Function at 0x1400025c0
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x140043018]
xor rax, rsp
mov qword [rbp + 0xf0], rax
xor r15d, r15d
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], r15b
lea r8d, [r15 + 0x10]
lea rdx, str.net_stop_Spooler
lea rcx, [rbp - 0x50]
call fcn.140004310
nop
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], r15b
lea r8d, [r15 + 0x11]
lea rdx, str.net_start_Spooler
lea rcx, [rbp - 0x70]
call fcn.140004310
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov r8, qword [rbp - 0x40]
call fcn.1400064d0
mov rcx, rax
call fcn.1400056a0
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
call fcn.140012824
mov edx, eax
call fcn.140002e10
mov rcx, rax
call fcn.1400056a0
mov edx, pe_nt_image_headers64
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], r15b
lea rax, [rbp - 0x10]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400026c0
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x30]
call fcn.140004310
nop
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov r8d, 0x18
lea rdx, str._System32_gwiportmon.dll
lea rcx, [rsp + 0x30]
call fcn.140004310
nop
lea rax, [rbp - 0x10]
mov rbx, rdi
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x140002710
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, r8
cmp rbx, rax
ja 0x1400027bf
lea rax, [r8 + rbx]
mov qword [rsp + 0x40], rax
lea rsi, [rsp + 0x30]
cmp rcx, 0x10
cmovae rsi, qword [rsp + 0x30]
lea rax, [rbp - 0x10]
add rax, rbx
cmp rax, rsi
jbe 0x14000277d
lea rax, [rsi + r8]
lea rcx, [rbp - 0x10]
cmp rcx, rax
ja 0x14000277d
lea rax, [rbp - 0x10]
cmp rsi, rax
ja 0x140002771
mov r14, r15
jmp 0x140002780
lea rax, [rbp - 0x10]
mov r14, rsi
sub r14, rax
jmp 0x140002780
mov r14, rbx
lea rcx, [rsi + rbx]
inc r8
mov rdx, rsi
call fcn.14000c8f0
mov r8, r14
lea rdx, [rbp - 0x10]
mov rcx, rsi
call fcn.14000c8f0
lea rcx, [rsi + r14]
mov r8, rbx
sub r8, r14
lea rax, [r14 + rbx]
lea rdx, [rbp - 0x10]
add rdx, rax
call fcn.14000c8f0
lea rax, [rsp + 0x30]
jmp 0x1400027da
mov qword [rsp + 0x28], rbx
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140006780
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14000285d
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002858
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002dd3
call fcn.14000aa90
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400028ad
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002dd9
call fcn.14000aa90
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov r8d, 0x18
lea rdx, str._System32_gwiportmon.dll
lea rcx, [rsp + 0x30]
call fcn.140004310
nop
lea rax, [rbp - 0x10]
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400028e4
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, r8
cmp rbx, rax
ja 0x140002993
lea rax, [r8 + rbx]
mov qword [rsp + 0x40], rax
lea rsi, [rsp + 0x30]
cmp rcx, 0x10
cmovae rsi, qword [rsp + 0x30]
lea rax, [rbp - 0x10]
add rax, rbx
cmp rax, rsi
jbe 0x140002951
lea rax, [rsi + r8]
lea rcx, [rbp - 0x10]
cmp rcx, rax
ja 0x140002951
lea rax, [rbp - 0x10]
cmp rsi, rax
ja 0x140002945
mov r14, r15
jmp 0x140002954
lea rax, [rbp - 0x10]
mov r14, rsi
sub r14, rax
jmp 0x140002954
mov r14, rbx
lea rcx, [rsi + rbx]
inc r8
mov rdx, rsi
call fcn.14000c8f0
mov r8, r14
lea rdx, [rbp - 0x10]
mov rcx, rsi
call fcn.14000c8f0
lea rcx, [rsi + r14]
mov r8, rbx
sub r8, r14
lea rax, [r14 + rbx]
lea rdx, [rbp - 0x10]
add rdx, rax
call fcn.14000c8f0
lea rax, [rsp + 0x30]
jmp 0x1400029ae
mov qword [rsp + 0x28], rbx
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140006780
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
xor r8d, r8d
lea rcx, str..._gwiportmon.dll
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140002a3b
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002ddf
call fcn.14000aa90
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140002a8b
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a86
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002de5
call fcn.14000aa90
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov r8d, 0x17
lea rdx, str._System32_gwiportui.dll
lea rcx, [rsp + 0x30]
call fcn.140004310
nop
lea rax, [rbp - 0x10]
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x140002ac0
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, r8
cmp rdi, rax
ja 0x140002b6f
lea rax, [r8 + rdi]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rcx, 0x10
cmovae rbx, qword [rsp + 0x30]
lea rax, [rbp - 0x10]
add rax, rdi
cmp rax, rbx
jbe 0x140002b2d
lea rax, [rbx + r8]
lea rcx, [rbp - 0x10]
cmp rcx, rax
ja 0x140002b2d
lea rax, [rbp - 0x10]
cmp rbx, rax
ja 0x140002b21
mov rsi, r15
jmp 0x140002b30
lea rax, [rbp - 0x10]
mov rsi, rbx
sub rsi, rax
jmp 0x140002b30
mov rsi, rdi
lea rcx, [rbx + rdi]
inc r8
mov rdx, rbx
call fcn.14000c8f0
mov r8, rsi
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.14000c8f0
lea rcx, [rbx + rsi]
mov r8, rdi
sub r8, rsi
lea rax, [rsi + rdi]
lea rdx, [rbp - 0x10]
add rdx, rax
call fcn.14000c8f0
lea rax, [rsp + 0x30]
jmp 0x140002b8a
mov qword [rsp + 0x28], rdi
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140006780
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
xor r8d, r8d
lea rcx, str..._gwiportui.dll
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140002c17
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002deb
call fcn.14000aa90
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140002c67
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002df1
call fcn.14000aa90
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rdx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x60]
call fcn.1400064d0
mov rcx, rax
call fcn.1400056a0
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rcx, qword [rbp - 0x70]
call fcn.140012824
mov edx, eax
call fcn.140002e10
mov rcx, rax
call fcn.1400056a0
lea rax, str.gwiportmon.dll
mov qword [rbp - 0x78], rax
lea rax, str.GWI_Port_Monitor
mov qword [rsp + 0x78], rax
lea rax, str.Windows_x64
mov qword [rbp - 0x80], rax
lea r8, [rsp + 0x78]
mov edx, 2
xor ecx, ecx
call qword [sym.imp.WINSPOOL.DRV_AddMonitorW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140002d1f
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002df7
call fcn.14000aa90
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140002d5a
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002dfd
call fcn.14000aa90
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140002da1
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d9c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002dcd
call fcn.14000aa90
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.14000aa70
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140012cd4
nop
call fcn.140012cd4
nop
call fcn.140012cd4
nop
call fcn.140012cd4
nop
call fcn.140012cd4
nop
call fcn.140012cd4
nop
call fcn.140012cd4
nop
call fcn.140012cd4
nop
call fcn.140012cd4
int3