Function at 0x1400454b0
Capabilities:
Copy file
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
sub rsp, 0x470
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1401c7b80]
xor rax, rsp
mov qword [rbp + 0x420], rax
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140045fec
mov byte [reloc.WS2_32.dll_accept], 0
mov r8d, 0x104
lea rdx, [rbp + 0x310]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x200]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
movabs rax, 0x3973a82d24d9dd5c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs rax, 0xff8bcb86036456af
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movabs rsi, 0x5b5dcb5f57a9b929
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rdi, 0xff8bcb86036438c6
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movdqa xmm0, xmmword [rbp + 0x160]
pxor xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rbp + 0x160], xmm0
lea rcx, [rbp + 0x200]
dec rcx
nop dword [rax + rax]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1400455b0
lea r8, [rbp + 0x160]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400455d0
call fcn.140004040
lea rdx, [rbp + 0x310]
mov rcx, rax
call fcn.140007aa0
call fcn.140004040
lea rdx, [rbp + 0x200]
mov rcx, rax
call fcn.140007aa0
xor r8d, r8d
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x310]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x140045f04
and dword [rbp + 0x10], 0xfffffe00
xor r15d, r15d
mov qword [rbp + 0x18], r15
mov eax, dword [rbp + 0x28]
and eax, 0xffffff04
or eax, 0x104
mov dword [rbp + 0x28], eax
mov qword [rbp + 0x30], r15
mov r12d, 0x20
mov rax, qword gs:[0x58]
mov r14, qword [rax]
mov eax, dword [r12 + r14]
cmp dword [0x1401cf0ec], eax
jle 0x140045694
lea rcx, [0x1401cf0ec]
call fcn.140133b58
cmp dword [0x1401cf0ec], 0xffffffff
jne 0x140045694
lea rcx, [0x1401727b0]
call fcn.140133edc
lea rcx, [0x1401cf0ec]
call fcn.140133af8
lea rdx, [0x1401c8cf0]
cmp qword [reloc.OLEAUT32.dll_SafeArrayDestroy], 0x10
cmovae rdx, qword [0x1401c8cf0]
mov rcx, qword [0x1401c8d38]
mov rax, qword [rcx]
mov r8d, dword [0x1401c8d00]
call qword [rax + SafeArrayCopy]
mov qword [rbp + 0x20], rax
movabs rax, 0x5b33a43624dbdc5f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movdqa xmm0, xmmword [rbp + 0x170]
pxor xmm0, xmmword [rbp + 0x90]
movdqa xmmword [rbp + 0x170], xmm0
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 8]
call fcn.14004f6e0
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rax
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x100]
call fcn.14004e9e0
movsx r8d, byte [rbx + 8]
movzx ecx, byte [rbp + 0x108]
mov byte [rbx + 8], cl
mov ecx, dword [rbp + 0x108]
xor ecx, r8d
movzx r8d, cl
xor r8d, dword [rbp + 0x108]
mov rax, qword [rbx]
mov rcx, qword [rbp + 0x100]
mov qword [rbx], rcx
mov qword [rbp + 0x100], rax
mov ecx, dword [rbx + 8]
mov edx, ecx
shl edx, 0x17
sar edx, 0x1f
mov eax, r8d
xor eax, ecx
and eax, 0x100
xor eax, ecx
mov dword [rbx + 8], eax
shl edx, 8
xor edx, r8d
and edx, 0x100
xor edx, r8d
mov dword [rbp + 0x108], edx
lea rcx, [rbp + 0x100]
call fcn.14004ec20
nop
lea rcx, [rbp + 0x20]
call fcn.14004ec20
mov eax, dword [rbp + 0x40]
and eax, 0xffffff04
or eax, 0x104
mov dword [rbp + 0x40], eax
mov qword [rbp + 0x48], r15
mov eax, dword [r12 + r14]
cmp dword [0x1401cf0ec], eax
jle 0x140045820
lea rcx, [0x1401cf0ec]
call fcn.140133b58
cmp dword [0x1401cf0ec], 0xffffffff
jne 0x140045820
lea rcx, [0x1401727b0]
call fcn.140133edc
lea rcx, [0x1401cf0ec]
call fcn.140133af8
lea rdx, [0x1401c8c30]
cmp qword [reloc.OLEAUT32.dll_SafeArrayDestroy], 0x10
cmovae rdx, qword [0x1401c8c30]
mov rcx, qword [0x1401c8d38]
mov rax, qword [rcx]
mov r8d, dword [0x1401c8c40]
call qword [rax + SafeArrayCopy]
mov qword [rbp + 0x38], rax
movabs rax, 0x5b5dcb5f579cdd44
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movdqa xmm0, xmmword [rbp + 0x180]
pxor xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp + 0x180], xmm0
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 8]
call fcn.14004f6e0
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x128], rax
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x118]
call fcn.14004e9e0
movsx r8d, byte [rbx + 8]
movzx ecx, byte [rbp + 0x120]
mov byte [rbx + 8], cl
mov ecx, dword [rbp + 0x120]
xor ecx, r8d
movzx r8d, cl
xor r8d, dword [rbp + 0x120]
mov rax, qword [rbx]
mov rcx, qword [rbp + 0x118]
mov qword [rbx], rcx
mov qword [rbp + 0x118], rax
mov ecx, dword [rbx + 8]
mov edx, ecx
shl edx, 0x17
sar edx, 0x1f
mov eax, r8d
xor eax, ecx
and eax, 0x100
xor eax, ecx
mov dword [rbx + 8], eax
shl edx, 8
xor edx, r8d
and edx, 0x100
xor edx, r8d
mov dword [rbp + 0x120], edx
lea rcx, [rbp + 0x118]
call fcn.14004ec20
nop
lea rcx, [rbp + 0x38]
call fcn.14004ec20
mov eax, dword [rbp + 0x58]
and eax, 0xffffff04
or eax, 0x104
mov dword [rbp + 0x58], eax
mov qword [rbp + 0x60], r15
mov eax, dword [r12 + r14]
cmp dword [0x1401cf0ec], eax
jle 0x1400459ac
lea rcx, [0x1401cf0ec]
call fcn.140133b58
cmp dword [0x1401cf0ec], 0xffffffff
jne 0x1400459ac
lea rcx, [0x1401727b0]
call fcn.140133edc
lea rcx, [0x1401cf0ec]
call fcn.140133af8
mov rcx, qword [0x1401c8d38]
mov rax, qword [rcx]
mov r8d, 0xffffffff
lea rdx, [rbp + 0x310]
call qword [rax + SafeArrayCopy]
mov qword [rbp + 0x50], rax
movabs rax, 0x5b5dcb5f3fddd859
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movdqa xmm0, xmmword [rbp + 0x190]
pxor xmm0, xmmword [rbp + 0xb0]
movdqa xmmword [rbp + 0x190], xmm0
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 8]
call fcn.14004f6e0
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], rax
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x130]
call fcn.14004e9e0
movsx r8d, byte [rbx + 8]
movzx ecx, byte [rbp + 0x138]
mov byte [rbx + 8], cl
mov ecx, dword [rbp + 0x138]
xor ecx, r8d
movzx r8d, cl
xor r8d, dword [rbp + 0x138]
mov rax, qword [rbx]
mov rcx, qword [rbp + 0x130]
mov qword [rbx], rcx
mov qword [rbp + 0x130], rax
mov ecx, dword [rbx + 8]
mov edx, ecx
shl edx, 0x17
sar edx, 0x1f
mov eax, r8d
xor eax, ecx
and eax, 0x100
xor eax, ecx
mov dword [rbx + 8], eax
shl edx, 8
xor edx, r8d
and edx, 0x100
xor edx, r8d
mov dword [rbp + 0x138], edx
lea rcx, [rbp + 0x130]
call fcn.14004ec20
nop
lea rcx, [rbp + 0x50]
call fcn.14004ec20
mov eax, dword [rbp + 0x70]
and eax, 0xffffff04
or eax, 0x104
mov dword [rbp + 0x70], eax
mov qword [rbp + 0x78], r15
mov eax, dword [r12 + r14]
cmp dword [0x1401cf0ec], eax
jle 0x140045b27
lea rcx, [0x1401cf0ec]
call fcn.140133b58
cmp dword [0x1401cf0ec], 0xffffffff
jne 0x140045b27
lea rcx, [0x1401727b0]
call fcn.140133edc
lea rcx, [0x1401cf0ec]
call fcn.140133af8
lea rdx, [0x1401c8d10]
cmp qword [reloc.OLEAUT32.dll_SafeArrayDestroy], 0x10
cmovae rdx, qword [0x1401c8d10]
mov rcx, qword [0x1401c8d38]
mov rax, qword [rcx]
mov r8d, dword [0x1401c8d20]
call qword [rax + SafeArrayCopy]
mov qword [rbp + 0x68], rax
movabs rax, 0x5b5dcb3236dbd859
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movdqa xmm0, xmmword [rbp + 0x1a0]
pxor xmm0, xmmword [rbp + 0xc0]
movdqa xmmword [rbp + 0x1a0], xmm0
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 8]
call fcn.14004f6e0
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x148], xmm0
mov qword [rbp + 0x158], rax
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x148]
call fcn.14004e9e0
movsx r8d, byte [rbx + 8]
movzx ecx, byte [rbp + 0x150]
mov byte [rbx + 8], cl
mov ecx, dword [rbp + 0x150]
xor ecx, r8d
movzx r8d, cl
xor r8d, dword [rbp + 0x150]
mov rax, qword [rbx]
mov rcx, qword [rbp + 0x148]
mov qword [rbx], rcx
mov qword [rbp + 0x148], rax
mov ecx, dword [rbx + 8]
mov edx, ecx
shl edx, 0x17
sar edx, 0x1f
mov eax, r8d
xor eax, ecx
and eax, 0x100
xor eax, ecx
mov dword [rbx + 8], eax
shl edx, 8
xor edx, r8d
and edx, 0x100
xor edx, r8d
mov dword [rbp + 0x150], edx
lea rcx, [rbp + 0x148]
call fcn.14004ec20
nop
lea rcx, [rbp + 0x68]
call fcn.14004ec20
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 8]
call fcn.14004fcd0
nop
call fcn.14001aa50
test al, al
je 0x140045dcd
movabs rax, 0x7867fc1f3cdadc4d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0x90e8a9be570e53e2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rdx, 0xa5a18ff187f4b383
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rcx, 0x2d272058f3f76d88
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1e0]
vmovdqa ymmword [rbp + 0xe0], ymm1
lea rcx, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 0x10
cmovae rcx, qword [rbp + 0x1b0]
lea r8, [rbp + 0xe0]
mov edx, dword [rbp + 0x1c0]
vzeroupper
call fcn.140014160
mov rdx, rax
lea rcx, [rbp + 0x200]
call fcn.140016350
movzx ebx, al
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0x10
jb 0x140045dbc
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045db6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046114
call fcn.140133ef4
nop
lea rcx, [rbp + 8]
call fcn.14004ec20
movzx eax, bl
jmp 0x1400460de
call fcn.140004040
mov r8, rax
movabs rax, 0x3e19ae3335c8d76c
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xe0], rcx
movabs rax, 0x96fda2f453034da4
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xe8], rcx
movabs rax, 0xccc0e9d1e293d6ef
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xf0], rcx
movabs rax, 0x2d272058f39308e4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs rdx, 0xa5a18ff187f4b383
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
movabs rcx, 0x2d272058f3f76d88
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1e0]
vmovdqa ymmword [rbp + 0xe0], ymm1
lea rdx, [rbp + 0xe0]
mov rcx, r8
vzeroupper
call fcn.140007aa0
nop
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0x10
jb 0x140045ef6
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045ef0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004610e
call fcn.140133ef4
nop
lea rcx, [rbp + 8]
call fcn.14004ec20
jmp 0x1400460dc
call fcn.140004040
mov r9, rax
movabs rax, 0x3e31a2192ed9d66a
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xe0], rcx
movabs rax, 0x93e2aae023171de6
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xe8], rcx
movabs rax, 0xa5a18ff187f4d7e6
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xf0], rcx
movabs rcx, 0x2d272058f3f76d88
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs rdx, 0xa5a18ff187f4b383
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
vmovdqu ymm0, ymmword [rbp + 0x1e0]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0xe0], ymm1
lea r8, [rbp + 0x200]
lea rdx, [rbp + 0xe0]
mov rcx, r9
vzeroupper
call fcn.140007aa0
jmp 0x1400460dc
call fcn.140004040
mov r8, rax
movabs rax, 0x7b24af3e32dbd548
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xe0], rcx
movabs rax, 0x8aabaef2760740a3
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xe8], rcx
movabs rax, 0xa5a18f94f395d7f3
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xf0], rcx
movabs rcx, 0x2d272058f3f76d88
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rsi, 0x5b5dcb5f57a9b929
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs rdi, 0xff8bcb86036438c6
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs rdx, 0xa5a18ff187f4b383
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
vmovdqu ymm0, ymmword [rbp + 0x1e0]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0xe0], ymm1
lea rdx, [rbp + 0xe0]
mov rcx, r8
vzeroupper
call fcn.140007aa0
xor al, al
mov rcx, qword [rbp + 0x420]
xor rcx, rsp
call fcn.1401339b0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14013d094
nop
call fcn.14013d094
int3