Function at 0x14000a720
Capabilities:
Copy file
Create directory
Delete file
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2b8
mov r15, r8
mov rbx, rdx
mov r12, rcx
mov rax, qword [0x140037010]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rdx, qword [rdx + 8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
xor ebp, ebp
test eax, eax
jne 0x14000a9fe
movabs rdi, 0xffffffff00000002
lea rbp, [rsp + 0x78]
mov qword [rbp], rdi
mov qword [rbp + 8], 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov rcx, rbp
mov rdx, r12
xor r8d, r8d
call fcn.140001f40
mov esi, dword [rbp + 4]
cmp esi, 0xffffffff
je 0x14000a922
mov eax, esi
and eax, 0x10
je 0x14000a922
lea rdx, [r15 + 0xc8]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000a9c0
lea rbp, [rsp + 0x58]
mov qword [rbp], rdi
mov qword [rbp + 8], 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xor r13d, r13d
mov rcx, rbp
mov rdx, rbx
xor r8d, r8d
call fcn.140001f40
mov ecx, 0x20a
call fcn.14000d924
mov rdi, rax
lea rcx, [rax + 2]
mov r8d, 0x208
xor edx, edx
call fcn.14000f920
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], r13
mov word [rdi], r13w
mov ecx, 0x20a
call fcn.14000d924
mov rdi, rax
lea rcx, [rax + 2]
mov r8d, 0x208
xor edx, edx
call fcn.14000f920
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r13
mov r14, qword [rbp + 8]
cmp qword [rsp + 0x80], 0xffffffffffffffff
mov word [rdi], r13w
mov ebp, 0x80004005
je 0x14000a899
cmp r14, 0xffffffffffffffff
je 0x14000a899
mov eax, dword [rsp + 0x5c]
cmp eax, 0xffffffff
je 0x14000a899
mov ecx, eax
and ecx, 0x10
je 0x14000a899
bt eax, 0xa
jb 0x14000a899
mov eax, dword [rsp + 0x58]
dec eax
cmp eax, 2
jb 0x14000a899
xor ebp, ebp
bt esi, 0xa
jb 0x14000a899
mov eax, dword [rsp + 0x78]
dec eax
cmp eax, 2
jae 0x14000aa24
lea rdx, [rsp + 0x78]
mov rcx, r12
call fcn.14000a620
test eax, eax
jns 0x14000a8d9
mov rcx, qword [r12 + 8]
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test ebp, ebp
js 0x14000a8d9
test eax, eax
jne 0x14000a8d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000a8e8
call fcn.14000dbd0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000a8f7
call fcn.14000dbd0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000a906
call fcn.14000dbd0
lea rax, [r14 + 1]
cmp rax, 2
jb 0x14000a9d4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000a9d4
mov rcx, qword [rsp + 0x80]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14000a93a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
setne al
xor ebp, ebp
mov qword [rsp + 0x80], 0xffffffffffffffff
cmp esi, 0xffffffff
je 0x14000a996
mov ecx, dword [rsp + 0x78]
cmp ecx, 2
je 0x14000a996
shr esi, 0xa
and sil, al
jne 0x14000a996
cmp ecx, 1
je 0x14000a996
mov rdx, qword [rbx + 8]
mov rcx, qword [r12 + 8]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x14000a996
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov rcx, qword [r12 + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000a9d4
mov rcx, qword [r12 + 8]
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test ebp, ebp
js 0x14000a9d4
test eax, eax
jne 0x14000a9d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebp, ax
or ebp, 0x80070000
test eax, eax
cmovle ebp, eax
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14000a9e6
call fcn.14000dbd0
mov rcx, qword [rsp + 0x80]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14000a9fe
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400187d0
mov eax, ebp
add rsp, 0x2b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [r12 + 8]
lea rdi, [rsp + 0x98]
mov rcx, rdi
call fcn.140027540
call fcn.14000dce8
mov dword [rax], 0
mov rcx, rdi
call fcn.1400275b0
test rax, rax
je 0x14000ab6a
mov r13, rax
mov rdi, qword [rsp + 0x88]
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
lea rsi, [0x1400304a6]
lea rbp, [rsp + 0x98]
mov rcx, r13
mov rdx, rsi
call fcn.140016aa8
test eax, eax
je 0x14000aabc
mov rcx, r13
lea rdx, [0x1400304a4]
call fcn.140016aa8
test eax, eax
je 0x14000aabc
test rdi, rdi
je 0x14000aad1
mov rcx, r13
mov rdx, qword [rsp + 0x30]
call fcn.140016aa8
test eax, eax
jne 0x14000aad1
mov rcx, rbp
call fcn.1400275b0
mov r13, rax
test rax, rax
jne 0x14000aa84
jmp 0x14000ab72
mov r9, qword [r12 + 8]
mov qword [rsp + 0x20], r13
mov edx, 0x105
lea rcx, [rsp + 0x48]
lea r8, [0x14002ff8a]
call fcn.140027360
cmp qword [rsp + 0x48], 0
jne 0x14000ab0d
mov eax, dword [rsp + 0x2c]
test eax, eax
mov ecx, 0x8007006f
cmovns eax, ecx
mov dword [rsp + 0x2c], eax
jmp 0x14000aabc
mov r9, qword [rbx + 8]
mov qword [rsp + 0x20], r13
mov edx, 0x105
lea rcx, [rsp + 0x38]
lea r8, [0x14002ff8a]
call fcn.140027360
cmp qword [rsp + 0x38], 0
je 0x14000aaf9
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x38]
mov r8, r15
call fcn.14000a720
mov edx, dword [rsp + 0x2c]
test edx, edx
mov ecx, eax
cmovs ecx, edx
test eax, eax
cmovs edx, ecx
mov dword [rsp + 0x2c], edx
call fcn.14000dce8
mov dword [rax], 0
jmp 0x14000aabc
mov dword [rsp + 0x2c], 0
call fcn.14000dce8
cmp dword [rax], 0
mov ebp, 0x80004005
mov eax, dword [rsp + 0x2c]
cmove ebp, eax
test eax, eax
cmovs ebp, eax
mov rcx, qword [rsp + 0x98]
cmp rcx, 0xffffffffffffffff
je 0x14000a899
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x14000a899