Function at 0x140036ed0
Capabilities:
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x448
movaps xmmword [rsp + 0x430], xmm6
mov r13, r8
mov r15, rdx
mov r14, rcx
mov rax, qword [0x14019ac40]
xor rax, rsp
mov qword [rsp + 0x428], rax
lea rax, [rsp + 0x328]
mov qword [rsp + 0x310], rax
movaps xmm0, xmmword [0x14016ddb0]
movups xmmword [rsp + 0x318], xmm0
lea r8, [rsp + 0x310]
mov r9d, 0x104
mov rdx, r13
call fcn.140035ea0
cmp dword [r14], 0
je 0x140036f8b
mov rcx, qword [rsp + 0x310]
lea rax, [rsp + 0x328]
cmp rcx, rax
je 0x140036f5c
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x428]
xor rcx, rsp
call fcn.14016a260
mov rax, r14
movaps xmm6, xmmword [rsp + 0x430]
add rsp, 0x448
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbp, [rsp + 0x80]
movaps xmm6, xmmword [0x14016c7a0]
lea r12, [rsp + 0x98]
movabs rsi, 0xcccccccccccccccd
xor ebx, ebx
mov qword [rsp + 0x48], r15
jmp 0x140036fe9
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x48]
lea rbp, [rsp + 0x80]
mov ebx, dword [rsp + 0x44]
add ebx, 1
cmp ebx, 0xc8
je 0x1400377f3
mov rcx, rbp
mov rdx, r15
mov r8, r13
mov r9b, 1
call fcn.14003a0b0
mov eax, dword [0x14019c710]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
jg 0x140037680
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax + 8]
mov eax, dword [rsp + 0x80]
cmp rcx, qword [0x14019a520]
jne 0x140037044
cmp eax, 0x78
je 0x140037733
test eax, eax
je 0x140037722
mov eax, dword [0x14019ced8]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
jg 0x1400376b6
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
cmp rax, qword [0x14019a3c8]
jne 0x140037722
cmp dword [rsp + 0x80], 0xd
jne 0x140037722
mov rdi, r15
mov dword [rsp + 0x44], ebx
mov rcx, qword [rsp + 0x310]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000080
mov dword [rsp + 0x20], 3
mov edx, 0x80010000
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140037620
mov r15, rax
mov rcx, rax
lea rdx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1400377cc
xor ebp, ebp
nop dword [rax]
test rbp, rbp
je 0x140037170
mov edi, 0x14
lea r9, [rsp + 0xe5]
mov rcx, rbp
nop word cs:[rax + rax]
nop
mov rax, rcx
mul rsi
shr rdx, 3
lea eax, [rdx + rdx]
lea eax, [rax + rax*4]
mov ebx, ecx
sub ebx, eax
or bl, 0x30
mov byte [r9 - 1], bl
add r9, 0xffffffffffffffff
add rdi, 0xffffffffffffffff
cmp rcx, 9
mov rcx, rdx
ja 0x140037120
movups xmmword [rsp + 0xa8], xmm6
mov byte [rsp + 0x98], 0
cmp rdi, 0x14
jne 0x140037190
jmp 0x1400371ce
mov byte [rsp + 0xe4], 0x30
movups xmmword [rsp + 0xa8], xmm6
mov byte [rsp + 0x98], 0
lea r9, [rsp + 0xe4]
lea rdi, [rsp + 0xe5]
sub rdi, r9
cmp rdi, 0xf
jbe 0x1400371b0
mov rcx, r12
mov rdx, rdi
call fcn.1400058f0
jmp 0x1400371ce
mov qword [rsp + 0xa8], rdi
mov rcx, r12
mov rdx, r9
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rdi + 0x98], 0
mov al, byte [r13 + 0x10]
cmp al, 1
je 0x1400371f0
test al, al
jne 0x140037230
mov word [rsp + 0x60], 0x100
mov cl, 1
xor eax, eax
jmp 0x140037275
lea rdx, str..tmp
mov qword [rsp + 0x50], rdx
mov word [rsp + 0x60], 0x103
movzx eax, word [rsp + 0x96]
lea rcx, [rsp + 0x62]
mov word [rcx + 4], ax
mov eax, dword [rsp + 0x92]
mov dword [rcx], eax
mov al, 3
mov rcx, rdx
jmp 0x140037269
cmp byte [r13 + 0x11], 1
movzx eax, al
mov ecx, 2
cmovne eax, ecx
mov rcx, qword [r13]
cmovne rcx, r13
mov qword [rsp + 0x50], rcx
lea rcx, str..tmp
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x60], al
mov byte [rsp + 0x61], 3
mov al, 2
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], r12
mov cl, 4
mov byte [rsp + 0x78], al
mov byte [rsp + 0x79], cl
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0xd0]
call fcn.1400400d0
mov rax, qword [rsp + 0xb0]
cmp rax, 0x10
jb 0x1400372d6
mov rcx, qword [rsp + 0x98]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400372d1
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x140037866
add rax, 0x28
mov rdx, rax
mov rcx, rdi
call fcn.14016a23c
mov word [rsp + 0xa8], 0x104
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0x68]
mov rdx, r15
mov r8, r12
xor r9d, r9d
call fcn.14003a0b0
cmp dword [rsp + 0x68], 0
je 0x140037430
mov eax, dword [0x14019ced8]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
jg 0x140037532
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 8]
cmp rax, qword [0x14019a3c8]
jne 0x14003734c
cmp dword [rsp + 0x68], 0x11
je 0x140037392
mov eax, dword [0x14019ced8]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
jg 0x140037568
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 8]
cmp rax, qword [0x14019a3c8]
jne 0x14003749b
cmp dword [rsp + 0x68], 0xd
jne 0x14003749b
mov rbx, r14
mov rcx, qword [rsp + 0x310]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14003743a
mov r14, rax
mov rcx, rax
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1400374ab
mov eax, dword [rsp + 0x11c]
mov edi, 5
cmp eax, dword [rsp + 0xc4]
jne 0x1400374c0
mov eax, dword [rsp + 0x120]
cmp eax, dword [rsp + 0xc8]
jne 0x1400374c0
mov eax, dword [rsp + 0x10c]
xor ecx, ecx
cmp eax, dword [rsp + 0xb4]
sete cl
lea edi, [rcx + rcx]
add edi, 5
jmp 0x1400374c0
mov edi, 5
jmp 0x1400374cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14, rbx
mov rcx, rbx
mov edx, eax
call fcn.14002e8d0
mov eax, dword [0x14019ced8]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
jg 0x14003759e
mov rax, qword [r14 + 8]
xor ecx, ecx
cmp dword [r14], 2
mov rax, qword [rax + 8]
sete cl
cmp rax, qword [0x14019a3c8]
lea edi, [rcx*4 + 1]
mov eax, 1
cmovne edi, eax
jmp 0x1400374cc
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [r14], xmm0
mov edi, 1
jmp 0x1400374cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edx, eax
call fcn.14002e8d0
mov edi, 1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, rbx
mov rax, qword [rsp + 0xe8]
cmp rax, 0x10
jb 0x140037513
mov rcx, qword [rsp + 0xd0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003750e
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140037866
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.14016a23c
cmp edi, 7
jne 0x1400375e0
add rbp, 1
cmp rbp, 0xc8
jne 0x140037100
jmp 0x140036fc0
lea rcx, [0x14019ced8]
call fcn.14016a3dc
cmp dword [0x14019ced8], 0xffffffff
jne 0x140037333
lea rcx, [0x14003a0a0]
call fcn.14016a724
lea rcx, [0x14019ced8]
call fcn.14016a37c
jmp 0x140037333
lea rcx, [0x14019ced8]
call fcn.14016a3dc
cmp dword [0x14019ced8], 0xffffffff
jne 0x140037371
lea rcx, [0x14003a0a0]
call fcn.14016a724
lea rcx, [0x14019ced8]
call fcn.14016a37c
jmp 0x140037371
lea rcx, [0x14019ced8]
call fcn.14016a3dc
cmp dword [0x14019ced8], 0xffffffff
jne 0x140037472
lea rcx, [0x14003a0a0]
call fcn.14016a724
lea rcx, [0x14019ced8]
call fcn.14016a37c
jmp 0x140037472
cmp edi, 5
je 0x140036fc0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 4
mov r15, qword [rsp + 0x48]
lea rbp, [rsp + 0x80]
mov ebx, dword [rsp + 0x44]
je 0x140036fda
jmp 0x1400377ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r14
mov edx, eax
call fcn.14002e8d0
mov eax, dword [0x14019ced8]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
mov r15, rdi
jg 0x1400376ec
mov rax, qword [r14 + 8]
mov rax, qword [rax + 8]
cmp rax, qword [0x14019a3c8]
mov ebx, dword [rsp + 0x44]
jne 0x140036f41
cmp dword [r14], 2
je 0x140036fda
jmp 0x140036f41
lea rcx, [0x14019c710]
call fcn.14016a3dc
cmp dword [0x14019c710], 0xffffffff
jne 0x14003701f
lea rcx, [0x14003a600]
call fcn.14016a724
lea rcx, [0x14019c710]
call fcn.14016a37c
jmp 0x14003701f
lea rcx, [0x14019ced8]
call fcn.14016a3dc
cmp dword [0x14019ced8], 0xffffffff
jne 0x140037071
lea rcx, [0x14003a0a0]
call fcn.14016a724
lea rcx, [0x14019ced8]
call fcn.14016a37c
jmp 0x140037071
lea rcx, [0x14019ced8]
call fcn.14016a3dc
cmp dword [0x14019ced8], 0xffffffff
jne 0x140037658
lea rcx, [0x14003a0a0]
call fcn.14016a724
lea rcx, [0x14019ced8]
call fcn.14016a37c
jmp 0x140037658
movups xmm0, xmmword [rsp + 0x80]
movups xmmword [r14], xmm0
jmp 0x140036f41
lea rsi, [rsp + 0x108]
mov qword [rsp + 0xf0], rsi
movaps xmm0, xmmword [0x14016f070]
movups xmmword [rsp + 0xf8], xmm0
lea r8, [rsp + 0xf0]
mov rcx, r14
mov rdx, r15
call fcn.140036c20
cmp dword [r14], 0
jne 0x14003784a
mov rdx, qword [rsp + 0x310]
mov rcx, qword [rsp + 0xf0]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14003783a
mov dword [r14], 0
mov eax, dword [0x14019c710]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
jg 0x14003789b
lea rax, [0x14019a518]
mov qword [r14 + 8], rax
jmp 0x14003784a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r14
mov edx, eax
call fcn.14002e8d0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140036f41
cmp edi, 2
jne 0x140036f41
mov dword [r14], 0
mov qword [r14 + 8], 0
mov eax, dword [0x14019ced8]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
jg 0x14003786c
mov dword [r14], 0xd
lea rax, [0x14019a3c0]
mov qword [r14 + 8], rax
jmp 0x140036f41
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r14
mov edx, eax
call fcn.14002e8d0
mov rcx, qword [rsp + 0xf0]
cmp rcx, rsi
je 0x140036f41
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140036f41
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
lea rcx, [0x14019ced8]
call fcn.14016a3dc
cmp dword [0x14019ced8], 0xffffffff
jne 0x140037823
lea rcx, [0x14003a0a0]
call fcn.14016a724
lea rcx, [0x14019ced8]
call fcn.14016a37c
jmp 0x140037823
lea rcx, [0x14019c710]
call fcn.14016a3dc
cmp dword [0x14019c710], 0xffffffff
jne 0x1400377bf
lea rcx, [0x14003a600]
call fcn.14016a724
lea rcx, [0x14019c710]
call fcn.14016a37c
jmp 0x1400377bf