Function at 0x140030570
Capabilities:
Copy file
Create directory
Get common file path

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x4e8]
sub rsp, 0x5d0
cmp byte [rcx + 0x864], 0
mov rdi, rdx
mov r14, rcx
je 0x140030a1b
mov qword [rax - 0x20], rbx
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x3b0]
mov qword [rax - 0x28], rsi
call fcn.1400312a0
movups xmm0, xmmword [rdi + 0x14]
lea rdx, [rsp + 0x30]
movsd xmm1, qword [rdi + 0x24]
lea rcx, [rsp + 0x50]
movaps xmmword [rsp + 0x50], xmm0
movsd qword [rsp + 0x60], xmm1
call fcn.14001b280
mov esi, 0xea60
mov dword [rbp + 0x500], 4
xor ebx, ebx
mov dword [rbp + 0x508], esi
lea r8, [rbp + 0x4f0]
mov dword [rbp + 0x4f0], ebx
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.140031170
test al, al
je 0x14003065e
mov eax, dword [rbp + 0x4f0]
lea r8, str.KMD_ACR_PnpStartDelay
imul rdx, rax, 0x10c
lea rax, [rbp + 0x500]
xor r9d, r9d
mov qword [rsp + 0x28], rax
add rdx, 0xc
lea rax, [rbp + 0x508]
add rdx, r14
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.140035380
cmp eax, 1
jne 0x14003065e
cmp dword [rbp + 0x500], ebx
jbe 0x14003065e
mov esi, dword [rbp + 0x508]
test byte [rdi + 4], 0x10
jne 0x140030685
mov edx, esi
lea rcx, [rsp + 0x30]
call fcn.14001aff0
mov rcx, qword [0x1400b80d8]
xor edx, edx
call fcn.14000dff0
call fcn.1400335c0
jmp 0x140030699
call fcn.14002b940
mov edx, esi
mov rcx, rdi
call fcn.14000c8b0
call fcn.14002b480
lea r8, [rbp + 0x4f0]
mov dword [rbp + 0x508], ebx
lea rdx, [rsp + 0x30]
mov dword [rbp + 0x500], 4
mov rcx, r14
mov dword [rbp + 0x4f0], ebx
call fcn.140031170
mov rsi, qword [rsp + 0x5c0]
test al, al
je 0x140030724
mov eax, dword [rbp + 0x4f0]
lea r8, str.KMD_ACR_RecoveryResult
imul rdx, rax, 0x10c
lea rax, [rbp + 0x500]
xor r9d, r9d
mov qword [rsp + 0x28], rax
add rdx, 0xc
lea rax, [rbp + 0x508]
add rdx, r14
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call fcn.140035380
cmp eax, 1
jne 0x140030724
mov edi, dword [rbp + 0x508]
cmp dword [rbp + 0x500], ebx
ja 0x140030726
mov edi, ebx
xor edx, edx
lea rcx, [rbp + 0x190]
mov r8d, 0x104
call fcn.14003aa80
xor edx, edx
lea rcx, [rbp + 0x80]
mov r8d, 0x104
call fcn.14003aa80
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x104
call fcn.14003aa80
xor edx, edx
lea rcx, [rbp + 0x2a0]
mov r8d, 0x104
call fcn.14003aa80
mov edx, 0x104
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop word [rax + rax]
movzx eax, byte [rbp + rbx + 0x2a0]
mov byte [rbp + rbx + 0x190], al
lea rbx, [rbx + 1]
test al, al
jne 0x140030790
lea r8, [rbp + 0x4f0]
mov rcx, r14
lea rdx, [rbp + 0x80]
call fcn.1400312a0
cmp dword [rbp + 0x4f0], 0
mov rbx, qword [rsp + 0x5c8]
jne 0x1400307db
cmp dword [rbp + 0x4f4], 0
je 0x14003099f
lea rax, [rbp + 0x3b0]
lea r8, [rbp + 0x80]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140030803
inc rax
test ecx, ecx
jne 0x1400307f0
test edx, edx
je 0x14003099f
lea rcx, [rsp + 0x70]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140030813
lea r8, [rbp + 0x2a0]
xor edx, edx
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140030830
lea rax, [rsp + 0x70]
dec rax
nop dword [rax + rax]
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x140030850
movups xmm0, xmmword [str.System32AMDACRDumps_]
lea rcx, [rsp + 0x70]
xor edx, edx
movsd xmm1, qword [0x140096eb8]
movups xmmword [rax], xmm0
movsd qword [rax + 0x10], xmm1
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1400308ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400308ab
mov rcx, qword [0x1400b80b8]
test rcx, rcx
je 0x14003099f
lea r8, str.CreateDirectory_failed_0x_x.
jmp 0x140030992
lea rcx, [rsp + 0x70]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400308b3
lea r8, [rbp + 0x80]
xor edx, edx
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400308d0
lea rcx, [rbp + 0x190]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400308f0
mov eax, dword [0x140096e98]
movups xmm0, xmmword [str.LiveKernelReportsWatchdog_]
movsd xmm1, qword [0x140096e90]
movups xmmword [rcx], xmm0
movsd qword [rcx + 0x10], xmm1
mov dword [rcx + 0x18], eax
movzx eax, byte [0x140096e9c]
mov byte [rcx + 0x1c], al
lea rcx, [rbp + 0x190]
dec rcx
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140030930
lea r8, [rbp + 0x80]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140030950
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x14003099f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400b80b8]
test rcx, rcx
je 0x14003099f
lea r8, str.CopyFile_failed_0x_x.
mov r9d, eax
mov edx, 0x40000000
call fcn.140032710
mov edx, edi
mov rcx, r14
call fcn.140031d20
test al, al
jne 0x140030a1b
sub edi, 1
je 0x140030a11
sub edi, 1
je 0x1400309fb
cmp edi, 1
je 0x1400309e5
mov rcx, qword [0x1400b80b8]
test rcx, rcx
je 0x140030a1b
lea r8, str.There_is_no_result_from_Registry
mov edx, 0x40000000
call fcn.140032710
add rsp, 0x5d0
pop r14
pop rdi
pop rbp
ret
mov ecx, 0xa1
call fcn.140030040
add rsp, 0x5d0
pop r14
pop rdi
pop rbp
ret
mov ecx, 0xa0
call fcn.140030040
add rsp, 0x5d0
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x9f
call fcn.140030040
add rsp, 0x5d0
pop r14
pop rdi
pop rbp
ret