Function at 0x140003560
Capabilities:
Copy file
Delete file
Get common file path
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov r15d, edx
mov rdi, rcx
test edx, edx
je 0x1400036cb
xor edx, edx
lea rcx, [rbp + 0x180]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov r13, 0xffffffffffffffff
call fcn.1400081c0
mov r14, qword [0x140021b98]
mov rbx, rax
test r14, r14
jne 0x1400035f8
mov rcx, qword [rax + 0x30]
lea edx, [r13 + 2]
call fcn.1400051b0
mov r14, rax
mov qword [0x140021b98], rax
cmp qword [0x140021b88], 0
jne 0x140003631
mov rcx, qword [rbx + 0x50]
call fcn.140002a20
test rax, rax
je 0x140003878
xor edx, edx
mov rcx, rax
call fcn.1400051b0
mov rdx, qword [r14 + 0x20]
mov rcx, rax
mov qword [0x140021b88], rax
call fcn.140004d00
mov rdx, qword [rdi + 0x18]
xor esi, esi
mov ecx, esi
lea rax, [rdx + 0x10]
movups xmm1, xmmword [rdx]
movsd xmm0, qword [rdx + 0x10]
movups xmmword [rsp + 0x30], xmm1
movsd qword [rsp + 0x50], xmm0
cmp qword [rax], rcx
je 0x140003660
inc ecx
lea rax, [rax + 0x18]
cmp qword [rax], rsi
jne 0x140003655
movsxd rax, ecx
psrldq xmm1, 8
movq rbx, xmm1
lea rcx, [rax + rax*2]
movups xmm2, xmmword [rdx + rcx*8 - 0x18]
movsd xmm0, qword [rdx + rcx*8 - 8]
mov ecx, r15d
movsd qword [rsp + 0x50], xmm0
mov rdi, qword [rsp + 0x50]
sub rdi, rbx
psrldq xmm2, 8
movq rax, xmm2
add rdi, rax
sub ecx, 1
je 0x1400037a8
sub ecx, 1
je 0x14000379e
sub ecx, 1
je 0x14000379e
sub ecx, 1
je 0x140003712
cmp ecx, 1
je 0x1400036f8
lea rcx, str.Unhook_method_does_not_exist__exiting..._n
call fcn.140001010
xor eax, eax
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.140009ae0
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
call fcn.1400068f0
mov rsi, rax
test rax, rax
jne 0x1400037c8
lea rcx, str.Something_wrong_happened_with_CreateSyscallStubWithVirtuallAlloc__aborting..._n
jmp 0x1400036c6
mov edx, 0x104
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, str.ntdll.dll
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x180]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rdx, [rsp + 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, str.._ntdlol.txt
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
mov edx, 1
mov r13, rax
call fcn.1400051b0
mov r14, rax
mov rcx, rax
jmp 0x1400037ab
mov ecx, r15d
call fcn.140003890
jmp 0x1400037c5
mov rcx, r14
lea rdx, str.NtProtectVirtualMemory
call fcn.140005380
test eax, eax
je 0x1400037c8
mov edx, eax
mov rcx, r14
call fcn.140004c70
mov rsi, rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rbx
mov r9d, 0x40
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x68]
mov qword [rsp + 0x68], rdi
lea rdx, [rsp + 0x58]
mov rcx, 0xffffffffffffffff
call rsi
test eax, eax
js 0x1400036cb
test rdi, rdi
je 0x140003820
mov rdx, qword [rsp + 0x30]
sub rdx, rbx
nop word [rax + rax]
movzx eax, byte [rbx + rdx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x140003810
mov r9d, dword [rsp + 0x60]
lea rax, [rsp + 0x60]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
mov rcx, 0xffffffffffffffff
call rsi
test eax, eax
js 0x1400036cb
cmp r15d, 4
jne 0x14000386e
lea rax, [r13 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140003863
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
jmp 0x1400036cd
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3