Function at 0x1800a22f0
Capabilities:
Check for time delay via gettickcount
Get file size

Disassembly:
push rbp
push r12
push r14
push r15
sub rsp, 0xed8
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0xeb0], rax
mov r12, rdx
mov rbp, rcx
test rcx, rcx
je 0x1800a2321
call fcn.1800fd3f0
mov r15d, 1
test r12, r12
je 0x1800a2342
mov r8d, r15d
mov rdx, r12
mov rcx, rbp
call fcn.180068a40
mov rcx, r12
call fcn.1800fd3f0
mov qword [rsp + 0xf10], rbx
mov qword [rsp + 0xed0], rsi
xor r14d, r14d
mov qword [rsp + 0xec8], rdi
mov qword [rsp + 0xec0], r13
cmp dword [0x1802210f4], r14d
je 0x1800a28af
mov r13d, r14d
mov ebx, r14d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
cmp dword [0x1802211f8], ebx
je 0x1800a23e1
movzx ecx, byte [0x18025c210]
cmp byte [r12], cl
je 0x1800a23e1
mov rcx, r12
call fcn.1800658c0
test eax, eax
jne 0x1800a23af
movzx ecx, byte [r12]
call fcn.180065cb0
test eax, eax
je 0x1800a23d5
lea rcx, [0x1802211fc]
mov r8d, r15d
mov rdx, rbp
call fcn.18008f400
test eax, eax
je 0x1800a23d5
movzx eax, byte [r12]
mov r13d, r15d
mov byte [0x18025c214], al
jmp 0x1800a23db
mov byte [0x18025c214], bl
mov dword [0x18025c218], edi
cmp dword [0x1802216ac], ebx
je 0x1800a24cb
movzx eax, byte [0x18025c211]
cmp byte [rbp], al
je 0x1800a2461
mov rcx, rbp
call fcn.1800658c0
test eax, eax
jne 0x1800a2412
movzx ecx, byte [rbp]
call fcn.180065cb0
test eax, eax
je 0x1800a244a
lea rcx, [0x18022138c]
xor r8d, r8d
mov rdx, rbp
call fcn.18008f400
test eax, eax
je 0x1800a244a
movzx eax, byte [rbp]
mov dword [0x18025c21c], edi
mov ebx, r15d
mov byte [0x18025c215], al
movzx eax, byte [rbp]
mov byte [0x18025c211], al
jmp 0x1800a24cb
mov byte [0x18025c215], bl
mov dword [0x18025c21c], edi
mov al, byte [rbp]
mov byte [0x18025c211], al
jmp 0x1800a24cb
mov eax, edi
sub eax, dword [0x18025c21c]
cmp eax, 0xea60
jbe 0x1800a24b8
mov rcx, rbp
call fcn.1800658c0
test eax, eax
jne 0x1800a2489
movzx ecx, byte [rbp]
call fcn.180065cb0
test eax, eax
je 0x1800a24ae
lea rcx, [0x18022138c]
xor r8d, r8d
mov rdx, rbp
call fcn.18008f400
test eax, eax
je 0x1800a24ae
movzx eax, byte [rbp]
mov ebx, r15d
mov byte [0x18025c215], al
jmp 0x1800a24be
xor al, al
mov byte [0x18025c215], al
jmp 0x1800a24be
mov al, byte [0x18025c215]
mov dword [0x18025c21c], edi
cmp byte [rbp], al
cmove ebx, r15d
test r13d, r13d
jne 0x1800a24d8
test ebx, ebx
je 0x1800a28af
cmp dword [0x1802216b4], r14d
jne 0x1800a24ee
cmp dword [0x1802216b8], r14d
je 0x1800a28af
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov edx, 0x80000000
lea r8d, [r9 + 3]
mov rcx, rbp
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800a2535
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rdi
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13d, r13d
je 0x1800a2769
test ebx, ebx
je 0x1800a26a4
mov edx, 0x5c
mov rcx, rbp
call fcn.1800f7e94
mov edx, 0x5c
mov rcx, r12
mov rbx, rax
call fcn.1800f7e94
test rbx, rbx
je 0x1800a2831
test rax, rax
je 0x1800a2831
sub rbx, rbp
sub rax, r12
cmp rbx, rax
jne 0x1800a260d
mov r8, rbx
mov rdx, r12
mov rcx, rbp
call fcn.18010c858
test eax, eax
jne 0x1800a260d
lea rdx, [0x180151500]
lea ecx, [rax + 2]
call fcn.180001000
lea rdx, [0x1801514fc]
mov ecx, 3
mov rdi, rax
call fcn.180001000
lea rdx, [0x180150fd0]
mov ecx, 0x424
mov rbx, rax
call fcn.180001000
mov r8d, dword [0x1802210f8]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rbx
lea r9, [0x1802210fc]
lea rdx, str.kind103__policyid_d__policyname_s__context_s___s___s__s
lea rcx, [rsp + 0x6b0]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.1800f509c
jmp 0x1800a2831
lea rdx, [0x180151500]
mov ecx, 2
call fcn.180001000
lea rdx, [0x180151370]
mov ecx, 0x3f9
mov rsi, rax
call fcn.180001000
lea rdx, [0x1801514ec]
mov ecx, 5
mov rdi, rax
call fcn.180001000
lea rdx, [0x180150fc0]
mov ecx, 0x425
mov rbx, rax
call fcn.180001000
mov r8d, dword [0x1802210f8]
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x48], r14d
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rbx
lea r9, [0x1802210fc]
lea rdx, str.kind103__policyid_d__policyname_s__context_s___s___s_s___s_d_bytes_
lea rcx, [rsp + 0x6b0]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.1800f509c
jmp 0x1800a2831
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x60], 0
call fcn.1800f4fb0
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.180065a00
lea rdx, [0x180151500]
mov ecx, 2
call fcn.180001000
lea rdx, [0x180151370]
mov ecx, 0x3f9
mov rsi, rax
call fcn.180001000
lea rdx, [0x1801514fc]
mov ecx, 3
mov rdi, rax
call fcn.180001000
lea rdx, [0x180150f90]
mov ecx, 0x428
mov rbx, rax
call fcn.180001000
mov r8d, dword [0x1802210f8]
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rcx
lea r9, [0x1802210fc]
lea rcx, [rsp + 0x6b0]
lea rdx, str.kind103__policyid_d__policyname_s__context_s__s___s___s_s__s_d_bytes_.__s
mov qword [rsp + 0x20], rax
call fcn.1800f509c
jmp 0x1800a2831
test ebx, ebx
je 0x1800a2831
lea rdx, str.RECYCLED_
mov rcx, r12
call fcn.1800f4d08
test rax, rax
jne 0x1800a2831
lea rdx, str.RECYCLER_
mov rcx, r12
call fcn.1800f4d08
test rax, rax
jne 0x1800a2831
lea rdx, [0x180151500]
lea ecx, [rax + 2]
call fcn.180001000
lea rdx, [0x180151370]
mov ecx, 0x3f9
mov rsi, rax
call fcn.180001000
lea rdx, [0x1801514fc]
mov ecx, 3
mov rdi, rax
call fcn.180001000
lea rdx, [0x180150f70]
mov ecx, 0x429
mov rbx, rax
call fcn.180001000
mov r8d, dword [0x1802210f8]
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x48], r14d
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rbx
lea r9, [0x1802210fc]
lea rdx, str.kind102__policyid_d__policyname_s__context_s___s___s_s__s_d_bytes_.__s
lea rcx, [rsp + 0x6b0]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.1800f509c
lea rcx, [0x1801f5210]
mov rdx, rbp
call fcn.180067220
test eax, eax
jne 0x1800a288b
mov r8d, dword [0x1802216b8]
mov edx, dword [0x1802216b4]
lea rax, [rsp + 0x6b0]
xor r14d, r14d
lea rcx, [0x180162c48]
xor r9d, r9d
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rax
lea rax, str.MyMoveFileExW_RemoteDiskPolicy
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x80
call fcn.18008e860
jmp 0x1800a288e
xor r14d, r14d
test r13d, r13d
je 0x1800a28af
cmp dword [0x1802216c4], 0
je 0x1800a28af
mov edx, 0x500
mov r8d, 2
mov rcx, rbp
call fcn.180068d50
cmp dword [0x180221ea4], 0
je 0x1800a2e81
mov r13d, r14d
mov ebx, r14d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x180221fac], 0
mov edi, eax
je 0x1800a292d
movzx ecx, byte [0x18025c210]
cmp byte [r12], cl
je 0x1800a292d
mov rcx, r12
call fcn.1800658c0
test eax, eax
jne 0x1800a28fa
movzx ecx, byte [r12]
call fcn.180065cb0
test eax, eax
je 0x1800a2920
lea rcx, [0x180221fb0]
mov r8d, r15d
mov rdx, rbp
call fcn.18008f400
test eax, eax
je 0x1800a2920
movzx eax, byte [r12]
mov r13d, r15d
mov byte [0x18025c214], al
jmp 0x1800a2927
mov byte [0x18025c214], 0
mov dword [0x18025c218], edi
cmp dword [0x1802222d0], 0
je 0x1800a2a19
movzx eax, byte [0x18025c211]
cmp byte [rbp], al
je 0x1800a29af
mov rcx, rbp
call fcn.1800658c0
test eax, eax
jne 0x1800a295f
movzx ecx, byte [rbp]
call fcn.180065cb0
test eax, eax
je 0x1800a2997
lea rcx, [0x180222140]
xor r8d, r8d
mov rdx, rbp
call fcn.18008f400
test eax, eax
je 0x1800a2997
movzx eax, byte [rbp]
mov dword [0x18025c21c], edi
mov ebx, r15d
mov byte [0x18025c215], al
movzx eax, byte [rbp]
mov byte [0x18025c211], al
jmp 0x1800a2a19
mov byte [0x18025c215], 0
mov dword [0x18025c21c], edi
mov al, byte [rbp]
mov byte [0x18025c211], al
jmp 0x1800a2a19
mov eax, edi
sub eax, dword [0x18025c21c]
cmp eax, 0xea60
jbe 0x1800a2a06
mov rcx, rbp
call fcn.1800658c0
test eax, eax
jne 0x1800a29d7
movzx ecx, byte [rbp]
call fcn.180065cb0
test eax, eax
je 0x1800a29fc
lea rcx, [0x180222140]
xor r8d, r8d
mov rdx, rbp
call fcn.18008f400
test eax, eax
je 0x1800a29fc
movzx eax, byte [rbp]
mov ebx, r15d
mov byte [0x18025c215], al
jmp 0x1800a2a0c
xor al, al
mov byte [0x18025c215], al
jmp 0x1800a2a0c
mov al, byte [0x18025c215]
mov dword [0x18025c21c], edi
cmp byte [rbp], al
cmove ebx, r15d
test r13d, r13d
jne 0x1800a2a26
test ebx, ebx
je 0x1800a2e81
cmp dword [0x1802222d4], 0
jne 0x1800a2a3c
cmp dword [0x1802222d8], 0
je 0x1800a2e81
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov edx, 0x80000000
lea r8d, [r9 + 3]
mov rcx, rbp
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, r14d
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800a2a85
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13d, r13d
je 0x1800a2d47
test ebx, ebx
je 0x1800a2c7d
mov edx, 0x5c
mov rcx, rbp
call fcn.1800f7e94
mov edx, 0x5c
mov rcx, r12
mov rbx, rax
call fcn.1800f7e94
test rbx, rbx
je 0x1800a2e40
test rax, rax
je 0x1800a2e40
sub rbx, rbp
sub rax, r12
cmp rbx, rax
jne 0x1800a2bb3
mov r8, rbx
mov rdx, r12
mov rcx, rbp
call fcn.18010c858
test eax, eax
jne 0x1800a2bb3
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x60], al
call fcn.1800f4fb0
mov ecx, dword [0x1802222dc]
lea r11, [rsp + 0x4a0]
lea rax, [rsp + 0x390]
lea r9, [rsp + 0x280]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x170]
mov r8, r12
mov rdx, rbp
mov qword [rsp + 0x20], rax
call fcn.180085950
lea r11, [rsp + 0x4a0]
lea rax, [rsp + 0x390]
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x170]
lea rdx, str.Mode_d_r_nSrcP_s_r_nDstP_s_r_nFSize_d_r_nFSign_s_r_nFCode_s_r_nCreateTime_s_r_nMifTime_s_r_nUType_s
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x280]
lea rcx, [rsp + 0x6b0]
mov qword [rsp + 0x30], rax
mov r9, rbp
mov r8d, 3
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r12
call fcn.1800f509c
jmp 0x1800a2e40
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x60], 0
call fcn.1800f4fb0
mov ecx, dword [0x1802222dc]
lea r11, [rsp + 0x4a0]
lea rax, [rsp + 0x280]
lea r9, [rsp + 0x390]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x170]
mov r8, r12
mov rdx, rbp
mov qword [rsp + 0x20], rax
call fcn.180085950
lea r11, [rsp + 0x4a0]
lea rax, [rsp + 0x280]
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x170]
lea rdx, str.Mode_d_r_nSrcP_s_r_nDstP_s_r_nFSize_d_r_nFSign_s_r_nFCode_s_r_nCreateTime_s_r_nMifTime_s_r_nUType_s
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x390]
lea rcx, [rsp + 0x6b0]
mov qword [rsp + 0x30], rax
mov r9, rbp
mov r8d, 2
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r12
call fcn.1800f509c
jmp 0x1800a2e40
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x60], 0
call fcn.1800f4fb0
mov ecx, dword [0x1802222dc]
lea r11, [rsp + 0x4a0]
lea rax, [rsp + 0x280]
lea r9, [rsp + 0x390]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x170]
mov r8, r12
mov rdx, rbp
mov qword [rsp + 0x20], rax
call fcn.180085950
lea r11, [rsp + 0x4a0]
lea rax, [rsp + 0x280]
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x170]
lea rdx, str.Mode_d_r_nSrcP_s_r_nDstP_s_r_nFSize_d_r_nFSign_s_r_nFCode_s_r_nCreateTime_s_r_nMifTime_s_r_nUType_s
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x390]
lea rcx, [rsp + 0x6b0]
mov qword [rsp + 0x30], rax
mov r9, rbp
mov r8d, 2
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r12
call fcn.1800f509c
jmp 0x1800a2e40
test ebx, ebx
je 0x1800a2e40
lea rdx, str.RECYCLED_
mov rcx, r12
call fcn.1800f4d08
test rax, rax
jne 0x1800a2e40
lea rdx, str.RECYCLER_
mov rcx, r12
call fcn.1800f4d08
test rax, rax
jne 0x1800a2e40
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x60], al
call fcn.1800f4fb0
mov ecx, dword [0x1802222dc]
lea r11, [rsp + 0x4a0]
lea rax, [rsp + 0x280]
lea r9, [rsp + 0x390]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x170]
mov r8, r12
mov rdx, rbp
mov qword [rsp + 0x20], rax
call fcn.180085950
lea r11, [rsp + 0x4a0]
lea rax, [rsp + 0x280]
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x170]
lea rdx, str.Mode_d_r_nSrcP_s_r_nDstP_s_r_nFSize_d_r_nFSign_s_r_nFCode_s_r_nCreateTime_s_r_nMifTime_s_r_nUType_s
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x390]
lea rcx, [rsp + 0x6b0]
mov qword [rsp + 0x30], rax
mov r9, rbp
mov r8d, r15d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r12
call fcn.1800f509c
lea rcx, [0x1801f5210]
mov rdx, rbp
call fcn.180067220
test eax, eax
jne 0x1800a2e81
mov dword [rsp + 0x38], r15d
lea rax, [rsp + 0x6b0]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0xe
call fcn.18008e860
mov r13, qword [rsp + 0xec0]
mov rdi, qword [rsp + 0xec8]
mov rsi, qword [rsp + 0xed0]
mov rbx, qword [rsp + 0xf10]
mov eax, r15d
mov rcx, qword [rsp + 0xeb0]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0xed8
pop r15
pop r14
pop r12
pop rbp
ret