Function at 0x140003440
Capabilities:
Copy file
Get file attributes
Hash data using djb2
Set file attributes
Timestomp file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x400]
sub rsp, 0x500
xor ebx, ebx
xorps xmm0, xmm0
mov qword [rbp - 0x80], rbx
mov r15, rdx
mov rdi, rcx
movups xmmword [rcx], xmm0
lea r12, [rbx - 1]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
test r9, r9
je 0x140003d4e
mov r13, qword [rbp + 0x460]
mov rax, r8
sub rax, rdx
add rax, 4
sub r8, rdx
mov qword [rbp - 0x58], rax
mov qword [rbp + 0x450], r8
nop word [rax + rax]
movsxd r14, dword [r15]
mov eax, ebx
sub eax, dword [r15]
add r14, r15
neg eax
sbb rax, rax
and r14, rax
mov eax, ebx
sub eax, dword [r8 + r15]
neg eax
movsxd rax, dword [r8 + r15]
movzx edx, byte [r14]
lea r9, [r14 + 1]
sbb rbx, rbx
add rax, r8
add rax, r15
mov r8d, 0x1505
and rbx, rax
test edx, edx
je 0x140003510
nop dword [rax]
lea eax, [rdx - 0x41]
cmp eax, 0x1a
lea ecx, [rdx + 0x20]
lea r9, [r9 + 1]
cmovb edx, ecx
imul r8d, r8d, 0x21
add r8d, edx
movzx edx, byte [r9 - 1]
test edx, edx
jne 0x1400034f0
test r8d, r8d
lea rcx, [rbp - 0x48]
mov r9d, 1
mov rdx, r13
cmovne r9d, r8d
mov r8, r14
call fcn.1400490d0
mov esi, dword [rbp - 0x48]
test sil, 1
je 0x140003d31
mov eax, esi
shr eax, 3
test al, 1
jne 0x140003d28
movzx edx, byte [rbx]
lea r9, [rbx + 1]
mov r8d, 0x1505
test edx, edx
je 0x140003580
nop word [rax + rax]
lea eax, [rdx - 0x41]
cmp eax, 0x1a
lea ecx, [rdx + 0x20]
lea r9, [r9 + 1]
cmovb edx, ecx
imul r8d, r8d, 0x21
add r8d, edx
movzx edx, byte [r9 - 1]
test edx, edx
jne 0x140003560
test r8d, r8d
lea rcx, [rbp - 0x30]
mov r9d, 1
mov rdx, r13
cmovne r9d, r8d
mov r8, rbx
call fcn.1400490d0
mov ecx, dword [rbp - 0x30]
test cl, 1
je 0x1400035bd
mov eax, ecx
shr eax, 3
test al, 1
jne 0x14000387b
shr ecx, 5
test cl, 1
jne 0x14000385e
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.140013d00
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140014000
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140013d00
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140014000
xor r14d, r14d
mov dword [rsp + 0x28], 0x800
cmp qword [rsp + 0x58], 8
lea rax, [rbp + 0x440]
lea rdx, [rsp + 0x40]
mov dword [rbp + 0x440], r14d
cmovae rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
mov qword [rsp + 0x20], rax
cmovae rcx, qword [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
jne 0x140003647
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, qword [rbp - 0x58]
mov rdx, rbx
mov rcx, r13
mov r8d, dword [rax + r15]
call fcn.140049050
cmp dword [rdi], r14d
jne 0x140003be1
mov eax, esi
shr eax, 4
test al, 1
jne 0x14000379d
cmp qword [rsp + 0x58], 8
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], r14
mov edx, pe_nt_image_headers64
cmovae rcx, qword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, r12
jne 0x1400036b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
jmp 0x1400036ea
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea r9, [rbp - 0x50]
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x1400036e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rdi], 0
jne 0x140003a97
shr esi, 5
test sil, 1
je 0x140003737
cmp qword [rsp + 0x58], 8
lea rcx, [rsp + 0x40]
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp qword [rsp + 0x58], 8
lea rcx, [rsp + 0x40]
cmovae rcx, qword [rsp + 0x40]
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x14000388a
movzx eax, byte [rbx]
lea r9, [rbx + 1]
mov r8d, 0x1505
test eax, eax
je 0x140003770
nop dword [rax + rax]
lea ecx, [rax - 0x41]
cmp ecx, 0x1a
lea edx, [rax + 0x20]
lea r9, [r9 + 1]
cmovb eax, edx
imul r8d, r8d, 0x21
add r8d, eax
movzx eax, byte [r9 - 1]
test eax, eax
jne 0x140003750
test r8d, r8d
lea rcx, [rbp - 0x18]
mov r9d, 1
mov rdx, r13
cmovne r9d, r8d
mov r8, rbx
call fcn.1400490d0
mov r9, qword [rbp - 0x10]
mov rax, qword [rbp - 0x40]
cmp r9, rax
jne 0x1400039dc
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400037df
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400037da
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003dd4
mov rcx, r8
call fcn.14004ba4c
mov rdx, qword [rsp + 0x78]
xor ebx, ebx
mov word [rsp + 0x40], bx
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
cmp rdx, 8
jb 0x140003836
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003831
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003dd4
mov rcx, r8
call fcn.14004ba4c
mov rcx, qword [rbp - 0x80]
add r15, 8
inc rcx
mov qword [rbp - 0x80], rcx
cmp rcx, qword [rbp + 0x458]
jae 0x140003d4e
mov r8, qword [rbp + 0x450]
jmp 0x1400034b0
lea r8, str.The_target_path_already_exists_and_is_read_only.
mov dword [rdi], r12d
mov edx, 0x400
lea rcx, [rbp]
call fcn.140003390
jmp 0x140003d4c
mov r9, rbx
lea r8, str.The_target_path__s_already_exists_as_a_directory.
jmp 0x140003d3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
lea rcx, [rbp + 0x458]
mov r9d, 0x400
mov dword [rdi], eax
mov qword [rsp + 0x30], rbx
mov r8d, eax
mov dword [rsp + 0x28], ebx
xor edx, edx
mov qword [rsp + 0x20], rcx
mov ecx, 0x1300
mov qword [rbp + 0x458], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rdx, qword [rbp + 0x458]
lea rcx, [rbp - 0x78]
call fcn.140013e70
cmp qword [rax + 0x18], 0x10
jb 0x1400038e0
mov rax, qword [rax]
mov r9, rax
lea r8, str.Clearing_the_readonly_flag_on_the_file_failed:__s
mov edx, 0x400
lea rcx, [rbp]
call fcn.140003390
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140003933
mov rcx, qword [rbp - 0x78]
inc rdx
cmp rdx, 0x1000
jb 0x14000392e
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003de0
mov rcx, r8
call fcn.14004ba4c
mov rcx, qword [rbp + 0x458]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140003982
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000397d
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003dce
mov rcx, r8
call fcn.14004ba4c
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bx
cmp rdx, 8
jb 0x140003d4e
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003d21
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003dce
jmp 0x140003d1e
lea r8, str.The_copied_file_is__llu_bytes__but_the_source_file_was__llu_bytes.
mov dword [rdi], r12d
mov edx, 0x400
mov qword [rsp + 0x20], rax
lea rcx, [rbp]
call fcn.140003390
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140003a3b
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003a36
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003dd4
mov rcx, r8
call fcn.14004ba4c
mov rdx, qword [rsp + 0x78]
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bx
cmp rdx, 8
jb 0x140003d4e
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003d21
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003dd4
jmp 0x140003d1e
mov r8d, dword [rdi]
lea rax, [rbp + 0x458]
xor ebx, ebx
mov r9d, 0x400
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
mov ecx, 0x1300
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x458], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rdx, qword [rbp + 0x458]
lea rcx, [rbp - 0x78]
call fcn.140013e70
cmp qword [rax + 0x18], 0x10
jb 0x140003ae5
mov rax, qword [rax]
mov r9, rax
lea r8, str.Updating_the_timestamp_on_the_file_failed:__s
mov edx, 0x400
lea rcx, [rbp]
call fcn.140003390
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140003b38
mov rcx, qword [rbp - 0x78]
inc rdx
cmp rdx, 0x1000
jb 0x140003b33
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003de6
mov rcx, r8
call fcn.14004ba4c
mov rcx, qword [rbp + 0x458]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140003b87
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003b82
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003dda
mov rcx, r8
call fcn.14004ba4c
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bx
cmp rdx, 8
jb 0x140003d4e
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003d21
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003dda
jmp 0x140003d1e
mov r8d, dword [rdi]
lea rax, [rbp + 0x458]
xor ebx, ebx
mov r9d, 0x400
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
mov ecx, 0x1300
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x458], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rdx, qword [rbp + 0x458]
lea rcx, [rbp - 0x78]
call fcn.140013e70
cmp qword [rax + 0x18], 0x10
jb 0x140003c2f
mov rax, qword [rax]
mov r9, rax
lea r8, str.Copying_the_file_failed:__s
mov edx, 0x400
lea rcx, [rbp]
call fcn.140003390
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140003c82
mov rcx, qword [rbp - 0x78]
inc rdx
cmp rdx, 0x1000
jb 0x140003c7d
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003dc8
mov rcx, r8
call fcn.14004ba4c
mov rcx, qword [rbp + 0x458]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140003cd1
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003ccc
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003dec
mov rcx, r8
call fcn.14004ba4c
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bx
cmp rdx, 8
jb 0x140003d4e
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003d21
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003dec
mov rcx, r8
call fcn.14004ba4c
jmp 0x140003d4e
lea r8, str.The_source_path__s_is_a_directory__which_is_not_supported.
jmp 0x140003d38
lea r8, str.The_source_path__s_does_not_exist.
mov r9, r14
mov edx, 0x400
mov dword [rdi], r12d
lea rcx, [rbp]
call fcn.140003390
xor ebx, ebx
cmp dword [rdi], 0
je 0x140003daa
mov ecx, 0x2808
mov qword [rdi + 0x18], 0x2800
mov dword [rdi + 0x20], ebx
call fcn.140058a4c
mov rcx, qword [rbp + 0x468]
mov qword [rax], 0x2800
lock add qword [rcx], 0x2800
add rax, 8
mov qword [rdi + 0x10], rax
mov byte [rax], 0
lea rax, [rbp]
mov qword [rdi + 0x28], rcx
inc r12
cmp byte [rax + r12], 0
jne 0x140003d91
mov r8, r12
lea rdx, [rbp]
mov rcx, rdi
call fcn.140024c90
mov rbx, qword [rsp + 0x548]
mov rax, rdi
add rsp, 0x500
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14005689c
int3
call fcn.14005689c
int3
call fcn.14005689c
int3
call fcn.14005689c
int3
call fcn.14005689c
int3
call fcn.14005689c
int3
call fcn.14005689c
int3