Function at 0x140095b60
Capabilities:
Copy file
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rbx, r8
mov r14, rdx
lea rdx, str.OperateFile::CopyFileWithDecompress
lea rcx, [rbp - 0x29]
call fcn.14001abe0
nop
lea r15, [0x1402a8360]
lea rsi, [0x1402bbdb0]
mov rcx, qword [0x1402a8360]
cmp rcx, r15
je 0x140095c29
test byte [rcx + 0x1c], 1
je 0x140095bec
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x52
lea r8, str.eXK3
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
mov rcx, qword [0x1402a8360]
cmp rcx, r15
je 0x140095c29
test byte [rcx + 0x1c], 1
je 0x140095c29
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x53
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
lea r8, str.eXK3
mov rcx, qword [rcx + 0x10]
call fcn.14002fbe0
xor edi, edi
mov qword [rbp - 0x41], rdi
mov dword [rbp - 0x35], edi
mov dword [rbp - 0x39], edi
mov dword [rbp - 0x49], edi
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x39]
lea r8, [rbp - 0x35]
lea rdx, [rbp - 0x41]
mov rcx, r14
call qword [sym.imp.SETUPAPI.dll_SetupGetFileCompressionInfoW]
test eax, eax
jne 0x140095dae
mov eax, dword [rbp - 0x49]
test eax, eax
jne 0x140095e90
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140095d57
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov r10, qword [0x1402a8360]
cmp r10, r15
je 0x140095ce2
test byte [r10 + 0x1c], 2
je 0x140095ce2
mov rbx, rsi
cmp qword [0x1402bbdc8], 8
cmovae rbx, qword [0x1402bbdb0]
lea rcx, [rbp - 0x29]
call fcn.14001b0b0
lea edx, [rdi + 0x54]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, str.eXK3
mov rcx, qword [0x1402a8360]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
mov r10, qword [0x1402a8360]
cmp r14d, 0x70
jne 0x140095d07
mov rcx, qword [0x1402bbf68]
mov rax, qword [rcx]
lea edx, [r14 + 0x34]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
mov r10, qword [0x1402a8360]
mov byte [rbp - 0x21], 1
cmp r10, r15
je 0x140095e01
test byte [r10 + 0x1c], 1
je 0x140095e01
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, MsiOpenDatabaseW
mov dword [rsp + 0x20], edi
lea r8, str.eXK3
mov rcx, qword [r10 + 0x10]
call fcn.140001b40
mov r10, qword [0x1402a8360]
jmp 0x140095e01
mov edx, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov r10, qword [0x1402a8360]
cmp r10, r15
je 0x140095db5
test byte [r10 + 0x1c], 4
je 0x140095db5
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x5a
mov qword [rsp + 0x28], rbx
mov rax, qword [rbp - 0x41]
mov qword [rsp + 0x20], rax
lea r8, str.eXK3
mov rcx, qword [r10 + 0x10]
call fcn.14002fbe0
mov r10, qword [0x1402a8360]
mov byte [rbp - 0x21], 1
cmp r10, r15
je 0x140095dfc
test byte [r10 + 0x1c], 1
je 0x140095dfc
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x5b
mov dword [rsp + 0x20], 1
lea r8, str.eXK3
mov rcx, qword [r10 + 0x10]
call fcn.140001b40
mov r10, qword [0x1402a8360]
mov edi, 1
lea rax, vtable.WppTrace.0
mov qword [rbp - 0x29], rax
cmp byte [rbp - 0x21], 0
jne 0x140095e59
cmp r10, r15
je 0x140095e59
test byte [r10 + 0x1c], 1
je 0x140095e59
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
cmp qword [0x1402bbdc8], 8
cmovae rsi, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], rcx
mov r9, rsi
lea r8, [0x140252818]
mov rcx, qword [r10 + 0x10]
call fcn.140006c90
lea rcx, [rbp + 7]
call fcn.1400048a0
lea rcx, [rbp - 0x19]
call fcn.1400048a0
mov eax, edi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1401e2900
mov rbx, qword [rsp + 0xe0]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
cmp eax, 1
jne 0x140095f8a
lea r8, [rbp - 0x49]
mov rdx, rbx
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.SETUPAPI.dll_SetupDecompressOrCopyFileW]
test eax, eax
je 0x140095d65
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov r10, qword [0x1402a8360]
cmp r10, r15
je 0x140095f15
test byte [r10 + 0x1c], 2
je 0x140095f15
mov rbx, rsi
cmp qword [0x1402bbdc8], 8
cmovae rbx, qword [0x1402bbdb0]
lea rcx, [rbp - 0x29]
call fcn.14001b0b0
mov edx, MsiOpenDatabaseW
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, str.eXK3
mov rcx, qword [0x1402a8360]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
mov r10, qword [0x1402a8360]
cmp r14d, 0x70
jne 0x140095f3a
mov rcx, qword [0x1402bbf68]
mov rax, qword [rcx]
lea edx, [r14 + 0x34]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
mov r10, qword [0x1402a8360]
mov byte [rbp - 0x21], 1
cmp r10, r15
je 0x140095e01
test byte [r10 + 0x1c], 1
je 0x140095e01
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, MsiOpenDatabaseW
mov dword [rsp + 0x20], edi
lea r8, str.eXK3
mov rcx, qword [r10 + 0x10]
call fcn.140001b40
mov r10, qword [0x1402a8360]
jmp 0x140095e01
cmp eax, 2
jne 0x140095d65
lea r8, [rbp - 0x49]
mov rdx, rbx
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.SETUPAPI.dll_SetupDecompressOrCopyFileW]
test eax, eax
je 0x140095d65
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov r10, qword [0x1402a8360]
cmp r10, r15
je 0x14009600f
test byte [r10 + 0x1c], 2
je 0x14009600f
mov rbx, rsi
cmp qword [0x1402bbdc8], 8
cmovae rbx, qword [0x1402bbdb0]
lea rcx, [rbp - 0x29]
call fcn.14001b0b0
mov edx, reloc.msi.dll_MsiOpenDatabaseW
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, str.eXK3
mov rcx, qword [0x1402a8360]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
mov r10, qword [0x1402a8360]
cmp r14d, 0x70
jne 0x140096034
mov rcx, qword [0x1402bbf68]
mov rax, qword [rcx]
lea edx, [r14 + 0x34]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
mov r10, qword [0x1402a8360]
mov byte [rbp - 0x21], 1
cmp r10, r15
je 0x140095e01
test byte [r10 + 0x1c], 1
je 0x140095e01
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x59
mov dword [rsp + 0x20], edi
lea r8, str.eXK3
mov rcx, qword [r10 + 0x10]
call fcn.140001b40
mov r10, qword [0x1402a8360]
jmp 0x140095e01