Function at 0x448a60
Capabilities:
Copy file
Move file

Disassembly:
push r15
mov eax, 0x4228
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0067cdd0
sub rsp, rax
lea rdx, [0x008ddad0]
lea rax, [rsp + 0x220]
mov rdi, rcx
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.005874a0
mov rax, qword [0x00828ce0]
cmp dword [rdi + 8], 0
mov r15, qword [rsp + 0x220]
mov dword [rax], 1
jle 0x449195
lea rsi, [0x008ddad0]
xor ebx, ebx
lea rbp, [rsp + 0x2220]
lea r12, [r15 + 8]
jmp 0x448ada
mov eax, dword [rdi + 8]
add ebx, 1
cmp eax, ebx
jle 0x448b1d
mov edx, ebx
mov rcx, rsi
call fcn.00578bd0
test eax, eax
je 0x448ad0
mov r8d, ebx
mov rdx, r12
mov rcx, rbp
call fcn.0050e220
mov rcx, qword [rsp + 0x2220]
lea rdx, str.indexesSDI
call sub.SHELL32.dll_StrStrIA
mov r13, rax
mov rcx, rbp
call fcn.0050d1b0
test r13, r13
je 0x448ad0
mov eax, dword [rdi + 8]
cmp eax, ebx
je 0x448bd8
xor r8d, r8d
mov qword [rsp + 0x2228], 0
lea rcx, [rsp + 0x2220]
mov word [rsp + 0x2242], r8w
mov r8, qword [0x00826960]
lea rax, [rcx + 0x22]
mov byte [rsp + 0x2240], 0
mov qword [rsp + 0x2230], rax
lea rdx, str._c_del__ws_.bin
lea rax, [0x00840bc0]
mov qword [rsp + 0x2238], 0x80
add r8, 0xc000
mov qword [rsp + 0x2220], rax
call fcn.00403810
mov r8, qword [rsp + 0x2230]
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov rcx, qword [0x00826970]
lea rdx, [0x0080e36c]
call fcn.0043f4d0
mov rcx, qword [rsp + 0x2228]
lea rax, [0x008407e0]
mov qword [rsp + 0x2220], rax
test rcx, rcx
je 0x448bd5
call fcn.007da030
mov ebx, dword [rdi + 8]
test ebx, ebx
jle 0x448cdb
lea rax, [rsp + 0x50]
xor ebx, ebx
lea r12, [rsp + 0x2220]
mov qword [rsp + 0x40], rax
lea rax, [r12 + 0x10]
lea r13, [rsp + 0x60]
mov qword [rsp + 0x48], rax
jmp 0x448c11
add ebx, 1
cmp dword [rdi + 8], ebx
jle 0x448cdb
lea rcx, [0x008ddad0]
mov edx, ebx
call fcn.00578bd0
test eax, eax
je 0x448c05
lea r14, [rsp + 0x70]
mov r8d, ebx
lea rdx, [r15 + 8]
mov rcx, r14
call fcn.0050e220
mov rbp, qword [rsp + 0x70]
mov qword [rsp + 0x50], r13
mov rsi, qword [rsp + 0x78]
mov rax, rbp
add rax, rsi
je 0x448c60
test rbp, rbp
jne 0x448c60
lea rcx, [0x0080e1a0]
call fcn.007cd620
nop
cmp rsi, 0xf
mov qword [rsp + 0xf0], rsi
ja 0x448d30
cmp rsi, 1
je 0x448dc0
test rsi, rsi
mov rax, r13
jne 0x44916d
mov qword [rsp + 0x58], rsi
mov byte [rax + rsi], 0
cmp dword [0x007e88a4], 1
je 0x448d80
mov rcx, qword [rsp + 0x50]
lea rdx, [0x0080e3a0]
call sub.SHELL32.dll_StrStrIA
test rax, rax
je 0x448dd0
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x448cc7
call fcn.007da050
mov rcx, r14
add ebx, 1
call fcn.0050d1b0
cmp dword [rdi + 8], ebx
jg 0x448c11
mov rcx, qword [0x00826970]
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea r8, str.__c_rd__s__q_update
lea rdx, [0x0080e36c]
call fcn.0043f4d0
test r15, r15
je 0x448d18
mov eax, 0xffffffff
lock xadd dword [r15], eax
cmp eax, 1
je 0x449158
add rsp, 0x4228
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0xf0]
xor r8d, r8d
call fcn.0079cf60
mov rcx, rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x60], rax
mov r8, rsi
mov rdx, rbp
call sub.msvcrt.dll_memcpy
mov rsi, qword [rsp + 0xf0]
mov rax, qword [rsp + 0x50]
jmp 0x448c88
mov rcx, qword [rsp + 0x70]
mov edx, 0x5c
call sub.msvcrt.dll_strchr
lea rsi, [rax + 1]
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov r8, qword [rsp + 0x58]
mov r9, rsi
xor edx, edx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.0079b070
jmp 0x448c9e
movzx eax, byte [rbp]
mov byte [rsp + 0x60], al
mov rax, r13
jmp 0x448c88
mov rcx, qword [rsp + 0x50]
lea rdx, str..bat
call sub.SHELL32.dll_StrStrIA
test rax, rax
jne 0x448cb8
mov rax, qword [rdi + 0x20]
lea rdx, str._s_S
mov r9, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
mov r8, qword [rax]
call qword [sym.imp.USER32.dll_wsprintfW]
mov r8, qword [rsp + 0x50]
lea rdx, [0x0080e1da]
mov rcx, r12
call qword [sym.imp.USER32.dll_wsprintfW]
mov rax, qword [0x00826960]
lea rdx, [0x0080e28e]
mov rcx, r12
lea r8, [rax + 0xc000]
call fcn.00403ce0
mov rax, qword [0x00826960]
lea rdx, str.drivers
mov rcx, r12
lea r8, [rax + 0x6000]
call fcn.00403ce0
mov rax, qword [0x00826960]
lea rdx, str.toolsSDI
mov rcx, r12
lea r8, [rax + 0xe000]
call fcn.00403ce0
mov rcx, qword [rsp + 0x50]
lea rdx, [0x0080e205]
call sub.SHELL32.dll_StrStrIA
test rax, rax
je 0x448e97
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call fcn.00444fa0
mov rsi, r12
jmp 0x448eb1
mov rcx, rsi
mov edx, 0x5c
call sub.msvcrt.dll_wcschr
lea rsi, [rax + 2]
mov edx, 0x5c
mov rcx, rsi
call sub.msvcrt.dll_wcschr
test rax, rax
jne 0x448ea0
mov rcx, qword [rsp + 0x30]
lea rdx, [0x0080e3d6]
call sub.SHELL32.dll_StrStrIW
test rax, rax
je 0x448ee1
mov ecx, 0x5f
mov word [rsi], cx
lea rcx, [rsp + 0xf0]
xor edx, edx
mov qword [rsp + 0xf8], 0
lea rax, [rcx + 0x22]
mov word [rsp + 0x112], dx
mov rdx, r12
mov qword [rsp + 0x100], rax
lea rax, [0x00840bc0]
mov qword [rsp + 0x108], pe_nt_image_headers64
mov byte [rsp + 0x110], 0
mov qword [rsp + 0xf0], rax
call fcn.00403b60
mov rsi, qword [rsp + 0x100]
jmp 0x448f51
mov rcx, rsi
mov edx, 0x5c
call sub.msvcrt.dll_wcschr
lea rsi, [rax + 2]
mov edx, 0x5c
mov rcx, rsi
call sub.msvcrt.dll_wcschr
test rax, rax
jne 0x448f40
cmp word [rsi - 2], 0x5c
je 0x449140
mov rcx, qword [rsp + 0xf8]
lea rax, [0x008407e0]
mov qword [rsp + 0xf0], rax
test rcx, rcx
je 0x448f8f
call fcn.007da030
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__wgetcwd]
test rax, rax
je 0x449120
mov rcx, qword [0x00826970]
mov rdx, rax
call fcn.0043f0f0
mov dword [rsp + 0x3c], eax
mov rbp, qword [rsp + 0x30]
mov rcx, qword [0x00826970]
mov rdx, rbp
call fcn.0043f0f0
mov rcx, qword [0x00826910]
mov esi, eax
cmp eax, 0xffffffff
mov r9, rbp
cmove esi, dword [rsp + 0x3c]
lea rdx, str.Src:__d__S_n
mov r8d, esi
call fcn.0041e020
mov rcx, qword [0x00826970]
mov rdx, r12
call fcn.0043f0f0
lea rdx, [0x0080e40c]
mov ebp, eax
mov rcx, r12
call sub.msvcrt.dll_wcscspn
cmp ebp, 0xffffffff
jne 0x44901c
test rax, rax
cmovne ebp, dword [rsp + 0x3c]
mov rcx, qword [0x00826910]
mov r9, r12
mov r8d, ebp
lea rdx, str.Dst:__d__S_n
call fcn.0041e020
cmp esi, ebp
mov r8, r12
je 0x4490d0
mov rcx, qword [0x00826910]
lea rdx, str.Copy_new_file:__S_n
call fcn.0041e020
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
jne 0x4490a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x00826910]
lea r8, str.CopyFileExW__
mov edx, eax
call fcn.0041e530
jmp 0x448cb8
mov rcx, qword [0x00826970]
mov rdx, r12
call fcn.0043e750
test al, al
je 0x448cb8
mov rdx, qword [rsp + 0x30]
mov rcx, qword [0x00826970]
call fcn.0043f4b0
jmp 0x448cb8
mov rcx, qword [0x00826910]
lea rdx, str.Move_new_file:__S_n
call fcn.0041e020
mov r8d, 1
mov rdx, r12
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x448cb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x00826910]
lea r8, str.MoveFileEx__
mov edx, eax
call fcn.0041e530
jmp 0x448cb8
mov rcx, qword [0x00826910]
lea rdx, str._wgetcwd_error
call fcn.0041e020
mov dword [rsp + 0x3c], 0xffffffff
jmp 0x448fb8
mov rcx, qword [rsp + 0x100]
xor eax, eax
mov word [rsi - 2], ax
call fcn.0043f300
jmp 0x448f6e
mov rcx, r15
call fcn.00589e20
mov rcx, r15
call fcn.007da050
jmp 0x448d18
mov rcx, r13
jmp 0x448d5a
jne 0x448b25
jmp 0x448cdb