Function at 0x140019e90
Capabilities:
Copy file
Create directory

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xab0
lea rbp, [rsp + 0x80]
and rbp, 0xffffffffffffffc0
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0xa20], rax
mov qword [rbp + 0x30], rcx
xor r12d, r12d
mov ecx, 0x10000
mov qword [rbp + 0x18], r12
mov rsi, r8
mov qword [rbp + 0x28], r8
mov rbx, rdx
xor r13d, r13d
call fcn.1400e8c84
mov qword [rbp + 8], rax
mov rdi, rax
test rbx, rbx
je 0x14001a972
test rsi, rsi
je 0x14001a972
test rax, rax
je 0x14001a972
mov r15, 0xffffffffffffffff
cmp byte [rsi], r12b
jne 0x140019f2c
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
mov edx, 1
mov ecx, r15d
call fcn.140066570
mov rcx, rbx
call fcn.140077510
mov qword [rbp], rax
mov rsi, rax
test rax, rax
je 0x14001a966
nop dword [rax]
nop dword [rax + rax]
xor r14d, r14d
cmp dword [0x14019f120], r14d
jne 0x14001a8c0
mov rax, qword [rsi]
lea rdi, [0x14015bbf8]
test rax, rax
cmovne rdi, rax
mov rax, r15
mov qword [rbp + 0x38], rdi
nop dword [rax + rax]
inc rax
cmp byte [rdi + rax], r14b
jne 0x140019f80
test rax, rax
je 0x14001a876
mov r14, qword [rbp + 0x28]
mov rax, r15
nop dword [rax]
inc rax
cmp byte [r14 + rax], 0
jne 0x140019fa0
mov rcx, r15
nop dword [rax]
inc rcx
cmp byte [rdi + rcx], 0
jne 0x140019fb0
mov rdx, qword [0x1401d0e00]
add eax, ecx
mov rcx, r15
inc rcx
cmp byte [rdx + rcx], 0
jne 0x140019fc5
add ecx, 0x1b
add eax, ecx
mov ecx, 1
movsxd rbx, eax
mov rdx, rbx
call fcn.1400c4f6c
mov qword [rbp + 0x20], rax
mov r13, rax
test rax, rax
je 0x14001a94e
mov rax, qword [0x1401d0e00]
lea r9, [0x14015ba18]
mov qword [rsp + 0x30], rdi
mov r8, r15
mov qword [rsp + 0x28], r14
mov rdx, rbx
mov rcx, r13
mov qword [rsp + 0x20], rax
call fcn.140004fd0
test eax, eax
js 0x14001a95a
lea rcx, [rbp + 0x40]
mov r8d, 0x800
lea rdx, [rsi + 0x40]
call fcn.140135ea0
mov rax, qword [rbp + 0x58]
shr rax, 0x18
movzx eax, al
add eax, 0xfffffffc
cmp eax, 8
ja case.0x14001a05f.4
lea rbx, [0x140000000]
cdqe
mov ecx, dword [rbx + rax*4 + 0x1a9ac]
add rcx, rbx
jmp rcx
mov byte [0x1401e8f58], 2
cmp byte [rsi + 8], 0
je 0x14001a28f
cmp dword [0x1401d0cc4], 0
jne 0x14001a1fe
mov rcx, r13
call fcn.1400fc834
mov r14, rax
test rax, rax
jne 0x14001a243
lea rcx, str.Could_not_allocate_string_for_sanitized_path
call fcn.14004f2f0
mov rcx, r14
call fcn.140017cf0
mov rcx, rax
mov rbx, rax
call fcn.140104594
test rbx, rbx
je 0x14001a0bf
mov rcx, rbx
call fcn.1400e8c70
cmp dword [0x14019f5b8], 0
je 0x14001a1f6
mov rcx, rsi
call fcn.140076290
movsxd rdx, dword [0x1401d0cc0]
lea rdi, [0x140000000]
movabs rcx, 0x2b6109100
lea rsi, [rdi + 0x1d0e20]
add rax, rcx
lea rsi, [rsi + rdx*8]
imul rcx, rax, 0x989680
lea eax, [rdx + 1]
movsxd rbx, eax
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
mov dword [rsi], ecx
sar rcx, 0x20
shr rdx, 1
mov dword [rsi + 4], ecx
mov rcx, qword [rbp]
lea rax, [rdx + rdx*2]
sub rbx, rax
call fcn.140076150
movabs rcx, 0x2b6109100
add rax, rcx
imul rcx, rax, 0x989680
movsxd rax, ebx
movsxd rbx, ebx
inc rbx
lea rdi, [rdi + rax*8]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
mov dword [rdi + 0x1d0e20], ecx
lea rdi, [rdi + 0x1d0e20]
sar rcx, 0x20
shr rdx, 1
mov dword [rdi + 4], ecx
mov rcx, qword [rbp]
lea rax, [rdx + rdx*2]
sub rbx, rax
call fcn.140076010
movabs rcx, 0x2b6109100
lea r8, [0x140000000]
add rax, rcx
lea r9, [r8 + 0x1d0e20]
imul rcx, rax, 0x989680
movsxd rax, ebx
mov r8, rdi
lea r9, [r9 + rax*8]
mov dword [r9], ecx
lea eax, [rbx + 1]
movsxd r10, eax
movabs rax, 0xaaaaaaaaaaaaaaab
mul r10
sar rcx, 0x20
shr rdx, 1
mov dword [r9 + 4], ecx
mov rcx, r14
mov qword [0x1401d0e08], r9
lea rax, [rdx + rdx*2]
mov rdx, rsi
sub r10, rax
mov dword [0x1401d0cc0], r10d
call fcn.140019da0
mov rsi, qword [rbp]
mov rcx, r14
call fcn.1400e8c70
mov rcx, rsi
call fcn.140077380
mov rdx, rax
test rax, rax
je 0x14001a86b
mov rax, qword [0x1401d0e00]
mov r8, r15
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001a220
mov rcx, qword [rbp + 0x30]
add r8, r13
call fcn.140019e90
test eax, eax
jne 0x14001a95a
jmp 0x14001a86b
lea rdx, [rax + 2]
nop word [rax + rax]
mov rax, r15
inc rax
cmp byte [r14 + rax], 0
jne 0x14001a253
mov rcx, rdx
sub rcx, r14
cmp rcx, rax
jae 0x14001a09f
movzx eax, byte [rdx]
cmp al, 0x2a
je 0x14001a287
cmp al, 0x3f
je 0x14001a287
cmp al, 0x3c
je 0x14001a287
cmp al, 0x3e
je 0x14001a287
cmp al, 0x3a
je 0x14001a287
cmp al, 0x7c
jne 0x14001a28a
mov byte [rdx], 0x5f
inc rdx
jmp 0x14001a250
mov rsi, qword [rsi + 0x78]
lea rax, [rbp + 0x840]
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov r9, r13
mov r8, rdi
mov rcx, r14
call fcn.140018330
mov rcx, r13
test eax, eax
jne 0x14001a86e
mov rdx, rsi
call fcn.1400199b0
xor edi, edi
xor ebx, ebx
nop word [rax + rax]
cmp byte [rbp + rdi + 0x845], 0
je 0x14001a3b6
lea rax, [0x140000000]
cmp dword [rbx + rax + 0x19f5c0], 0
je 0x14001a3b6
mov rax, qword [rax + rdi*8 + 0x1500f8]
lea r9, str._s_syslinux__s__s
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x9a0]
lea rax, [0x140196f48]
mov r8, r15
mov qword [rsp + 0x28], rax
mov edx, 0x80
lea rax, [0x140156a6c]
mov qword [rsp + 0x20], rax
call fcn.140004fd0
lea rcx, [rbp + 0x9a0]
mov byte [rbp + 0xa1f], 0
call fcn.140017cf0
mov rcx, r13
mov r15, rax
call fcn.140017cf0
xor r8d, r8d
mov rdx, rax
mov rcx, r15
mov r14, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
test r15, r15
je 0x14001a37c
mov rcx, r15
call fcn.1400e8c70
test r14, r14
je 0x14001a389
mov rcx, r14
call fcn.1400e8c70
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r12d, r12d
jne 0x14001a3f1
call fcn.14004fba0
mov rdx, rax
lea rcx, str.__Could_not_replace_file:__s
call fcn.14004f2f0
mov r13, qword [rbp + 0x20]
mov r15, 0xffffffffffffffff
inc rdi
add rbx, 4
cmp rbx, 8
jb 0x14001a2d0
mov rcx, r13
mov ebx, 1
call fcn.1400fc834
mov r14, rax
test rax, rax
jne 0x14001a470
lea rcx, str.Could_not_allocate_string_for_sanitized_path
call fcn.14004f2f0
jmp 0x14001a4d0
lea r8, [rbp + 0x980]
mov ecx, 2
lea rdx, [rbp + 0x9a0]
call fcn.140047330
test eax, eax
je 0x14001a447
xor ebx, ebx
nop
lea rax, [0x140197810]
movsxd rdx, ebx
add rdx, rax
lea rcx, [rbp + 0x980]
mov r8d, 0x20
call fcn.1401368e0
test eax, eax
je 0x14001a442
add ebx, 0x20
cmp ebx, 0xbe0
jb 0x14001a410
xor eax, eax
jmp 0x14001a447
mov eax, 1
test eax, eax
lea rdx, [0x140158ab4]
lea rax, [0x140158ab0]
cmovne rdx, rax
lea rcx, str.__Replaced_with_local_version__s
call fcn.14004f2f0
mov r13, qword [rbp + 0x20]
jmp 0x14001a876
lea rdx, [rax + 2]
nop dword [rax]
nop dword [rax + rax]
mov rcx, r15
inc rcx
cmp byte [r14 + rcx], 0
jne 0x14001a483
mov rax, rdx
sub rax, r14
cmp rax, rcx
jae 0x14001a4bd
movzx eax, byte [rdx]
cmp al, 0x2a
je 0x14001a4b3
cmp al, 0x3f
je 0x14001a4b3
cmp al, 0x3c
je 0x14001a4b3
cmp al, 0x3e
je 0x14001a4b3
cmp al, 0x3a
je 0x14001a4b3
cmp al, 0x7c
jne 0x14001a4b8
xor ebx, ebx
mov byte [rdx], 0x5f
inc rdx
jmp 0x14001a480
test ebx, ebx
jne 0x14001a4d0
mov rdx, r14
lea rcx, str.__File_name_sanitized_to__s
call fcn.14004f2f0
mov rcx, r14
mov qword [rsp + 0x30], rsi
call fcn.140050b10
mov qword [rbp + 0x18], rax
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x14001a549
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.14004fba0
mov rdx, rax
lea rcx, str.__Unable_to_create_file:__s
call fcn.14004f2f0
lea ecx, [rbx - 5]
cmp ecx, 1
ja 0x14001a8bc
lea rdx, [r14 + 3]
test rdx, rdx
lea rcx, str._NULL_
cmovne rcx, rdx
lea rdx, str.autorun.inf
call fcn.140113550
test eax, eax
jne 0x14001a8bc
lea rcx, str.__NOTE:_This_is_usually_caused_by_a_poorly_designed_security_solution._See_https:__bit.ly_40qDtyF._r_n__This_file_will_be_skipped_for_now__but_you_should_really_look_into_using_a_SMARTER_antivirus_solution.
call fcn.14004f2f0
jmp 0x14001a6cc
cmp qword [0x1401d0e60], 0
je 0x14001a55f
lea rcx, [rbp + 0x880]
call fcn.140041a50
test rsi, rsi
jle 0x14001a66a
nop dword [rax + rax]
cmp dword [0x14019f120], 0
jne 0x14001a8bc
mov rcx, qword [rbp]
lea rax, [rsi + 0x7ff]
cqo
and edx, 0x7ff
add rax, rdx
mov rdx, qword [rbp + 8]
sar rax, 0xb
mov rdi, rax
cmp rax, 0x20
mov eax, 0x20
cmovg rdi, rax
mov r8, rdi
call fcn.140076620
mov rbx, rax
test rax, rax
js 0x14001a92b
cmp rsi, rax
cmovl ebx, esi
cmp qword [0x1401d0e60], 0
je 0x14001a5e2
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x880]
mov r8d, ebx
call fcn.140046cf0
mov rdx, qword [rbp + 8]
lea r9, [rbp + 0x10]
mov r8d, ebx
mov rcx, r12
call fcn.140050980
inc qword [0x1401954e0]
test eax, eax
je 0x14001a8a8
mov eax, dword [rbp + 0x10]
cmp eax, ebx
jne 0x14001a89f
mov r8, qword [0x1401d0e48]
sub rsi, rax
add r8, rdi
mov rax, r8
mov qword [0x1401d0e48], r8
sub rax, qword [0x1401d0dd8]
cmp rax, 0x80
jb 0x14001a661
mov r9, qword [0x1401d0e40]
mov edx, 0xc9f
mov ecx, 7
mov dword [rsp + 0x20], 0
call fcn.140066570
mov rax, qword [0x1401d0e48]
mov qword [0x1401d0dd8], rax
test rsi, rsi
jg 0x14001a570
cmp qword [0x1401d0e60], 0
je 0x14001a6cc
lea rcx, [rbp + 0x880]
call fcn.140047240
xor ebx, ebx
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rbp + rbx + 0x880]
lea rdx, str._02x
mov rcx, qword [0x1401d0e60]
call fcn.140001060
inc rbx
cmp rbx, 0x10
jb 0x14001a690
mov rcx, qword [0x1401d0e60]
lea r8, [r13 + 3]
lea rdx, str.__.__s_n
call fcn.140001060
cmp dword [0x14019f5b8], 0
je 0x14001a81b
mov rcx, qword [rbp]
call fcn.140076150
movsxd rdx, dword [0x1401d0cc0]
lea r8, [0x140000000]
movabs rcx, 0x2b6109100
lea rsi, [r8 + 0x1d0e20]
add rax, rcx
lea rsi, [rsi + rdx*8]
imul rcx, rax, 0x989680
lea eax, [rdx + 1]
movsxd rbx, eax
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
mov dword [rsi], ecx
sar rcx, 0x20
shr rdx, 1
mov dword [rsi + 4], ecx
mov rcx, qword [rbp]
lea rax, [rdx + rdx*2]
sub rbx, rax
call fcn.140076290
movabs rcx, 0x2b6109100
lea rdx, [0x140000000]
add rax, rcx
lea rdi, [rdx + 0x1d0e20]
imul rcx, rax, 0x989680
movsxd rax, ebx
lea rdi, [rdi + rax*8]
movsxd rbx, ebx
mov dword [rdi], ecx
inc rbx
sar rcx, 0x20
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
mov dword [rdi + 4], ecx
mov rcx, qword [rbp]
shr rdx, 1
lea rax, [rdx + rdx*2]
sub rbx, rax
call fcn.140076010
movabs rcx, 0x2b6109100
lea rdx, [0x140000000]
add rax, rcx
lea r9, [rdx + 0x1d0e20]
imul rcx, rax, 0x989680
movsxd rax, ebx
mov r8, rsi
lea r9, [r9 + rax*8]
mov dword [r9], ecx
lea eax, [rbx + 1]
sar rcx, 0x20
mov dword [r9 + 4], ecx
movsxd rcx, eax
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
mov qword [0x1401d0e08], r9
shr rdx, 1
lea rax, [rdx + rdx*2]
mov rdx, rdi
sub rcx, rax
mov dword [0x1401d0cc0], ecx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x14001a81b
call fcn.14004fba0
mov rdx, rax
lea rcx, str.__Could_not_set_timestamp:__s
call fcn.14004f2f0
lea rax, [r12 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14001a833
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x18], r15
inc qword [0x1401954e0]
cmp byte [rbp + 0x840], 0
jne 0x14001a84c
cmp byte [rbp + 0x841], 0
je 0x14001a863
mov r8, qword [rbp + 0x38]
lea r9, [rbp + 0x840]
mov rdx, qword [rbp + 0x28]
mov rcx, r14
call fcn.140018fe0
mov rcx, r14
call fcn.1400e8c70
mov rcx, r13
call fcn.1400e8c70
xor r13d, r13d
mov rcx, qword [rbp]
call fcn.140077510
mov qword [rbp], rax
mov rsi, rax
test rax, rax
je 0x14001a962
mov r12, qword [rbp + 0x18]
mov r15, 0xffffffffffffffff
jmp 0x140019f50
lea rax, str.Short_write_detected
jmp 0x14001a8ad
call fcn.14004fba0
mov rdx, rax
lea rcx, str.__Error_writing_file:__s
call fcn.14004f2f0
mov rsi, qword [rbp]
mov rcx, qword [rsi]
mov qword [rsi + 0x38], 0
test rcx, rcx
je 0x14001a8d5
call fcn.1400e8c70
mov rcx, qword [rsi + 0x30]
mov qword [rsi], 0
test rcx, rcx
je 0x14001a8ea
call fcn.1400e8c70
mov rcx, rsi
mov qword [rsi + 0x30], 0
call fcn.1400e8c70
lea rcx, [r12 - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14001a90e
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc qword [0x1401954e0]
mov rcx, r14
call fcn.1400e8c70
mov rcx, r13
call fcn.1400e8c70
mov rcx, qword [rbp + 8]
jmp 0x14001a975
mov rax, qword [0x1401d0e00]
cmp byte [rax + r15 + 1], 0
lea r15, [r15 + 1]
jne 0x14001a932
lea rdx, [r15 + r13]
lea rcx, str.__Error_reading_UDF_file__s
jmp 0x14001a8b7
lea rcx, str.Error_allocating_file_name
call fcn.14004f2f0
xor r14d, r14d
jmp 0x14001a8c0
mov rdi, qword [rbp + 8]
mov rcx, rdi
call fcn.1400e8c70
xor eax, eax
jmp 0x14001a97f
mov rcx, rax
call fcn.1400e8c70
mov eax, 1
mov rcx, qword [rbp + 0xa20]
xor rcx, rsp
call fcn.1400b2a30
mov rbx, qword [rsp + 0xb08]
add rsp, 0xab0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret