Function at 0x14004f650
Capabilities:
Copy file
Get common file path

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
mov eax, 0x2700
call fcn.140054680
sub rsp, rax
mov qword [rsp + 0x26e0], 0xfffffffffffffffe
mov rax, qword [0x140079ca0]
xor rax, rsp
mov qword [rsp + 0x26f0], rax
call fcn.140005fb0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rax, 0x140
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x20]
add rax, 0x43e4
mov qword [rsp + 0x26c0], rax
mov rax, qword [rsp + 0x20]
add rax, 0x15b48
mov qword [rsp + 0x2498], rax
mov dword [rsp + 0x24a0], 0
mov rcx, qword [rsp + 0x2718]
call fcn.140006290
mov dword [rsp + 0x2490], eax
lea rcx, [rsp + 0x480]
call fcn.140045240
nop
lea rcx, [rsp + 0x24a8]
call fcn.140003710
nop
mov dword [rsp + 0x470], 0
mov dword [rsp + 0x28], 0
jmp 0x14004f729
mov eax, dword [rsp + 0x28]
add eax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x2710]
mov eax, dword [rax + 0x7b8]
cmp dword [rsp + 0x28], eax
jge 0x14004fce8
mov r9, qword [rsp + 0x2498]
add r9, 4
mov r8d, dword [rsp + 0x28]
add r8d, 1
lea rdx, [rsp + 0x24a8]
lea rcx, [rsp + 0x480]
call fcn.1400467a0
cmp eax, 1
je 0x14004f7a2
mov dword [rsp + 0x26cc], 9
lea rcx, [rsp + 0x24a8]
call fcn.140003760
nop
lea rcx, [rsp + 0x480]
call fcn.140045220
mov eax, dword [rsp + 0x26cc]
jmp 0x14004fd15
mov rbx, qword [rsp + 0x2710]
add rbx, 0x194
lea rcx, [rsp + 0x24a8]
call fcn.140003700
mov r8, rbx
mov rdx, rax
mov rcx, qword [rsp + 0x2710]
call fcn.14004f400
mov dword [rsp + 0x26c8], eax
cmp dword [rsp + 0x26c8], 0
jne 0x14004f7e7
jmp 0x14004f71e
mov rax, qword [rsp + 0x2710]
cmp dword [rax + 0x194], 0
jne 0x14004f80e
mov rax, qword [rsp + 0x2710]
cmp dword [rax + 0x7b4], 2
jne 0x14004f80e
jmp 0x14004f71e
mov rax, qword [rsp + 0x2710]
cmp dword [rax + 0x7b4], 7
je 0x14004f841
mov rax, qword [rsp + 0x2710]
cmp dword [rax + 0x7b4], 8
je 0x14004f841
mov rax, qword [rsp + 0x2710]
cmp dword [rax + 0x7b4], 0
jne 0x14004f846
jmp 0x14004f71e
mov rax, qword [rsp + 0x2710]
cmp dword [rax + 0x194], 0
je 0x14004f897
mov rcx, qword [rsp + 0x26c0]
mov rax, qword [rsp + 0x2710]
mov eax, dword [rax + 0x194]
cmp dword [rcx + 0x104], eax
je 0x14004f897
mov rcx, qword [rsp + 0x26c0]
mov rax, qword [rsp + 0x2710]
mov eax, dword [rax + 0x194]
cmp dword [rcx + 0x108], eax
jne 0x14004fc9e
lea rdx, [0x140064ebc]
lea rcx, [rsp + 0x260]
call fcn.140004cf0
lea rdx, [0x140064ec0]
lea rcx, [rsp + 0x24b0]
call fcn.140004cf0
mov rdx, qword [rsp + 0x250]
add rdx, 0x3a78
lea rcx, [rsp + 0x260]
call fcn.140004cf0
mov rdx, qword [rsp + 0x2710]
add rdx, 0x198
lea rcx, [rsp + 0x260]
call fcn.140004d20
mov rax, qword [rsp + 0x2710]
movzx eax, word [rax + 0x5a8]
test eax, eax
je 0x14004f9ad
lea rdx, [0x140064ec4]
lea rcx, [rsp + 0x40]
call fcn.140004cf0
xor r9d, r9d
mov r8d, 0x24
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
je 0x14004f96c
mov dword [rsp + 0x26d0], 3
lea rcx, [rsp + 0x24a8]
call fcn.140003760
nop
lea rcx, [rsp + 0x480]
call fcn.140045220
mov eax, dword [rsp + 0x26d0]
jmp 0x14004fd15
lea rdx, [0x140064ec8]
lea rcx, [rsp + 0x40]
call fcn.140004d20
mov rdx, qword [rsp + 0x2710]
add rdx, 0x5a8
lea rcx, [rsp + 0x40]
call fcn.140004d20
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x24b0]
call fcn.140004cf0
jmp 0x14004fb4d
mov rax, qword [rsp + 0x2710]
cmp dword [rax + 0x7b4], 6
jne 0x14004fa48
lea rdx, [0x140064ecc]
lea rcx, [rsp + 0x40]
call fcn.140004cf0
xor r9d, r9d
mov r8d, 0x25
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
je 0x14004fa20
mov dword [rsp + 0x26d4], 3
lea rcx, [rsp + 0x24a8]
call fcn.140003760
nop
lea rcx, [rsp + 0x480]
call fcn.140045220
mov eax, dword [rsp + 0x26d4]
jmp 0x14004fd15
lea rdx, [0x140064ed0]
lea rcx, [rsp + 0x40]
call fcn.140004d20
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x24b0]
call fcn.140004cf0
jmp 0x14004fb4d
mov rax, qword [rsp + 0x2710]
cmp dword [rax + 0x7b4], 0xa
jne 0x14004fa96
mov rcx, qword [rsp + 0x2710]
add rcx, 0x7c0
call fcn.140003700
mov rdx, rax
lea rcx, [rsp + 0x24b0]
call fcn.140004cf0
lea rdx, str...COLOR_
lea rcx, [rsp + 0x24b0]
call fcn.140004d20
jmp 0x14004fb4d
mov rax, qword [rsp + 0x2710]
cmp dword [rax + 0x7b4], 1
je 0x14004fb31
mov rax, qword [rsp + 0x2710]
cmp dword [rax + 0x7b4], 3
je 0x14004fb31
mov r8, qword [rsp + 0x2710]
add r8, 0x198
movsxd rcx, dword [rsp + 0x470]
mov rax, qword [rsp + 0x250]
lea rcx, [rax + rcx*2 + 0x1660]
mov edx, 0x104
call fcn.14002fb84
mov rcx, qword [rsp + 0x2710]
add rcx, 0x198
call fcn.14002f9f0
mov r11, rax
mov eax, dword [rsp + 0x470]
lea eax, [rax + r11 + 1]
mov dword [rsp + 0x470], eax
movsxd rdx, dword [rsp + 0x470]
xor ecx, ecx
mov rax, qword [rsp + 0x250]
mov word [rax + rdx*2 + 0x1660], cx
mov rdx, qword [rsp + 0x26c0]
add rdx, 0x414
lea rcx, [rsp + 0x24b0]
call fcn.140004cf0
mov rdx, qword [rsp + 0x2710]
add rdx, 0x198
lea rcx, [rsp + 0x24b0]
call fcn.140004d20
mov r9d, 1
lea r8, [rsp + 0x24b0]
mov rax, qword [rsp + 0x250]
mov edx, dword [rax + 4]
mov rcx, qword [rsp + 0x2710]
call fcn.14004dec0
test eax, eax
je 0x14004fba1
mov rax, qword [rsp + 0x2720]
mov dword [rax], 1
xor r8d, r8d
lea rdx, [rsp + 0x24b0]
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x14004fc55
mov rax, qword [rsp + 0x2710]
cmp dword [rax + 0x7b4], 4
jne 0x14004fbe0
mov dword [rsp + 0x26e8], 1
jmp 0x14004fbeb
mov dword [rsp + 0x26e8], 0
mov r9d, dword [rsp + 0x26e8]
lea r8, [rsp + 0x24b0]
lea rdx, [rsp + 0x260]
mov rcx, qword [rsp + 0x2710]
call fcn.14004cf00
cmp eax, 1
je 0x14004fc47
mov dword [rsp + 0x26d8], 9
lea rcx, [rsp + 0x24a8]
call fcn.140003760
nop
lea rcx, [rsp + 0x480]
call fcn.140045220
mov eax, dword [rsp + 0x26d8]
jmp 0x14004fd15
mov rax, qword [rsp + 0x2720]
mov dword [rax], 1
mov r9d, 1
lea r8, [rsp + 0x24b0]
mov rax, qword [rsp + 0x250]
mov edx, dword [rax + 4]
mov rcx, qword [rsp + 0x2710]
call fcn.14004dec0
test eax, eax
je 0x14004fc8d
mov rax, qword [rsp + 0x2720]
mov dword [rax], 1
mov eax, dword [rsp + 0x24a0]
add eax, 1
mov dword [rsp + 0x24a0], eax
mov rcx, qword [rsp + 0x2710]
call fcn.14004cdd0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x24a0]
imul eax, eax, 0x64
mov edx, dword [rsp + 0x2490]
add edx, eax
mov rcx, qword [rsp + 0x2718]
call fcn.1400062c0
mov rcx, qword [rsp + 0x2710]
call fcn.14004cdd0
jmp 0x14004f71e
mov dword [rsp + 0x26dc], 0
lea rcx, [rsp + 0x24a8]
call fcn.140003760
nop
lea rcx, [rsp + 0x480]
call fcn.140045220
mov eax, dword [rsp + 0x26dc]
mov rcx, qword [rsp + 0x26f0]
xor rcx, rsp
call fcn.14002f9d0
add rsp, 0x2700
pop rbx
ret