Function at 0x140004970
Capabilities:
Copy file
Delete file

Disassembly:
jmp 0x140004970
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x498
mov rdi, rsp
movabs rcx, 0x126
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4b0]
mov qword [rsp + 0x408], 0xfffffffffffffffe
mov rax, qword [0x1402e9ae8]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov eax, 0x49
mov word [rsp + 0x38], ax
mov eax, reloc.OLEAUT32.dll_VarBstrFromDate
mov word [rsp + 0x3a], ax
mov eax, reloc.OLEAUT32.dll_VarBstrFromDate
mov word [rsp + 0x3c], ax
mov eax, 0x78
mov word [rsp + 0x3e], ax
mov eax, VarCyFromDisp
mov word [rsp + 0x40], ax
mov eax, VarBstrFromDate
mov word [rsp + 0x42], ax
mov eax, 0x74
mov word [rsp + 0x44], ax
mov eax, 0x4f
mov word [rsp + 0x46], ax
mov eax, 0x76
mov word [rsp + 0x48], ax
mov eax, 0x78
mov word [rsp + 0x4a], ax
mov eax, VarCyFromDisp
mov word [rsp + 0x4c], ax
mov eax, VarBstrFromDate
mov word [rsp + 0x4e], ax
mov eax, 0x62
mov word [rsp + 0x50], ax
mov eax, 0x78
mov word [rsp + 0x52], ax
xor eax, eax
mov word [rsp + 0x54], ax
mov eax, VarBstrFromDate
mov word [rsp + 0x78], ax
mov eax, 0x69
mov word [rsp + 0x7a], ax
mov eax, 0x7a
mov word [rsp + 0x7c], ax
mov eax, 0x45
mov word [rsp + 0x7e], ax
mov eax, 0x6a
mov word [rsp + 0x80], ax
xor eax, eax
mov word [rsp + 0x82], ax
lea rax, [rsp + 0x220]
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0x258]
mov qword [rsp + 0x288], rax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x250]
call fcn.1400016b8
mov qword [rsp + 0x410], rax
mov rax, qword [rsp + 0x410]
mov qword [rsp + 0x418], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x288]
call fcn.1400016b8
mov qword [rsp + 0x420], rax
mov r8, qword [rsp + 0x418]
mov rdx, qword [rsp + 0x420]
lea rcx, [rsp + 0xa8]
call fcn.140001235
nop
lea rax, [rsp + 0x290]
mov qword [rsp + 0x2c0], rax
mov rcx, qword [rsp + 0x4b0]
call fcn.1400012d5
mov rdi, rax
xor edx, edx
mov rcx, qword [rsp + 0x4b0]
call fcn.1400016a9
mov rbx, rax
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x2c0]
call fcn.14000118b
mov qword [rsp + 0x428], rax
mov rdx, qword [rsp + 0x428]
mov rcx, qword [rsp + 0x4b8]
call fcn.1400012e4
lea r9, [rsp + 0xf4]
mov r8d, 0x40
mov rdx, rdi
mov rcx, rbx
call rax
mov eax, 0x50
mov word [rsp + 0x118], ax
mov eax, 0x3a
mov word [rsp + 0x11a], ax
mov eax, VarDateFromDisp
mov word [rsp + 0x11c], ax
mov eax, 0x41
mov word [rsp + 0x11e], ax
mov eax, VarBstrFromDate
mov word [rsp + 0x120], ax
mov eax, 0x73
mov word [rsp + 0x122], ax
mov eax, 0x75
mov word [rsp + 0x124], ax
mov eax, 0x61
mov word [rsp + 0x126], ax
mov eax, 0x77
mov word [rsp + 0x128], ax
mov eax, VarCyFromDisp
mov word [rsp + 0x12a], ax
mov eax, VarDateFromDisp
mov word [rsp + 0x12c], ax
mov eax, 0x75
mov word [rsp + 0x12e], ax
mov eax, 0x6c
mov word [rsp + 0x130], ax
mov eax, 0x2e
mov word [rsp + 0x132], ax
mov eax, 0x6c
mov word [rsp + 0x134], ax
mov eax, 0x63
mov word [rsp + 0x136], ax
mov eax, 0x76
mov word [rsp + 0x138], ax
xor eax, eax
mov word [rsp + 0x13a], ax
mov eax, VarBstrFromDate
mov word [rsp + 0x158], ax
mov eax, 0x45
mov word [rsp + 0x15a], ax
mov eax, 0x48
mov word [rsp + 0x15c], ax
mov eax, 0x46
mov word [rsp + 0x15e], ax
mov eax, 0x52
mov word [rsp + 0x160], ax
mov eax, VarBstrFromDate
mov word [rsp + 0x162], ax
mov eax, 0x41
mov word [rsp + 0x164], ax
mov eax, 0x4c
mov word [rsp + 0x166], ax
xor eax, eax
mov word [rsp + 0x168], ax
mov eax, 0x50
mov word [rsp + 0x190], ax
mov eax, 0x3a
mov word [rsp + 0x192], ax
mov eax, VarDateFromDisp
mov word [rsp + 0x194], ax
mov eax, 0x4a
mov word [rsp + 0x196], ax
mov eax, 0x79
mov word [rsp + 0x198], ax
mov eax, 0x76
mov word [rsp + 0x19a], ax
mov eax, reloc.OLEAUT32.dll_VarBstrFromDisp
mov word [rsp + 0x19c], ax
mov eax, 0x77
mov word [rsp + 0x19e], ax
mov eax, 0x6a
mov word [rsp + 0x1a0], ax
mov eax, VarCyFromDisp
mov word [rsp + 0x1a2], ax
mov eax, VarDateFromDisp
mov word [rsp + reloc.OLEAUT32.dll_OleTranslateColor], ax
mov eax, 0x4a
mov word [rsp + 0x1a6], ax
mov eax, VarBstrFromDate
mov word [rsp + 0x1a8], ax
mov eax, 0x61
mov word [rsp + 0x1aa], ax
mov eax, 0x78
mov word [rsp + 0x1ac], ax
mov eax, VarDateFromDisp
mov word [rsp + 0x1ae], ax
mov eax, 0x34
mov word [rsp + 0x1b0], ax
mov eax, 0x39
mov word [rsp + 0x1b2], ax
mov eax, VarBstrFromDate
mov word [rsp + 0x1b4], ax
mov eax, VarBstrFromDate
mov word [rsp + 0x1b6], ax
mov eax, 0x35
mov word [rsp + 0x1b8], ax
mov eax, 0x39
mov word [rsp + 0x1ba], ax
mov eax, reloc.OLEAUT32.dll_VarBstrFromDate
mov word [rsp + 0x1bc], ax
mov eax, 0x6a
mov word [rsp + 0x1be], ax
mov eax, VarBstrFromDate
mov word [rsp + 0x1c0], ax
mov eax, VarBstrFromDate
mov word [rsp + 0x1c2], ax
mov eax, 0x35
mov word [rsp + 0x1c4], ax
mov eax, 0x36
mov word [rsp + 0x1c6], ax
mov eax, reloc.OLEAUT32.dll_VarBstrFromDisp
mov word [rsp + 0x1c8], ax
mov eax, 0x30
mov word [rsp + 0x1ca], ax
mov eax, 0x35
mov word [rsp + 0x1cc], ax
mov eax, 0x37
mov word [rsp + 0x1ce], ax
mov eax, 0x2e
mov word [rsp + 0x1d0], ax
mov eax, 0x79
mov word [rsp + 0x1d2], ax
mov eax, VarCyFromDisp
mov word [rsp + 0x1d4], ax
mov eax, VarBstrFromDate
mov word [rsp + 0x1d6], ax
xor eax, eax
mov word [rsp + 0x1d8], ax
mov eax, 0x4e
mov word [rsp + 0x1f8], ax
mov eax, 0x4e
mov word [rsp + 0x1fa], ax
mov eax, 0x51
mov word [rsp + 0x1fc], ax
mov eax, 0x69
mov word [rsp + 0x1fe], ax
mov eax, 0x4f
mov word [rsp + 0x200], ax
mov eax, 0x49
mov word [rsp + 0x202], ax
xor eax, eax
mov word [rsp + 0x204], ax
lea rax, [rsp + 0x2c8]
mov qword [rsp + 0x2f8], rax
lea rax, [rsp + 0x300]
mov qword [rsp + 0x330], rax
lea rdx, [rsp + 0x1f8]
mov rcx, qword [rsp + 0x2f8]
call fcn.1400016b8
mov qword [rsp + 0x430], rax
mov rax, qword [rsp + 0x430]
mov qword [rsp + 0x438], rax
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0x330]
call fcn.1400016b8
mov qword [rsp + 0x440], rax
mov r8, qword [rsp + 0x438]
mov rdx, qword [rsp + 0x440]
lea rcx, [rsp + 0x338]
call fcn.140001235
mov qword [rsp + 0x448], rax
mov rax, qword [rsp + 0x448]
mov qword [rsp + 0x450], rax
mov rcx, qword [rsp + 0x450]
call fcn.1400012a8
mov rdx, rax
lea rcx, [rsp + 0xa8]
call fcn.1400015eb
nop
lea rcx, [rsp + 0x338]
call fcn.1400013d9
lea rcx, [rsp + 0xa8]
call fcn.1400012a8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rax, [rsp + 0x368]
mov qword [rsp + 0x398], rax
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x3d0], rax
xor edx, edx
mov rcx, qword [rsp + 0x4b0]
call fcn.1400016a9
mov rdi, rax
lea rcx, [rsp + 0xa8]
call fcn.1400012a8
mov rbx, rax
lea rdx, [rsp + 0x158]
mov rcx, qword [rsp + 0x398]
call fcn.1400016b8
mov qword [rsp + 0x458], rax
mov rax, qword [rsp + 0x458]
mov qword [rsp + 0x460], rax
lea rdx, [rsp + 0x118]
mov rcx, qword [rsp + 0x3d0]
call fcn.1400016b8
mov qword [rsp + 0x468], rax
mov r8, qword [rsp + 0x460]
mov rdx, qword [rsp + 0x468]
lea rcx, [rsp + 0x3d8]
call fcn.140001235
mov qword [rsp + 0x470], rax
mov rax, qword [rsp + 0x470]
mov qword [rsp + 0x478], rax
mov rcx, qword [rsp + 0x478]
call fcn.1400012a8
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileExA]
nop
lea rcx, [rsp + 0x3d8]
call fcn.1400013d9
nop
lea rcx, [rsp + 0xa8]
call fcn.1400013d9
nop
mov rcx, qword [rsp + 0x4b0]
call fcn.1400015a5
mov rcx, rsp
lea rdx, reloc.oledlg.dll_OleUIBusyA
call fcn.140153d00
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140153ce0
add rsp, 0x498
pop rdi
pop rbx
ret