Function at 0x180009cf0
Capabilities:
Copy file
Get file attributes
Swap mouse buttons
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x1a0
cmp edx, 1
jne 0x180009f6e
mov dword [rsp + 0x48], 0x19c
lea rax, [0x180009230]
add rax, 0x19c
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180010080
mov dword [rsp + 0x48], 0x243
lea rax, [0x1800098e0]
add rax, 0x243
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.1800132c0
xor ecx, ecx
call fcn.18008864c
mov ecx, eax
call fcn.180085244
mov dword [rsp + 0x48], 0x116
lea rbx, [0x180009650]
lea rax, [rbx + 0x116]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0xc0]
movaps xmm0, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180013480
mov dword [rsp + 0x48], 0x272
lea rdx, [rsp + 0x50]
add rbx, 0x272
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180013480
mov dword [rsp + 0x48], 0x1bb
lea rax, [0x180009740]
add rax, 0x1bb
lea r9, [rsp + 0x130]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x50]
movaps xmm0, xmmword [rsp + 0x40]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180013640
mov dword [rsp + 0x48], 0x295
lea rax, [0x180004140]
add rax, 0x295
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180010080
cmp dword [0x180125cf0], 0xbce37a5b
jne 0x180009f58
xor ebx, ebx
lea r8, str.vqClMbqCSJh362rwN46736QYRZ35
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
lea rcx, str.32X2TGgYIMt68Br
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
mov qword [rsp + 0x30], rbx
lea rdx, str.47QSBvnsHY26lZFRmMk61zgb
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileMUIPath]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddResourceAttributeAce]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockFileEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSectionWhenCallbackReturns]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BuildCommDCBW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFirmwareType]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMemoryErrorHandlingCapabilities]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rbx, qword [rsp + 0x1c0]
mov eax, 1
add rsp, 0x1a0
pop rdi
ret
cmp edx, 2
je 0x180009f58
cmp edx, 3
jne 0x18000a040
cmp dword [0x180125cf0], 0x3f173759
jne 0x180009f58
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadProfiling]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsThreadpoolTimerSet]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepConditionVariableSRW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor ebx, ebx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTapePosition]
xor eax, eax
lock cmpxchg dword [rbx], ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SwapMouseButton]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadStringPtrW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetLastActivePopup]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
jmp 0x180009f58
test edx, edx
jne 0x180009f58
mov qword [rsp + 0x1b0], rsi
mov ecx, 0xffffb88c
mov qword [rsp + 0x1b8], r14
nop dword [rax]
mov r9d, ecx
mov eax, 0x55555556
inc ecx
imul ecx
mov r10d, ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x18000a060
mov r11d, 0xffff1a80
mov eax, 0x55555556
sub r11d, ecx
mov r8d, 0xa7
add ecx, 0x2eac
sub r8d, r11d
imul ecx
sub r8d, r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
je 0x18000a0c7
nop dword [rax]
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x18000a0b0
lea eax, [r10*2 + 0x125e4]
lea edx, [r8 + r8*2]
sub edx, eax
add edx, ecx
lea ebx, [r8 + rdx]
lea eax, [r11 + rbx]
lea r9d, [rax*2 + 0x32fe]
mov eax, r9d
lea r8d, [rdx + 0x105e]
and eax, 0x80000003
jge 0x18000a0ff
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x18000a112
test r9d, r9d
jle 0x18000a112
lea r9d, [r9*2 - 0xb5b1]
jmp 0x18000a11a
lea r9d, [r9*2 - 0x2061]
test r8b, 1
je 0x18000a129
inc r8d
test r8b, 1
jne 0x18000a120
mov ecx, 0x1c0f
mov eax, 0x55555556
sub ecx, r11d
shl ecx, 2
imul ecx
lea r10d, [rcx + 0xa0d]
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
lea eax, [rbx + 0x14b3]
lea ebx, [rax + rax*2]
mov eax, 0x55555556
cmove r10d, ecx
add ebx, ebx
imul r10d
sub ebx, r8d
mov r11d, r10d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r10d, ecx
je 0x18000a186
test r10d, r10d
jle 0x18000a186
lea r11d, [r10 - 0x544]
mov r8d, 0x2efd
nop dword [rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x18000a190
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
je 0x18000a1cd
lea edi, [r9 + 0x41b4]
test r9d, r9d
jg 0x18000a1d4
lea edi, [r9 + 0x54e]
lea r9d, [rbx - 0x910f]
add r11d, r8d
sub r8d, 0xf92
lea r10d, [r9 + 0x3e4]
mov ebx, r9d
mov eax, 0x55555556
imul r9d
lea esi, [rdi + rbx]
mov edi, r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x55555556
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
cmove r10d, r9d
mov r9d, 0x1f63
imul r8d
sub r9d, r10d
mov eax, edx
add esi, r9d
shr eax, 0x1f
sub r10d, esi
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
je 0x18000a240
test r8d, r8d
jle 0x18000a240
lea edi, [r8 - 0x38a]
lea eax, [r9 + 0x21c0]
add r10d, r10d
test al, 1
je 0x18000a256
nop
inc eax
test al, 1
jne 0x18000a250
lea r14d, [rax + rax]
sub esi, r10d
mov eax, 0x55555556
sub r14d, esi
imul esi
mov ebx, esi
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp esi, ecx
je 0x18000a297
nop word [rax + rax]
inc ebx
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp ebx, ecx
jne 0x18000a280
mov r9d, ebx
mov eax, 0x55555556
sub r9d, esi
add ebx, 0xbd3
mov rsi, qword [rsp + 0x1b0]
mov r10d, ebx
mov ecx, 0x1881
lea r8d, [r9 - 0x3ae]
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, 0x3ae
cmp r8d, eax
mov eax, 0xfffff83b
cmove ecx, edx
neg r10d
add r10d, r10d
sub r10d, ecx
lea ecx, [r11 + 0x141e]
add ecx, r14d
add r10d, r9d
mov r14, qword [rsp + 0x1b8]
add ecx, ebx
sub eax, ecx
mov r9d, 0x21e0
add r10d, eax
sub r9d, edi
sub ebx, r9d
add ecx, 0x1d69
sub r9d, 0x231c
sub ebx, edi
add ebx, r10d
mov eax, 0x55555556
imul r9d
lea r8d, [rbx + rdi]
mov r11d, 0x245
add r8d, ecx
mov eax, edx
shr eax, 0x1f
mov ecx, 0xfffffdbb
add edx, eax
lea eax, [rdx + rdx*2]
cmp r9d, eax
lea eax, [r8 + r8]
cmove r11d, ecx
sub r11d, r8d
lea r8d, [rbx + r10*2]
add r11d, 0x231
add r8d, eax
add r11d, r9d
test r11b, 1
je 0x18000a374
test r11d, r11d
jle 0x18000a374
add r11d, 0xc7b
sub r11d, eax
mov eax, 0x55555556
imul r11d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r11d, ecx
je 0x18000a3aa
nop
inc r11d
mov eax, 0x55555556
imul r11d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r11d, ecx
jne 0x18000a390
lea eax, [r11 + r11]
cmp eax, 0xfff4baf0
jne 0x18000a3cc
lea eax, [r8 + rdi]
cmp eax, 0x5d4d6a
jne 0x18000a3cc
cmp edi, 0x1be2
je 0x180009f58
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]