Function at 0x14000d3e0
Capabilities:
Copy file
Delete file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5b8]
sub rsp, 0x6b8
mov rax, qword [0x14009b940]
xor rax, rsp
mov qword [rbp + 0x5a0], rax
xor ebx, ebx
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], rbx
mov r15d, ebx
mov r13, r8
mov qword [rsp + 0x60], rdx
mov r14, rdx
mov r12, rcx
mov rcx, qword [0x14009b028]
lea rsi, [0x14009b028]
cmp rcx, rsi
je 0x14000d45c
test byte [rcx + 0x1c], 4
je 0x14000d45c
cmp byte [rcx + 0x19], 5
jb 0x14000d45c
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x7d]
lea r8, [0x1400885f0]
call fcn.140001024
cmp dword [rbp + 0x620], ebx
jne 0x14000d46e
mov eax, 0x57
jmp 0x14000d69b
mov dword [rsp + 0x28], ebx
mov edx, 0x80000000
mov r8d, 1
mov dword [rsp + 0x20], 3
mov rcx, r12
call fcn.140069cbc
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x14000d4eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14000d699
test byte [rcx + 0x1c], 4
je 0x14000d699
cmp byte [rcx + 0x19], 2
jb 0x14000d699
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400885f0]
mov edx, 0x7e
mov dword [rsp + 0x20], eax
mov r9, r12
call fcn.140001328
jmp 0x14000d699
lea r9, [rbp + 0x390]
xor r8d, r8d
call fcn.14000a2f8
mov ebx, eax
test eax, eax
je 0x14000d5d9
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14000d534
test byte [rcx + 0x1c], 4
je 0x14000d534
cmp byte [rcx + 0x19], 2
jb 0x14000d534
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400885f0]
mov edx, 0x7f
mov r9d, eax
call fcn.140001050
mov r13, qword [rsp + 0x48]
lea r12, [0x14009b028]
mov ecx, r15d
test ebx, ebx
je 0x14000d677
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x14000d67c
mov r14, qword [rsp + 0x58]
mov rsi, rdi
sub rsi, r14
lea edi, [r15 - 1]
cmp r15d, dword [rbp + 0x620]
cmovne edi, ecx
inc edi
mov r8, qword [r14 + rsi]
test r8, r8
je 0x14000db85
mov rdx, qword [r14]
lea r9, [rbp + 0x180]
call fcn.140008c50
test eax, eax
je 0x14000dacf
mov rcx, qword [0x14009b028]
cmp rcx, r12
je 0x14000db85
test byte [rcx + 0x1c], 4
je 0x14000db85
cmp byte [rcx + 0x19], 3
jb 0x14000db85
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400885f0]
mov edx, 0x8b
mov r9d, eax
call fcn.140001050
jmp 0x14000db85
mov ecx, dword [rbp + 0x620]
mov eax, 8
mul rcx
mov rdi, rax
test rdx, rdx
je 0x14000d62c
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14000d622
test byte [rcx + 0x1c], 4
je 0x14000d622
cmp byte [rcx + 0x19], 2
jb 0x14000d622
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400885f0]
mov edx, 0x80
mov r9d, 0x80070216
call fcn.140001050
mov ebx, 0x216
jmp 0x14000d534
mov rcx, rdi
call fcn.140067108
mov qword [rsp + 0x50], rax
mov rbx, rax
test rax, rax
jne 0x14000d6bf
lea ebx, [rax + 8]
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14000d672
test byte [rcx + 0x1c], 4
je 0x14000d672
cmp byte [rcx + 0x19], 2
jb 0x14000d672
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x79]
mov r9d, edi
lea r8, [0x1400885f0]
call fcn.140001050
mov r13, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
cmp r13, 0xffffffffffffffff
je 0x14000d691
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, rdi
call fcn.1400671c4
mov eax, ebx
mov rcx, qword [rbp + 0x5a0]
xor rcx, rsp
call fcn.14007ec50
add rsp, 0x6b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r8, rdi
xor edx, edx
mov rcx, rbx
call sub.msvcrt.dll_memset
mov rcx, qword [r13]
call fcn.140067e3c
xor ecx, ecx
mov rsi, rax
test rax, rax
jne 0x14000d726
lea ebx, [rax + 8]
mov rcx, qword [0x14009b028]
lea r12, [0x14009b028]
cmp rcx, r12
je 0x14000d718
test byte [rcx + 0x1c], 4
je 0x14000d718
cmp byte [rcx + 0x19], 2
jb 0x14000d718
mov r9, qword [r13]
lea edx, [rbx + 0x7a]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400885f0]
call fcn.1400011fc
mov r13, qword [rsp + 0x48]
xor eax, eax
mov ecx, eax
jmp 0x14000d54b
mov dword [rsp + 0x40], ecx
cmp dword [rbp + 0x620], ecx
jbe 0x14000d843
mov r14, qword [rsp + 0x58]
mov r15, rbx
sub r15, r14
mov edx, 0x3b
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x14000d762
mov word [rax], bx
call fcn.1400506f4
mov qword [r15 + r14], rax
test rax, rax
je 0x14000d9b0
mov rdx, qword [r14]
lea r9, [rbp + 0x180]
mov r8, rax
call fcn.140008c50
mov ebx, eax
test eax, eax
jne 0x14000d98a
lea rax, [rbp + 0x180]
mov edx, 0x104
lea r9, [rbp + 0x390]
mov qword [rsp + 0x20], rax
lea r8, [0x140088010]
lea rcx, [rsp + 0x70]
call fcn.140002ac0
mov r9d, eax
test eax, eax
js 0x14000d92f
lea r8d, [rbx + 1]
mov rcx, r12
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop dword [rax + rax]
test eax, eax
je 0x14000d8ec
mov r8, rsi
lea rcx, [rsp + 0x70]
mov rdx, r13
call fcn.140005c44
xor ecx, ecx
mov ebx, eax
test eax, eax
jne 0x14000d8b7
lea rsi, [rdi + 2]
test rdi, rdi
jne 0x14000d80b
mov esi, ecx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax + rax]
mov ebx, dword [rsp + 0x40]
add r14, 8
inc ebx
mov dword [rsp + 0x40], ebx
cmp ebx, dword [rbp + 0x620]
jb 0x14000d741
mov r14, qword [rsp + 0x60]
mov r15d, ebx
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test eax, eax
jne 0x14000da04
mov rax, qword [0x14009b028]
lea rsi, [0x14009b028]
cmp rax, rsi
je 0x14000da0b
test byte [rax + 0x1c], 4
je 0x14000da0b
cmp byte [rax + 0x19], 3
jb 0x14000da0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14009b028]
lea r8, [0x1400885f0]
mov r9d, eax
mov edx, 0x88
mov rcx, qword [rcx + 0x10]
call fcn.140001050
jmp 0x14000da0b
mov rcx, qword [0x14009b028]
lea r12, [0x14009b028]
cmp rcx, r12
je 0x14000d9f5
test byte [rcx + 0x1c], 4
je 0x14000d9f5
cmp byte [rcx + 0x19], 2
jb 0x14000d9f5
mov edx, 0x87
jmp 0x14000d9e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x14009b028]
lea r12, [0x14009b028]
cmp rcx, r12
je 0x14000d9f5
test byte [rcx + 0x1c], 4
je 0x14000d9f5
cmp byte [rcx + 0x19], 2
jb 0x14000d9f5
mov edx, 0x86
jmp 0x14000d9e2
mov ecx, r9d
movzx eax, r9w
and ecx, 0x1fff0000
mov ebx, r9d
cmp ecx, 0x70000
cmove ebx, eax
mov rcx, qword [0x14009b028]
lea r12, [0x14009b028]
cmp rcx, r12
je 0x14000d9f5
test byte [rcx + 0x1c], 4
je 0x14000d9f5
cmp byte [rcx + 0x19], 2
jb 0x14000d9f5
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400885f0]
mov edx, 0x85
call fcn.140001050
jmp 0x14000d9f5
mov rcx, qword [0x14009b028]
lea r12, [0x14009b028]
cmp rcx, r12
je 0x14000d9f5
test byte [rcx + 0x1c], 4
je 0x14000d9f5
cmp byte [rcx + 0x19], 2
jb 0x14000d9f5
mov edx, 0x84
jmp 0x14000d9e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x14009b028]
lea r12, [0x14009b028]
cmp rcx, r12
je 0x14000d9f5
test byte [rcx + 0x1c], 4
je 0x14000d9f5
cmp byte [rcx + 0x19], 2
jb 0x14000d9f5
mov edx, 0x83
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400885f0]
mov r9d, eax
call fcn.140001050
mov r15d, dword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x14000d540
lea rsi, [0x14009b028]
mov rcx, r12
or r13, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x14000da75
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14000d539
test byte [rcx + 0x1c], 4
je 0x14000d539
cmp byte [rcx + 0x19], 2
jb 0x14000d539
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400885f0]
mov edx, 0x89
mov dword [rsp + 0x20], eax
mov r9, r12
call fcn.140001328
jmp 0x14000d539
mov r9d, dword [rbp + 0x620]
mov rdx, rbx
mov r8, qword [rsp + 0x58]
mov rcx, r14
call fcn.1400583e4
mov ebx, eax
test eax, eax
je 0x14000d539
mov rcx, qword [0x14009b028]
cmp rcx, rsi
je 0x14000dac6
test byte [rcx + 0x1c], 4
je 0x14000dac6
cmp byte [rcx + 0x19], 3
jb 0x14000dac6
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400885f0]
mov edx, 0x8a
mov r9d, eax
call fcn.140001050
xor ecx, ecx
mov ebx, ecx
jmp 0x14000d539
lea rax, [rbp + 0x180]
mov edx, 0x104
lea r9, [rbp + 0x390]
mov qword [rsp + 0x20], rax
lea r8, [0x140088010]
lea rcx, [rsp + 0x70]
call fcn.140002ac0
test eax, eax
jns 0x14000db2e
mov rcx, qword [0x14009b028]
cmp rcx, r12
je 0x14000db85
test byte [rcx + 0x1c], 4
je 0x14000db85
cmp byte [rcx + 0x19], 3
jb 0x14000db85
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400885f0]
mov edx, 0x8c
mov r9d, eax
call fcn.140001050
jmp 0x14000db85
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x14000db85
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14009b028]
cmp rcx, r12
je 0x14000db85
test byte [rcx + 0x1c], 4
je 0x14000db85
cmp byte [rcx + 0x19], 3
jb 0x14000db85
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x70]
mov edx, 0x8d
mov dword [rsp + 0x20], eax
lea r8, [0x1400885f0]
call fcn.140001328
add r14, 8
sub rdi, 1
jne 0x14000d574
jmp 0x14000d677