Function at 0x14000c210
Capabilities:
Copy file
Delete file
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xd8]
sub rsp, 0x1b0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400f7080]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov ebx, edx
mov r15, rcx
xor r14d, r14d
mov dword [rsp + 0x50], r14d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [r15 + 0x98]
cmp rax, 0xea60
jb 0x14000c905
mov rax, qword [r15 + 0x60]
mov qword [rbp - 0x50], r14
mov esi, 7
mov word [rbp - 0x60], r14w
mov qword [rbp - 0x48], rsi
test rax, rax
jne 0x14000c29d
mov r12d, r14d
mov edi, esi
lea r14d, [r12 + 1]
jmp 0x14000c2cd
lea rdx, [r15 + 0x50]
lea r8, [rax - 0xb]
cmp rax, r8
cmovb r8, rax
cmp qword [rdx + 0x18], 8
jb 0x14000c2b6
mov rdx, qword [rdx]
lea rcx, [rbp - 0x60]
call fcn.140002160
mov r14d, 3
mov rdi, qword [rbp - 0x48]
mov r12, qword [rbp - 0x50]
mov r13d, r14d
xor eax, eax
mov qword [rbp], rax
mov qword [rbp + 8], rsi
mov word [rbp - 0x10], ax
sub ebx, 1
je 0x14000c9f8
cmp ebx, 1
jne 0x14000c9f8
lea r8d, [rax + 8]
lea rdx, str.programs
lea rcx, [rbp - 0x10]
call fcn.140002160
nop
movdqa xmm0, xmmword [0x1400e5d00]
movdqu xmmword [rbp - 0x30], xmm0
xor eax, eax
mov word [rbp - 0x40], ax
or r14d, 4
mov dword [rsp + 0x50], r14d
mov rbx, qword [rbp]
lea rdx, [rbx + r12]
lea rcx, [rbp - 0x40]
call fcn.140009b70
lea rdx, [rbp - 0x60]
cmp rdi, 8
cmovae rdx, qword [rbp - 0x60]
mov r8, r12
lea rcx, [rbp - 0x40]
call fcn.140009600
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rdx, qword [rbp - 0x10]
mov r8, rbx
lea rcx, [rbp - 0x40]
call fcn.140009600
mov r8d, 3
lea rdx, [0x1400da2c0]
lea rcx, [rbp - 0x40]
call fcn.140009600
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
xor r14d, r14d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], rsi
mov word [rax], r14w
or r13d, 0xc
and r13d, 0xfffffffb
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14000c3e9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c3e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ca7f
call fcn.1400a508c
movdqa xmm0, xmmword [0x1400e5d00]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], r14w
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000c997
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x80]
call fcn.14000cfc0
test al, al
je 0x14000c478
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000c46e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xc003100a
jmp 0x14000c99c
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
xor edx, edx
lea r8d, [rdx + 0x50]
lea rcx, [rbp + 0x50]
call fcn.1400a6c90
movzx eax, word [rbp - 0x12]
movzx ecx, word [rbp - 0x14]
movzx edx, word [rbp - 0x16]
movzx r10d, word [rbp - 0x18]
movzx r11d, word [rbp - 0x1a]
movzx r9d, word [rbp - 0x1e]
movzx r8d, word [rbp - 0x20]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
lea rdx, str._04d_02d_02d_02d_02d_02d_03d
lea rcx, [rbp + 0x50]
call fcn.14000e8b0
nop
movdqa xmm0, xmmword [0x1400e5d00]
movdqu xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x30], r14w
mov eax, r13d
or eax, 0x10
mov dword [rsp + 0x50], eax
mov rdi, qword [rbp]
mov rbx, qword [rbp - 0x50]
lea rdx, [rdi + rbx]
lea rcx, [rbp + 0x30]
call fcn.140009b70
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
mov r8, rbx
lea rcx, [rbp + 0x30]
call fcn.140009600
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rdx, qword [rbp - 0x10]
mov r8, rdi
lea rcx, [rbp + 0x30]
call fcn.140009600
mov r8d, 8
lea rdx, str._mirror_
lea rcx, [rbp + 0x30]
call fcn.140009600
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], rsi
mov word [rax], r14w
mov eax, r13d
or eax, 0x30
mov dword [rsp + 0x50], eax
lea rax, [rbp + 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000c590
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x10]
call fcn.140009600
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], rsi
mov word [rax], r14w
or r13d, 0x70
mov dword [rsp + 0x50], r13d
mov r8d, 3
lea rdx, [0x1400da2c0]
lea rcx, [rbp - 0x40]
call fcn.140009600
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], rsi
mov word [rax], r14w
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14000c647
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c642
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ca85
call fcn.1400a508c
movdqa xmm0, xmmword [0x1400e5d00]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], r14w
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x14000c699
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c694
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ca8b
call fcn.1400a508c
movdqa xmm0, xmmword [0x1400e5d00]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], r14w
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x14000c6eb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c6e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ca91
call fcn.1400a508c
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000c753
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000c753
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne bl
test eax, eax
je 0x14000c93a
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x14000c7c7
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
test bl, bl
je 0x14000c93a
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [r15 + 0x98], rax
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14000c81e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c819
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ca97
call fcn.1400a508c
movdqa xmm0, xmmword [0x1400e5d00]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r14w
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14000c872
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c86d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ca9d
call fcn.1400a508c
movdqa xmm0, xmmword [0x1400e5d00]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], r14w
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x14000c8c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c8bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000caa3
call fcn.1400a508c
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14000c905
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c900
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000caa9
call fcn.1400a508c
mov eax, 0x30000
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.1400a4a60
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ebx, 0xc003f001
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14000c981
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c97c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000caaf
call fcn.1400a508c
movdqa xmm0, xmmword [0x1400e5d00]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r14w
jmp 0x14000c99c
mov ebx, 0xc003000c
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14000c9dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c9d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cab5
call fcn.1400a508c
movdqa xmm0, xmmword [0x1400e5d00]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], r14w
mov rdi, qword [rbp - 0x48]
mov rsi, qword [rbp + 8]
jmp 0x14000c9fd
mov ebx, 0xc0030004
cmp rsi, 8
jb 0x14000ca3a
lea rdx, [rsi*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ca34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cabb
call fcn.1400a508c
nop
cmp rdi, 8
jb 0x14000ca72
lea rdx, [rdi*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ca6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ca79
call fcn.1400a508c
mov eax, ebx
jmp 0x14000c90a
call fcn.1400a8f10
nop
call fcn.1400a8f10
nop
call fcn.1400a8f10
nop
call fcn.1400a8f10
nop
call fcn.1400a8f10
int3
call fcn.1400a8f10
nop
call fcn.1400a8f10
nop
call fcn.1400a8f10
nop
call fcn.1400a8f10
nop
call fcn.1400a8f10
nop
call fcn.1400a8f10
nop
call fcn.1400a8f10
int3