Function at 0x14000a130
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x3880
call fcn.140015af0
sub rsp, rax
mov eax, dword [0x14001cbf0]
mov edi, r9d
mov rbx, r8
test al, 1
mov rsi, rdx
jne 0x14000a178
and qword [0x14001cbe8], 0
or eax, 1
lea rcx, [0x140015b8c]
mov dword [0x14001cbf0], eax
call fcn.1400157c0
and word [rsp + 0x380], 0
lea rcx, [rsp + 0x382]
xor edx, edx
mov r8d, 0x1fe
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x581]
xor edx, edx
mov r8d, 0x10fe
mov byte [rsp + 0x580], 0
call sub.msvcrt.dll_memset
and word [rsp + 0x1680], 0
lea rcx, [rsp + 0x1682]
xor edx, edx
mov r8d, 0x21fc
call sub.msvcrt.dll_memset
lea rdx, str.nircmd.exe__s
lea rcx, [rsp + 0x580]
mov r8, rbx
call sub.msvcrt.dll_sprintf
lea rax, [rsp + 0x1680]
or ebx, 0xffffffff
lea r8, [rsp + 0x580]
mov r9d, ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x10fe
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x380]
mov r9d, ebx
mov r8, rsi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0xff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [0x14001cbc8]
test rax, rax
jne 0x14000a26a
lea rdx, str.NetRemoteTOD
lea rcx, [0x14001cbe8]
call fcn.140011b80
test rax, rax
mov qword [0x14001cbc8], rax
jne 0x14000a26a
or ebx, 0xffffffff
jmp 0x14000a27b
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x380]
call rax
mov ebx, eax
test ebx, ebx
jne 0x14000a3ef
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax + 8]
imul ecx, ecx, 0x3c
sub ecx, dword [rax + 0x18]
add ecx, dword [rax + 0xc]
mov eax, dword [rax + 0x10]
imul ecx, ecx, 0x3c
lea edx, [rcx + rax + 0x43]
mov eax, 0x15180
test edx, edx
jns 0x14000a2ab
add edx, eax
jmp 0x14000a2b1
cmp edx, eax
jl 0x14000a2b1
sub edx, eax
and dword [rsp + 0x48], 0
and dword [rsp + 0x30], 0
imul edx, edx, 0x3e8
test edi, edi
mov eax, edx
mov byte [rsp + 0x4c], 0
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x1680]
mov byte [rsp + 0x4d], 0
mov qword [rsp + 0x50], rax
je 0x14000a374
mov ebx, 0x104
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8, rbx
mov byte [rsp + 0x60], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x171]
xor edx, edx
mov r8d, 0x207
mov byte [rsp + 0x170], 0
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x60]
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x170]
mov rdx, rsi
call sub.msvcrt.dll_strcpy
lea rcx, [rsp + 0x170]
call fcn.1400025c4
lea rdx, str.admin__nircmd.exe
lea rcx, [rsp + 0x170]
call sub.msvcrt.dll_strcat
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x60]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rax, qword [0x14001cbc0]
test rax, rax
jne 0x14000a3a4
lea rdx, str.NetScheduleJobAdd
lea rcx, [0x14001cbe8]
call fcn.140011b80
test rax, rax
mov qword [0x14001cbc0], rax
jne 0x14000a3a4
or ebx, 0xffffffff
jmp 0x14000a3ba
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x380]
call rax
mov ebx, eax
mov rax, qword [0x14001cbd0]
mov rdi, qword [rsp + 0x38]
test rax, rax
jne 0x14000a3ea
lea rdx, str.NetApiBufferFree
lea rcx, [0x14001cbe8]
call fcn.140011b80
test rax, rax
mov qword [0x14001cbd0], rax
je 0x14000a3ef
mov rcx, rdi
call rax
lea r11, [rsp + 0x3880]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret