Function at 0x14001ecdc
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3a8]
sub rsp, 0x480
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov r14, qword [rbp + 0x3d0]
xor r15d, r15d
mov rsi, qword [rbp + 0x3e8]
mov rdi, r9
mov r11, r8
mov rbx, rdx
mov r10, rcx
test rcx, rcx
je 0x14001f3a7
test r8, r8
je 0x14001f3a7
mov edx, 0x103
mov dword [rsp + 0x4c], r15d
lea rax, [rbp + 0x160]
mov dword [rsp + 0x48], r15d
mov r8d, edx
mov dword [rsp + 0x44], r15d
sub r10, rax
mov dword [rsp + 0x40], r15d
lea rcx, [rbp + 0x160]
lea r12d, [r15 + 2]
lea r13d, [r15 + 1]
lea rax, [r8 + 0x7ffffefb]
test rax, rax
je 0x14001ed98
movzx eax, word [r10 + rcx]
test ax, ax
je 0x14001ed98
mov word [rcx], ax
add rcx, r12
sub r8, r13
jne 0x14001ed77
test r8, r8
lea rax, [rcx - 2]
cmovne rax, rcx
lea rcx, [rsp + 0x50]
mov word [rax], r15w
lea rax, [rsp + 0x50]
sub r11, rax
lea rax, [rdx + 0x7ffffefb]
test rax, rax
je 0x14001edd5
movzx eax, word [rcx + r11]
test ax, ax
je 0x14001edd5
mov word [rcx], ax
add rcx, r12
sub rdx, r13
jne 0x14001edb4
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r15w
test rbx, rbx
je 0x14001ee10
lea rcx, [rbp + 0x160]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
nop dword [rax + rax]
mov r8, rbx
lea rcx, [rbp + 0x160]
mov edx, 0x104
call fcn.140010d0c
test rdi, rdi
je 0x14001ee80
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
nop dword [rax + rax]
mov r8, rdi
lea rcx, [rsp + 0x50]
mov edx, 0x104
call fcn.140010d0c
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14001ee54
test al, 0x10
je 0x14001ee80
test rbx, rbx
jne 0x14001ee80
lea rcx, [rbp + 0x160]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
nop dword [rax + rax]
mov r8, rdi
lea rcx, [rbp + 0x160]
mov edx, 0x104
call fcn.140010d0c
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14001f36f
mov bl, 0x10
test bl, al
jne 0x14001f36f
mov edi, dword [rbp + 0x3d8]
bt edi, 0xa
jae 0x14001eeec
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14001eecc
test bl, al
je 0x14001eeec
lea rdx, str.__WMC_CopyFile:_File__S_was_only_to_be_installed_if_already_present_on_the_system.__It_was_not_present_and_thus_will_not_be_installed._r_n
lea r8, [rbp + 0x160]
mov ecx, 4
call fcn.140019b1c
mov eax, r13d
jmp 0x14001f3ac
test bl, dil
je 0x14001ef14
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14001ef14
test bl, al
jne 0x14001ef14
lea rdx, str.__WMC_CopyFile:_File__S_is_not_to_be_installed_if_already_present_on_the_system.__It_was_present_and_thus_will_not_be_reinstalled._r_n
jmp 0x14001eed3
mov ebx, 4
test bl, dil
je 0x14001f08e
lea r8, [rbp + 0x160]
mov ecx, ebx
lea rdx, str.__WMC_CopyFile:_File__S_should_always_to_be_installed.__This_file_will_be_installed._r_n
call fcn.140019b1c
mov esi, dword [rbp + 0x3e0]
test esi, esi
je 0x14001ef4d
lea rcx, [rbp + 0x160]
call fcn.14001a074
cmp edi, 8
je 0x14001f057
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
bt eax, 0xe
jae 0x14001efe2
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
call fcn.14001c9fc
test eax, eax
je 0x14001efcc
movabs r10, 0xc744176334503970
mov rax, qword [rsp + 0x30]
lea rcx, [rbp + 0x160]
xor edx, edx
call qword [0x140048188]
test eax, eax
jne 0x14001efcc
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r8, [rsp + 0x50]
mov ecx, r12d
mov r9d, eax
lea rdx, str.ERROR:_Decryption_failed_for_file__S.__Last_result:_0x_x._r_n
call fcn.140019b1c
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001efe2
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop dword [rax + rax]
lea rcx, [rsp + 0x50]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
bt eax, 0xe
jae 0x14001f20d
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
call fcn.14001c9fc
test eax, eax
je 0x14001f1f7
movabs r10, 0xc744176334503970
mov rax, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [0x140048188]
jmp 0x14001f1d0
lea r8, [rsp + 0x50]
mov ecx, r12d
lea rdx, str.__WMC_CopyFile:_Could_not_replace_file__S.__This_file_will_be_replaced_on_reboot._r_n
call fcn.140019b1c
mov r9d, esi
mov dword [rsp + 0x28], r13d
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r14
lea rcx, [rbp + 0x160]
call fcn.14001d558
jmp 0x14001f3ac
lea r8, [rsp + 0x4c]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.14001aeb8
test eax, eax
je 0x14001f21c
lea r8, [rsp + 0x50]
mov ecx, ebx
lea rdx, str.__WMC_CopyFile:_Could_not_find_file_version_for__S.__This_file_will_be_overwritten._r_n
call fcn.140019b1c
mov esi, dword [rbp + 0x3e0]
test esi, esi
je 0x14001f0d3
lea rcx, [rbp + 0x160]
call fcn.14001a074
cmp edi, 8
je 0x14001f057
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
bt eax, 0xe
jae 0x14001f168
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
call fcn.14001c9fc
test eax, eax
je 0x14001f152
movabs r10, 0xc744176334503970
mov rax, qword [rsp + 0x30]
lea rcx, [rbp + 0x160]
xor edx, edx
call qword [0x140048188]
test eax, eax
jne 0x14001f152
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r8, [rsp + 0x50]
mov ecx, r12d
mov r9d, eax
lea rdx, str.ERROR:_Decryption_failed_for_file__S.__Last_result:_0x_x._r_n
call fcn.140019b1c
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001f168
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop dword [rax + rax]
lea rcx, [rsp + 0x50]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
bt eax, 0xe
jae 0x14001f20d
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
call fcn.14001c9fc
test eax, eax
je 0x14001f1f7
movabs r10, 0xc744176334503970
mov rax, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [0x140048188]
test eax, eax
jne 0x14001f1f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r8, [rsp + 0x50]
mov ecx, r12d
mov r9d, eax
lea rdx, str.ERROR:_Decryption_failed_for_file__S.__Last_result:_0x_x._r_n
call fcn.140019b1c
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001f20d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
test edi, edi
je 0x14001f057
xor eax, eax
jmp 0x14001f3ac
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x160]
call fcn.14001aeb8
test eax, eax
je 0x14001f24b
lea r8, [rbp + 0x160]
lea rdx, str.ERROR:_WMC_CopyFile:_Could_not_find_file_version_for__S.__This_file_will_not_be_copied._r_n
mov ecx, ebx
jmp 0x14001eedf
movzx eax, word [rsp + 0x40]
mov r8, 0xffffffffffff0000
mov ecx, dword [rsp + 0x40]
mov edx, dword [rsp + 0x48]
and rcx, r8
or rcx, rax
and rdx, r8
mov eax, dword [rsp + 0x44]
shr rax, 0x10
shl rcx, 0x10
or rcx, rax
movzx eax, word [rsp + 0x44]
shl rcx, 0x10
or rcx, rax
movzx eax, word [rsp + 0x48]
or rdx, rax
mov eax, dword [rsp + 0x4c]
shl rdx, 0x10
shr rax, 0x10
or rdx, rax
movzx eax, word [rsp + 0x4c]
shl rdx, 0x10
or rdx, rax
cmp rdx, rcx
jne 0x14001f2b0
mov eax, r13d
jmp 0x14001f2b7
sbb eax, eax
not eax
and eax, r12d
test rsi, rsi
je 0x14001f2be
mov dword [rsi], eax
test eax, eax
je 0x14001f2de
test dil, 0x40
jne 0x14001f2cd
cmp eax, r13d
je 0x14001f2de
lea r8, [rsp + 0x50]
lea rdx, str.__WMC_CopyFile:_File__S_is_newer_than_the_version_to_be_installed.__No_copy_will_occur._r_n
jmp 0x14001f244
lea r8, [rbp + 0x160]
mov ecx, ebx
lea rdx, str.__WMC_CopyFile:_File__S_is_newer_than_the_installed_version.__This_file_will_be_installed._r_n
call fcn.140019b1c
mov esi, dword [rbp + 0x3e0]
test esi, esi
je 0x14001f309
lea rcx, [rbp + 0x160]
call fcn.14001a074
test dil, 8
jne 0x14001f057
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
bt eax, 0xe
jae 0x14001efe2
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
call fcn.14001c9fc
test eax, eax
je 0x14001efcc
movabs r10, 0xc744176334503970
mov rax, qword [rsp + 0x30]
lea rcx, [rbp + 0x160]
xor edx, edx
call qword [0x140048188]
jmp 0x14001efa5
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x14001f387
movzx eax, ax
or eax, 0x80070000
mov r9d, eax
lea r8, [rbp + 0x160]
lea rdx, str.ERROR:_WMC_CopyFile:_Could_not_find_source_file__S.__Error:_0x_x._r_n
mov ecx, r12d
call fcn.140019b1c
mov eax, 0x80070002
jmp 0x14001f3ac
mov eax, 0x80004003
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.1400017f0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret