Function at 0x1800015a0
Capabilities:
Copy file
Delete file

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x270
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x270], rbx
mov qword [rbp + 0x278], rsi
mov qword [rbp + 0x280], rdi
mov rax, qword [0x18008ab58]
xor rax, rbp
mov qword [rbp + 0x230], rax
xor r13d, r13d
lea rcx, [0x18008b6d0]
mov r15d, r13d
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
cmp dword [0x18008b4c4], r13d
jne 0x180001711
xor r9d, r9d
lea edx, [r13 + 0xa]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoW]
nop dword [rax + rax]
mov r15d, eax
test eax, eax
js 0x180001914
lea edx, [r13 + 0x1c]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x18000bb50
lea r8, str.PIPE_
mov rcx, rax
lea edx, [r13 + 0xe]
call qword [sym.imp.msvcrt.dll_wcscpy_s]
nop dword [rax + rax]
lea r8, str.scerpc
mov rcx, rbx
lea edx, [r13 + 0xe]
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
xor r9d, r9d
lea edx, [r13 + 0xa]
mov r8, rbx
lea rcx, str.ncacn_np
call qword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x18000bb5a
mov qword [rsp + 0x28], r13
lea rcx, section..rdata
mov r9d, 0x21
mov dword [rsp + 0x20], 0x4d2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
nop dword [rax + rax]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov ecx, edi
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
nop dword [rax + rax]
mov ebx, eax
mov ecx, ebx
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
nop dword [rax + rax]
mov r15d, eax
test ebx, ebx
jne 0x180001709
mov dword [0x18008b4c4], 1
test eax, eax
js 0x180001914
cmp qword [0x18008b2d8], 0x26c
jb 0x18000bb6a
mov rcx, qword [0x18008b2e8]
add rcx, 0x274
cmp rcx, 0x26c
jb 0x18000bb6a
call fcn.1800019b0
test eax, eax
je 0x18000bb6a
mov eax, dword [rsp]
mov eax, 0x280
sub rsp, rax
lea rsi, [rsp + 0x30]
mov eax, dword [rsi]
test rsi, rsi
je 0x18000bb6a
mov dword [rsi], 0x6b637453
add rsi, 8
je 0x18000bb6a
cmp qword [0x18008b2d8], 0x438
jb 0x18000bb97
mov rcx, qword [0x18008b2e8]
add rcx, 0x440
cmp rcx, 0x438
jb 0x18000bb97
call fcn.1800019b0
test eax, eax
je 0x18000bb97
mov eax, dword [rsp]
mov eax, 0x440
sub rsp, rax
lea r14, [rsp + 0x30]
mov eax, dword [r14]
test r14, r14
je 0x18000bb97
mov dword [r14], 0x6b637453
add r14, 8
je 0x18000bb97
test rsi, rsi
je 0x18000bc3c
test r14, r14
je 0x18000bc3c
mov edx, 0x104
mov word [rsi], r13w
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemWindowsDirectoryW]
nop dword [rax + rax]
mov word [rsi + 0x206], r13w
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rsi + rbx*2], r13w
jne 0x180001814
mov r8, rsi
mov edx, 0x21c
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscpy_s]
nop dword [rax + rax]
mov edi, 0x136
lea r8, str._securitylogs_scecomp.log
mov edx, edi
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
lea r8, str._securitylogs_scecomp.old
mov edx, 0x21c
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l2_1_2.dll_CopyFileW]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
mov eax, ebx
lea r8, str._security_sce.tmp
sub edi, ebx
mov edx, edi
lea r12, [rax + rax]
lea rcx, [r12 + rsi]
call qword [sym.imp.msvcrt.dll_wcscpy_s]
nop dword [rax + rax]
lea rdx, [rbp]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wfindfirst64]
nop dword [rax + rax]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18000bbc4
mov dword [0x18008b4b8], r13d
mov dword [0x18008b4c8], r13d
mov dword [0x18008b4c0], r13d
test rsi, rsi
je 0x1800018fd
cmp dword [rsi - 8], 0x70616548
lea rcx, [rsi - 8]
je 0x18000bc47
test r14, r14
je 0x180001914
cmp dword [r14 - 8], 0x70616548
lea rcx, [r14 - 8]
je 0x18000bc5a
mov qword [0x18008b4b0], r13
mov qword [0x18008b4a0], r13
mov qword [0x18008b4a8], r13
test r15d, r15d
js 0x180001936
call fcn.180001e50
mov r15d, eax
lea rcx, [0x18008b6d0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
test r15d, r15d
js 0x18000199d
xor edx, edx
lea rcx, [0x180002000]
lea r8d, [rdx + 0x18]
call qword [sym.imp.ntdll.dll_RtlQueueWorkItem]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x230]
xor rcx, rbp
call fcn.180002a90
mov rbx, qword [rbp + 0x270]
mov rsi, qword [rbp + 0x278]
mov rdi, qword [rbp + 0x280]
lea rsp, [rbp + 0x240]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, r15d
jmp 0x180001967
mov ebx, 0xc0000017
jmp 0x1800016ea
cmp eax, 0x6cc
jne 0x1800016cb
jmp 0x18000169e
mov rax, qword [0x18008b2e0]
mov ecx, 0x274
call qword [0x180071c20]
mov rsi, rax
test rax, rax
je 0x180001775
mov dword [rax], 0x70616548
add rsi, 8
jmp 0x180001775
mov rax, qword [0x18008b2e0]
mov ecx, 0x440
call qword [0x180071c20]
mov r14, rax
test rax, rax
je 0x1800017db
mov dword [rax], 0x70616548
add r14, 8
jmp 0x1800017db
mov ecx, 0x21c
sub ecx, ebx
mov ebx, ecx
add r12, r14
lea r8, str._security_
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcscpy_s]
nop dword [rax + rax]
lea r8, [rbp + 0x28]
mov edx, 0x21c
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
lea rdx, [rbp]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wfindnext64]
nop dword [rax + rax]
test eax, eax
je 0x18000bbd0
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__findclose]
nop dword [rax + rax]
nop
jmp 0x1800018d2
mov r15d, 0xc0000017
jmp 0x1800018e7
mov rax, qword [0x18008b2f0]
call qword [0x180071c20]
nop
jmp 0x1800018fd
mov rax, qword [0x18008b2f0]
call qword [0x180071c20]
nop
jmp 0x180001914