Function at 0x140010d18
Capabilities:
Create directory
Delete file
Get common file path
Move file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x4a0
mov rax, qword [0x1400280c8]
xor rax, rsp
mov qword [rsp + 0x490], rax
and qword [rsp + 0x48], 0
xor eax, eax
or rdi, 0xffffffffffffffff
and dword [rsp + 0x40], eax
mov rbp, r9
mov r12, r8
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov rsi, rdi
mov r14, rdx
mov r13, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140020010
cmp dword [rsp + 0x40], 0
mov ecx, 0x104
je 0x140010ecb
lea rdx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x140010dbc
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010ff6
jmp 0x140010dc0
mov ebx, dword [rsp + 0x40]
lea r9, [rsp + 0x70]
lea rdx, [0x140022b10]
lea rcx, [rsp + 0x280]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x140010dfd
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010ff6
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140010e28
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010ff6
lea rcx, [rsp + 0x50]
call fcn.140010cd4
test eax, eax
jne 0x140010e52
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010ff6
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140010e8d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010ff6
mov rcx, rdi
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
not rcx
cmp word [rsp + rcx*2 + 0x6c], 0x5c
je 0x140010ef6
lea r8, [0x140021cb0]
lea rcx, [rsp + 0x70]
or r9, 0xffffffffffffffff
mov edx, 0x104
call fcn.14001475c
mov ebx, eax
test eax, eax
js 0x140010ff6
jmp 0x140010ef6
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x140010ef2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jmp 0x140010ec3
mov ebx, dword [rsp + 0x40]
xor edi, edi
cmp rsi, 0xffffffffffffffff
jne 0x140010fc1
lea r8, [rsp + 0x70]
lea rdx, str._s_s_05d._s
lea rcx, [rsp + 0x48]
mov r9, r13
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], edi
call fcn.1400108c0
mov ebx, eax
test eax, eax
js 0x140010ff6
and qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x48]
lea r8d, [rsi + 2]
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140010f8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, 0x80070050
jne 0x140010f84
xor ebx, ebx
jmp 0x140010fb3
test ebx, ebx
js 0x140010fe7
jmp 0x140010fb3
mov rcx, qword [rsp + 0x48]
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [rsp + 0x40], 0
je 0x140010fb3
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
inc edi
cmp edi, 0x3e8
jl 0x140010ef8
test rbp, rbp
je 0x140010fca
mov qword [rbp], rsi
test r12, r12
je 0x140010fde
mov rax, qword [rsp + 0x48]
and qword [rsp + 0x48], 0
mov qword [r12], rax
test ebx, ebx
js 0x140010fe7
test rbp, rbp
jne 0x140010ff6
cmp rsi, 0xffffffffffffffff
je 0x140010ff6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140011005
call fcn.140010460
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1400146fc
add rsp, 0x4a0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret