Function at 0x75b89944c
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r15, rcx
lea rdi, [0x75b91c090]
mov rcx, qword [0x75b91c090]
cmp rcx, rdi
je 0x75b89949b
test byte [rcx + 0x1c], 4
je 0x75b89949b
movzx r9d, dl
mov edx, 0x1c
lea r8, [0x75b8f6b80]
mov rcx, qword [rcx + 0x10]
call fcn.75b803b0c
mov r13, qword [r15 + 0x30]
mov rax, qword [r15 + 0x38]
mov r12, qword [rax + 0x18]
mov rax, qword [r15 + 8]
mov qword [rbp - 0x50], rax
xor r14d, r14d
mov qword [rbp - 0x30], r14
lea rdx, str.wer.dll
lea rcx, [rbp - 0x30]
call fcn.75b89b45c
test eax, eax
js 0x75b8999ed
mov qword [rbp + 0x50], r14
lea r8, str.WerReportCreate
mov rsi, qword [rbp - 0x30]
mov rdx, rsi
lea rcx, [rbp + 0x50]
call fcn.75b89d29c
test eax, eax
js 0x75b8999f5
mov qword [rbp - 0x38], r14
lea r8, str.WerReportCloseHandle
mov rdx, rsi
lea rcx, [rbp - 0x38]
call fcn.75b89d29c
test eax, eax
js 0x75b8999fd
mov qword [rbp - 0x48], r14
lea r8, str.WerReportSetParameter
mov rdx, rsi
lea rcx, [rbp - 0x48]
call fcn.75b89d29c
test eax, eax
js 0x75b899a05
mov qword [rbp - 0x40], r14
lea r8, str.WerReportAddFile
mov rdx, rsi
lea rcx, [rbp - 0x40]
call fcn.75b89d29c
test eax, eax
js 0x75b899a0d
mov qword [rbp - 0x28], r14
lea r8, str.WerReportSubmit
mov rdx, rsi
lea rcx, [rbp - 0x28]
call fcn.75b89d29c
test eax, eax
js 0x75b899a15
mov qword [rbp + 0x58], r14
movabs r10, 0xe1d8aeb93cd43970
lea r9, [rbp + 0x58]
xor r8d, r8d
xor edx, edx
mov rcx, qword [r12]
mov rax, qword [rbp + 0x50]
call qword [0x75b8e0a70]
mov ebx, eax
test eax, eax
js 0x75b899a1d
mov byte [rbp - 0x20], r14b
lea rax, [rbp + 0x58]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x10], rax
mov ebx, r14d
cmp dword [r12 + 0x20], r14d
jbe 0x75b89960d
mov eax, ebx
mov rdi, qword [r13 + rax*8]
test rdi, rdi
je 0x75b8995cc
cmp word [rdi], r14w
jne 0x75b8995d3
lea rdi, str.unspecified
movabs r10, 0xed3c2fcb7e534170
mov r9, rdi
xor r8d, r8d
mov edx, ebx
mov rcx, qword [rbp + 0x58]
mov rax, qword [rbp - 0x48]
call qword [0x75b8e0a70]
mov r14d, eax
test eax, eax
js 0x75b899a4f
inc ebx
cmp ebx, dword [r12 + 0x20]
mov r14d, 0
jb 0x75b8995ba
mov eax, dword [r15 + 0x20]
test eax, eax
je 0x75b899659
mov r12, qword [r15 + 0x28]
mov ebx, r14d
mov eax, ebx
mov r14, qword [r12 + rax*8]
movabs r10, 0xee0d26df3a556970
xor r9d, r9d
lea r8d, [r9 + 5]
mov rdx, r14
mov rcx, qword [rbp + 0x58]
mov rax, qword [rbp - 0x40]
call qword [0x75b8e0a70]
mov edi, eax
test eax, eax
js 0x75b899a87
inc ebx
cmp ebx, dword [r15 + 0x20]
jb 0x75b89961c
xor r14d, r14d
mov dword [rbp + 0x50], r14d
lea r8, [rbp + 0x50]
xor edx, edx
lea rcx, str.MpClient_CopyClientManifestForTesting
call fcn.75b857af0
nop
mov ecx, dword [rbp + 0x50]
test eax, eax
cmovs ecx, r14d
test ecx, ecx
je 0x75b899807
mov qword [rbp + 0x50], r14
lea rdx, str._windir_Temp
lea rcx, [rbp + 0x50]
call fcn.75b89dff4
test eax, eax
jns 0x75b8996e1
mov rcx, qword [0x75b91c090]
lea r13, [0x75b91c090]
cmp rcx, r13
je 0x75b8996ca
test byte [rcx + 0x1c], 1
je 0x75b8996ca
mov edx, 0x18
mov r9d, eax
lea r8, [0x75b8f6b80]
mov rcx, qword [rcx + 0x10]
call fcn.75b803b0c
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x75b89980e
call fcn.75b8bde90
jmp 0x75b89980e
mov qword [rbp - 0x48], r14
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r9d, eax
mov rbx, qword [rbp + 0x50]
mov r8, rbx
lea rdx, str._lsClient_Manifest__ld.xml
lea rcx, [rbp - 0x48]
call fcn.75b89f104
test eax, eax
jns 0x75b899756
mov rcx, qword [0x75b91c090]
lea r13, [0x75b91c090]
cmp rcx, r13
je 0x75b89973a
test byte [rcx + 0x1c], 1
je 0x75b89973a
mov edx, 0x19
mov r9d, eax
lea r8, [0x75b8f6b80]
mov rcx, qword [rcx + 0x10]
call fcn.75b803b0c
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x75b899748
call fcn.75b8bde90
test rbx, rbx
je 0x75b89980e
mov rcx, rbx
jmp 0x75b8996d7
xor r8d, r8d
mov rdi, qword [rbp - 0x48]
mov rdx, rdi
mov r14, qword [rbp - 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CopyFileW]
xor r12d, r12d
test eax, eax
je 0x75b899779
mov eax, r12d
jmp 0x75b89977e
call fcn.75b89abc4
mov ecx, eax
shr ecx, 0x1f
test cl, cl
je 0x75b8997d4
mov rcx, qword [0x75b91c090]
lea r13, [0x75b91c090]
cmp rcx, r13
je 0x75b8997b8
test byte [rcx + 0x1c], 1
je 0x75b8997b8
mov edx, 0x1a
mov r9d, eax
lea r8, [0x75b8f6b80]
mov rcx, qword [rcx + 0x10]
call fcn.75b803b0c
test rdi, rdi
je 0x75b8997c5
mov rcx, rdi
call fcn.75b8bde90
test rbx, rbx
je 0x75b899815
mov rcx, rbx
call fcn.75b8bde90
jmp 0x75b899815
mov rcx, qword [0x75b91c090]
lea r13, [0x75b91c090]
cmp rcx, r13
je 0x75b8997b8
test byte [rcx + 0x1c], 4
je 0x75b8997b8
mov edx, 0x1b
mov r9, rdi
lea r8, [0x75b8f6b80]
mov rcx, qword [rcx + 0x10]
call fcn.75b805074
jmp 0x75b8997b8
lea r13, [0x75b91c090]
mov r14, qword [rbp - 0x50]
xor r12d, r12d
movabs r10, 0xee0d26df3a556970
xor r9d, r9d
lea r8d, [r9 + 5]
mov rdx, r14
mov rcx, qword [rbp + 0x58]
mov rax, qword [rbp - 0x40]
call qword [0x75b8e0a70]
mov ebx, eax
test eax, eax
js 0x75b899ac4
mov ebx, dword [r15 + 0x40]
mov r14d, 2
and ebx, r14d
add ebx, ebx
mov rax, qword [r15 + 0x38]
mov edi, ebx
test rax, rax
je 0x75b899881
mov rax, qword [rax + 0x18]
test rax, rax
je 0x75b899881
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x75b899881
lea rdx, str.AntiMalware_SFC_Instrumentation
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x75b899881
bts edi, 8
mov dword [rbp + 0x40], r12d
movabs r10, 0xe38cbf985a546870
lea r9, [rbp + 0x40]
mov r8d, edi
mov edx, r14d
mov rcx, qword [rbp + 0x58]
mov rax, qword [rbp - 0x28]
call qword [0x75b8e0a70]
mov ebx, eax
test eax, eax
js 0x75b8999bb
mov r9d, dword [rbp + 0x40]
cmp r9d, r14d
jne 0x75b899905
mov rcx, qword [0x75b91c090]
cmp rcx, r13
je 0x75b899975
test byte [rcx + 0x1c], 4
je 0x75b8998f3
mov edx, 0x22
mov r9d, r14d
lea r8, [0x75b8f6b80]
mov rcx, qword [rcx + 0x10]
call fcn.75b803b0c
mov r9d, dword [rbp + 0x40]
mov rcx, qword [0x75b91c090]
cmp rcx, r13
je 0x75b899975
test byte [rcx + 0x1c], 4
je 0x75b899975
mov edx, 0x23
jmp 0x75b899965
cmp r9d, 0xb
jne 0x75b899923
mov rcx, qword [0x75b91c090]
cmp rcx, r13
je 0x75b899975
test byte [rcx + 0x1c], 4
je 0x75b899975
lea edx, [r9 + 0x19]
jmp 0x75b899965
mov rcx, qword [0x75b91c090]
cmp rcx, r13
je 0x75b899975
test byte [rcx + 0x1c], 4
je 0x75b899955
mov edx, 0x25
lea r8, [0x75b8f6b80]
mov rcx, qword [rcx + 0x10]
call fcn.75b803b0c
mov r9d, dword [rbp + 0x40]
mov rcx, qword [0x75b91c090]
cmp rcx, r13
je 0x75b899975
test byte [rcx + 0x1c], r14b
je 0x75b899975
mov edx, 0x26
lea r8, [0x75b8f6b80]
mov rcx, qword [rcx + 0x10]
call fcn.75b803b0c
mov byte [rbp - 0x20], 1
movabs r10, 0x945d9f4218525370
mov rcx, qword [rbp + 0x58]
mov rax, qword [rbp - 0x38]
call qword [0x75b8e0a70]
nop
test rsi, rsi
je 0x75b8999a0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [0x75b91c090]
cmp rcx, r13
je 0x75b8999e5
test byte [rcx + 0x1c], 1
je 0x75b8999e5
mov edx, 0x21
mov r9d, ebx
lea r8, [0x75b8f6b80]
mov rcx, qword [rcx + 0x10]
call fcn.75b803b0c
mov ecx, ebx
call fcn.75b89ca74
nop
mov ecx, eax
call fcn.75b89ca74
int3
mov ecx, eax
call fcn.75b89ca74
int3
mov ecx, eax
call fcn.75b89ca74
int3
mov ecx, eax
call fcn.75b89ca74
int3
mov ecx, eax
call fcn.75b89ca74
int3
mov ecx, eax
call fcn.75b89ca74
int3
mov rcx, qword [0x75b91c090]
cmp rcx, rdi
je 0x75b899a47
test byte [rcx + 0x1c], 1
je 0x75b899a47
mov edx, 0x1d
mov r9d, ebx
lea r8, [0x75b8f6b80]
mov rcx, qword [rcx + 0x10]
call fcn.75b803b0c
mov ecx, ebx
call fcn.75b89ca74
nop
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b899a7e
test byte [rcx + 0x1c], 1
je 0x75b899a7e
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rdi
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
call fcn.75b897e5c
mov ecx, r14d
call fcn.75b89ca74
int3
mov rcx, qword [0x75b91c090]
lea rax, [0x75b91c090]
cmp rcx, rax
je 0x75b899abc
test byte [rcx + 0x1c], 1
je 0x75b899abc
mov edx, 0x1f
mov dword [rsp + 0x20], edi
mov r9, r14
lea r8, [0x75b8f6b80]
mov rcx, qword [rcx + 0x10]
call fcn.75b81c350
mov ecx, edi
call fcn.75b89ca74
int3
mov rcx, qword [0x75b91c090]
cmp rcx, r13
je 0x75b899af2
test byte [rcx + 0x1c], 1
je 0x75b899af2
mov edx, 0x20
mov dword [rsp + 0x20], ebx
mov r9, r14
lea r8, [0x75b8f6b80]
mov rcx, qword [rcx + 0x10]
call fcn.75b81c350
mov ecx, ebx
call fcn.75b89ca74
int3