Function at 0x4ad2285c
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6a0
mov rax, qword [0x4ad2e1c8]
xor rax, rsp
mov qword [rsp + 0x690], rax
mov qword [rsp + 0x48], rcx
lea rcx, [0x4ad3bb60]
mov rdx, rsp
call sub.msvcrt.dll__setjmp
xor ebx, ebx
cmp eax, ebx
je 0x4ad228d4
mov eax, 1
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.4ad01000
lea r11, [rsp + 0x6a0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0x78]
call fcn.4ad02a74
or r15, 0xffffffffffffffff
mov rbp, rax
xor eax, eax
mov rcx, r15
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r12, [rbp + rcx*2]
cmp word [rbp], bx
je 0x4ad22df9
cmp word [r12], bx
je 0x4ad22df9
mov rcx, r15
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
cmp word [r12 + rcx*2], bx
jne 0x4ad22df9
mov rcx, rbp
call fcn.4ad02e40
mov rcx, r15
mov rdi, rbp
mov r8, rax
xor eax, eax
repne scasw ax, word [rdi]
not rcx
mov rdx, rcx
mov rcx, rbp
call fcn.4ad01744
mov rcx, r12
call fcn.4ad02e40
mov rcx, r15
mov rdi, r12
mov r8, rax
xor eax, eax
repne scasw ax, word [rdi]
not rcx
mov rdx, rcx
mov rcx, r12
call fcn.4ad01744
mov rcx, rbp
call fcn.4ad0b6a4
mov r13, rax
cmp rax, 1
jne 0x4ad22992
mov ecx, dword [0x4ad2e13c]
call fcn.4ad22808
int3
lea rdi, [0x4ad3c0a0]
lea rax, [rsp + 0x60]
mov r9d, 0x104
mov r8, rdi
lea rcx, [rsp + 0x60]
mov r14d, 2
sub r8, rax
mov rdx, r9
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbx
je 0x4ad229da
movzx eax, word [r8 + rcx]
cmp ax, bx
je 0x4ad229da
mov word [rcx], ax
add rcx, r14
sub rdx, 1
jne 0x4ad229b8
cmp rdx, rbx
jne 0x4ad229e2
sub rcx, r14
lea rax, [rsp + 0x270]
mov word [rcx], bx
mov rdx, r9
sub rdi, rax
lea rcx, [rsp + 0x270]
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbx
je 0x4ad22a1c
movzx eax, word [rdi + rcx]
cmp ax, bx
je 0x4ad22a1c
mov word [rcx], ax
add rcx, r14
sub rdx, 1
jne 0x4ad229fb
cmp rdx, rbx
jne 0x4ad22a24
sub rcx, r14
mov word [rcx], bx
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
mov rax, qword [r13 + 0x30]
test byte [rax], 0x10
not rcx
lea r15, [rcx - 1]
jne 0x4ad22a57
mov r8, qword [r13 + 0x20]
lea rcx, [rsp + 0x60]
mov rdx, r9
call fcn.4ad01ac0
jmp 0x4ad22a6a
dec r15d
movsxd rax, r15d
mov word [rsp + rax*2 + 0x60], bx
mov word [rsp + rax*2 + 0x270], bx
test byte [r13 + 0x38], 8
jne 0x4ad22aa1
lea rcx, [rsp + 0x60]
call fcn.4ad02e40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [r13 + 0x30]
mov dword [rcx], eax
mov rax, qword [r13 + 0x30]
cmp dword [rax], 0xffffffff
jne 0x4ad22aa1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.4ad22808
int3
mov edi, 0x3a
cmp word [r12 + 2], di
je 0x4ad22dee
lea edx, [rdi + 0x22]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rbx
jne 0x4ad22dee
movzx eax, word [0x4ad3c0a0]
lea rdx, [rsp + 0x58]
mov rcx, rbp
mov word [rsp + 0x480], ax
lea eax, [rdi - 0x10]
mov word [rsp + 0x482], di
mov word [rsp + 0x58], ax
lea eax, [rdi + 5]
mov word [rsp + 0x5c], bx
mov word [rsp + 0x5a], ax
call fcn.4ad03130
or rcx, 0xffffffffffffffff
mov r11, rax
xor eax, eax
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
mov rdi, rbp
lea rdx, [rsp + 0x60]
repne scasw ax, word [rdi]
mov edi, ebx
not rcx
dec rcx
cmp r11, rcx
lea ecx, [rax + 0x20]
mov rax, qword [r13 + 0x30]
mov dword [rsp + 0x30], ecx
mov r8d, ecx
setb dil
lea rcx, [0x4ad04960]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call fcn.4ad04688
cmp al, bl
jne 0x4ad22bbc
mov rax, qword [r13 + 0x30]
mov edx, 0x10
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], edx
mov r8d, edx
lea rcx, [0x4ad04960]
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call fcn.4ad04688
cmp al, bl
jne 0x4ad22ba3
mov ecx, dword [0x4ad2e13c]
cmp ecx, 0x12
cmove ecx, r14d
mov dword [0x4ad2e13c], ecx
call fcn.4ad22808
int3
cmp edi, ebx
je 0x4ad22bbc
mov rcx, qword [rsp + 0x38]
call fcn.4ad0478c
mov ecx, 0x232a
call fcn.4ad22808
int3
mov rbp, qword [rsp + 0x38]
movsxd rcx, r15d
mov r14d, ebx
lea rdi, [rsp + rcx*2 + 0x60]
mov qword [rsp + 0x40], rcx
mov word [rdi], bx
mov qword [rsp + 0x50], rdi
cmp dword [0x4ad2e19c], ebx
jne 0x4ad22ddc
mov rax, qword [r13 + 0x30]
test byte [rax], 0x10
je 0x4ad22c90
lea rcx, [rsp + 0x270]
mov edx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov r11, rax
cmp rax, rbx
je 0x4ad22d92
mov word [rax + 2], bx
xor eax, eax
or r8, 0xffffffffffffffff
mov rcx, r8
mov rdi, r12
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x270]
not rcx
lea rdx, [rcx - 1]
mov rcx, r8
repne scasw ax, word [rdi]
not rcx
lea rax, [rdx + rcx]
mov edx, 0x104
cmp rax, rdx
ja 0x4ad22d7a
lea rcx, [rsp + 0x270]
lea rax, [r11 + 2]
mov r8, r12
sub rax, rcx
lea rcx, [r11 + 2]
sar rax, 1
sub rdx, rax
call fcn.4ad01744
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x270]
xor eax, eax
repne scasw ax, word [rdi]
not rcx
mov word [rsp + rcx*2 + 0x26e], bx
jmp 0x4ad22d15
mov word [rsp + rcx*2 + 0x60], bx
mov r8, qword [r13 + 0x30]
lea rcx, [rsp + 0x60]
add r8, 0x2c
mov edx, 0x104
call fcn.4ad01ac0
lea rcx, [rsp + 0x480]
mov r9, rdi
mov r8, r12
mov edx, 0x104
call fcn.4ad125b0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x480]
repne scasw ax, word [rdi]
lea eax, [r15 + 1]
not rcx
movsxd rdx, eax
dec rcx
add rcx, rdx
mov edx, 0x104
cmp rcx, rdx
ja 0x4ad22dc4
mov rax, qword [rsp + 0x40]
lea r8, [rsp + 0x480]
lea rcx, [rsp + 0x270]
mov word [rsp + rax*2 + 0x270], bx
call fcn.4ad01ac0
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, ebx
jne 0x4ad22d4f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov eax, 0x234d
cmp r14d, 0xb7
cmove r14d, eax
xor edx, edx
mov ecx, r14d
call fcn.4ad0b8b0
mov r8d, dword [rsp + 0x30]
mov rdx, qword [r13 + 0x30]
lea rcx, [0x4ad04960]
mov r9, rbp
call fcn.4ad0b630
cmp al, bl
je 0x4ad22daa
mov rcx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
jmp 0x4ad22bd9
mov rcx, rbp
call fcn.4ad0478c
call fcn.4ad0b850
mov ecx, 0x232e
call fcn.4ad22808
int3
mov rcx, rbp
call fcn.4ad0478c
call fcn.4ad0b850
mov ecx, 0x232e
call fcn.4ad22808
int3
mov rcx, rbp
call fcn.4ad0478c
call fcn.4ad0b850
cmp r14d, ebx
setne bl
mov eax, ebx
jmp 0x4ad228a7
mov rcx, rbp
call fcn.4ad0478c
call fcn.4ad0b850
mov ecx, 0x232e
call fcn.4ad22808
int3
mov rcx, rbp
call fcn.4ad0478c
call fcn.4ad0b850
jmp 0x4ad228a2
mov ecx, 0x232a
call fcn.4ad22808
int3
mov ecx, 0x232a
call fcn.4ad22808
int3