15w
lea r8, [rsi + 0x58]
lea r9, [rbp - 0x41]
call fcn.14002d5e4
test al, al
jne 0x14002df7e
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14002df48
mov ebx, 0x1000
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
cmp rdx, rbx
mov rax, rcx
jb 0x14002df43
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e38f
call fcn.1401af36c
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x29], r14
mov word [rbp - 0x41], r15w
xor eax, eax
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1401af480
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp qword [rbp - 0x31], r15
jne 0x14002df9d
cmp byte [0x140233a34], r15b
je 0x14002df9d
lea rdx, [0x1401dc2f0]
lea rcx, [rbp - 0x41]
call fcn.140012fc0
lea rdx, [rbp - 0x41]
mov ecx, 1
call fcn.140029cc8
jmp 0x14002df07
mov rbx, qword [rsi + 0x50]
test rbx, rbx
je 0x14002df55
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400f17b3.0]
mov rcx, qword [0x14025af70]
mov rax, qword [rcx]
mov rdx, qword [rbx + 8]
mov rax, qword [rax + 0x28]
call qword [case.0x1400f17b3.0]
mov rcx, qword [0x14025af70]
mov rax, qword [rcx]
mov rdx, qword [rbx + 0x10]
mov rax, qword [rax + 0x28]
call qword [case.0x1400f17b3.0]
mov rcx, qword [0x14025af70]
mov rax, qword [rcx]
mov rdx, rbx
mov rax, qword [rax + 0x28]
call qword [case.0x1400f17b3.0]
jmp 0x14002df55
mov rcx, qword [rsi + 0x48]
test rcx, rcx
jne 0x14002e026
lea eax, [rcx + 1]
jmp 0x14002df57
mov qword [rbp - 0x41], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x31], xmm0
movdqa xmm1, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x31], xmm1
mov word [rbp - 0x41], r15w
lea rdx, [rbp - 0x41]
mov rcx, qword [rcx + 0x10]
call fcn.1400e34b4
test al, al
je 0x14002e0d2
lea rcx, [rbp - 0x41]
call fcn.1400cb9f4
test al, al
je 0x14002e0d2
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 9]
call fcn.1400e333c
nop
mov rbx, qword [rax + 0x10]
lea rcx, [rbp - 9]
call fcn.140006b94
test rbx, rbx
je 0x14002e0d2
mov r8d, 1
mov byte [rdi + 0x11], r8b
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14002e0cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
mov ebx, 0x1000
cmp rdx, rbx
jb 0x14002e0c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e395
call fcn.1401af36c
mov r8, r15
jmp 0x14002e119
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14002e113
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
mov ebx, 0x1000
cmp rdx, rbx
jb 0x14002e10e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e395
call fcn.1401af36c
mov r8d, 1
movdqa xmm0, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x31], xmm0
mov word [rbp - 0x41], r15w
mov rax, r8
jmp 0x14002df57
mov byte [rcx + 0x11], r15b
cmp qword [rsi + 0x30], r15
je 0x14002df55
mov rcx, qword [rsi + 0x48]
test rcx, rcx
je 0x14002df55
mov qword [rbp - 0x41], r15
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x31], r15
mov r14d, 7
mov qword [rbp - 0x29], r14
mov word [rbp - 0x41], r15w
lea rdx, [rbp - 0x41]
mov rcx, qword [rcx + 0x10]
call fcn.1400e34b4
mov ebx, 0x1000
test al, al
je 0x14002e315
mov qword [rbp - 9], r15
mov qword [rbp + 7], r15
mov qword [rbp + 0xf], r15
mov r15, qword [rbp - 0x31]
lea r12, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae r12, qword [rbp - 0x41]
movabs r13, 0x7ffffffffffffffe
cmp r15, r13
ja 0x14002e39b
mov qword [rbp + 0xf], r14
cmp r15, 8
jae 0x14002e1d8
mov qword [rbp + 7], r15
lea r8d, [r14 + 9]
mov rdx, r12
lea rcx, [rbp - 9]
call fcn.1401b1520
jmp 0x14002e256
mov rax, r15
or rax, r14
cmp rax, r13
jbe 0x14002e1f3
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14002e221
mov r13, rax
mov ecx, 0xa
cmp rax, rcx
cmovb r13, rcx
lea rcx, [r13 + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14002e377
add rcx, rcx
cmp rcx, rbx
jb 0x14002e228
call fcn.14000417c
jmp 0x14002e236
test rcx, rcx
je 0x14002e234
call fcn.1401af330
jmp 0x14002e236
xor eax, eax
mov qword [rbp - 9], rax
mov qword [rbp + 7], r15
mov qword [rbp + 0xf], r13
lea r8, [r15*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.1401b1520
nop
lea rdx, [rbp - 9]
lea rcx, [rbp - 9]
call fcn.1400e1954
mov rdx, qword [rsi + 0x30]
or r8, 0xffffffffffffffff
xor r15d, r15d
inc r8
cmp word [rdx + r8*2], r15w
jne 0x14002e26e
lea rcx, [rbp - 9]
call fcn.140006c24
lea rcx, [rbp - 9]
call fcn.1400cb9f4
test al, al
je 0x14002e2a2
mov ecx, 0x50d
call fcn.1400f6aa0
mov rcx, rax
call fcn.14016b0ac
jmp 0x14002e2cc
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rdx, qword [rbp - 9]
lea rcx, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x14002e355
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x14002e308
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
cmp rdx, rbx
mov rax, rcx
jb 0x14002e303
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e383
call fcn.1401af36c
mov word [rbp - 9], r15w
mov qword [rbp + 0xf], r14
mov qword [rbp + 7], r15
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14002df48
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
cmp rdx, rbx
mov rax, rcx
jb 0x14002df43
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e37d
jmp 0x14002df43
mov dl, byte [rdi + 0x10]
mov rcx, rdi
call fcn.14002f370
mov r8d, 1
lea rdx, [rbp - 9]
mov rcx, rdi
call fcn.14002f1a8
jmp 0x14002e2cc
call fcn.140006b74
nop
call fcn.1401b6544
nop
call fcn.1401b6544
nop
call fcn.1401b6544
int3
call fcn.1401b6544
int3
call fcn.1401b6544
nop
call fcn.140006bf8
int3