Function at 0x140003400
Capabilities:
Copy file
Get file attributes
Hash data using djb2
Set file attributes
Timestomp file

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x418]
sub rsp, 0x518
xor esi, esi
xorps xmm0, xmm0
mov qword [rbp - 0x70], rsi
mov r14, rdx
mov r15, rcx
movups xmmword [rcx], xmm0
lea rdi, [rsi - 1]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
test r9, r9
je 0x140003e5c
mov r12, qword [rbp + 0x480]
sub r8, rdx
mov qword [rbp + 0x470], r8
lea rax, [r8 + 4]
mov qword [rbp - 0x48], rax
movsxd rcx, dword [r14]
lea r10, [r12 + 0x10]
mov eax, esi
sub eax, ecx
neg eax
lea rdi, [r14 + rcx]
movsxd rcx, dword [r8 + r14]
sbb rax, rax
and rdi, rax
lea rax, [r8 + r14]
mov r8d, 0x1505
lea r13, [rax + rcx]
mov eax, esi
sub eax, ecx
movzx edx, byte [rdi]
lea r14, [rdi + 1]
neg eax
mov r9, r14
sbb rax, rax
and r13, rax
mov qword [rsp + 0x60], r13
test edx, edx
je 0x1400034e0
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx - 0x41]
cmp eax, 0x1a
lea ecx, [rdx + 0x20]
lea r9, [r9 + 1]
cmovb edx, ecx
imul r8d, r8d, 0x21
add r8d, edx
movzx edx, byte [r9 - 1]
test edx, edx
jne 0x1400034c0
test r8d, r8d
mov esi, 1
mov rcx, r10
cmovne esi, r8d
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [r12 + 0x28]
test eax, eax
je 0x140003564
mov r15, qword [r12 + 0x18]
mov r13, qword [r12 + 0x20]
lea r12d, [rax - 1]
mov ebx, r12d
and ebx, esi
mov ecx, ebx
mov eax, dword [r15 + rbx*4]
test eax, eax
je 0x140003551
nop dword [rax + rax]
cmp esi, eax
jne 0x140003542
mov rcx, qword [r13 + rcx*8]
cmp rcx, rdi
je 0x14000374a
mov rdx, rdi
call fcn.140007fb0
test eax, eax
je 0x14000374a
inc ebx
and ebx, r12d
mov ecx, ebx
mov eax, dword [r15 + rbx*4]
test eax, eax
jne 0x140003520
mov r12, qword [rbp + 0x480]
mov r15, qword [rbp + 0x460]
mov r13, qword [rsp + 0x60]
lea rcx, [r12 + 0x10]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
movzx edx, byte [rdi]
mov r8d, 0x1505
test edx, edx
je 0x1400035a0
nop dword [rax]
lea eax, [rdx - 0x41]
cmp eax, 0x1a
lea ecx, [rdx + 0x20]
lea r14, [r14 + 1]
cmovb edx, ecx
imul r8d, r8d, 0x21
add r8d, edx
movzx edx, byte [r14 - 1]
test edx, edx
jne 0x140003580
test r8d, r8d
lea rcx, [rbp - 0x38]
mov r9d, 1
mov rdx, r12
cmovne r9d, r8d
mov r8, rdi
call fcn.140049670
mov esi, dword [rbp - 0x38]
test sil, 1
je 0x140003e34
mov eax, esi
shr eax, 3
test al, 1
jne 0x140003e2b
movzx edx, byte [r13]
lea rbx, [r13 + 1]
mov r8d, 0x1505
mov r9, rbx
test edx, edx
je 0x140003610
nop dword [rax]
lea eax, [rdx - 0x41]
cmp eax, 0x1a
lea ecx, [rdx + 0x20]
lea r9, [r9 + 1]
cmovb edx, ecx
imul r8d, r8d, 0x21
add r8d, edx
movzx edx, byte [r9 - 1]
test edx, edx
jne 0x1400035f0
test r8d, r8d
lea rcx, [rbp - 0x20]
mov r9d, 1
mov rdx, r12
cmovne r9d, r8d
mov r8, r13
call fcn.140049670
mov ecx, dword [rbp - 0x20]
test cl, 1
je 0x14000364d
mov eax, ecx
shr eax, 3
test al, 1
jne 0x140003959
shr ecx, 5
test cl, 1
jne 0x140003933
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.140013ff0
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.140014240
mov rdx, r13
lea rcx, [rsp + 0x40]
call fcn.140013ff0
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140014240
xor edi, edi
mov dword [rsp + 0x28], 0x800
cmp qword [rsp + 0x58], 8
lea rax, [rbp - 0x78]
lea rdx, [rsp + 0x40]
mov dword [rbp - 0x78], edi
cmovae rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
mov qword [rsp + 0x20], rax
cmovae rcx, qword [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
jne 0x1400036cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r15], eax
mov rax, qword [rbp - 0x48]
mov rdx, r13
mov r14, qword [rbp + 0x468]
mov rcx, r12
mov r8d, dword [rax + r14]
call fcn.1400495f0
cmp dword [r15], edi
jne 0x140003ce6
mov eax, esi
shr eax, 4
test al, 1
jne 0x14000386c
cmp qword [rsp + 0x58], 8
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
mov edx, 0x100
cmovae rcx, qword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000378a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r15], eax
jmp 0x1400037bc
mov r12, qword [rbp + 0x480]
cmp ebx, 0xffffffff
je 0x140003558
mov r15, qword [rbp + 0x460]
mov r13, qword [rsp + 0x60]
movsxd rax, ebx
lea rcx, [rax + rax*2]
mov rax, qword [r12 + 0x40]
lea rdx, [rax + rcx*8]
test rdx, rdx
je 0x140003564
mov dword [rdx], 0x40000000
jmp 0x140003564
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea r9, [rbp - 0x40]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x1400037b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r15], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [r15], 0
jne 0x140003b9d
shr esi, 5
test sil, 1
je 0x14000380a
cmp qword [rsp + 0x58], 8
lea rcx, [rsp + 0x40]
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp qword [rsp + 0x58], 8
lea rcx, [rsp + 0x40]
cmovae rcx, qword [rsp + 0x40]
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140003982
movzx edx, byte [r13]
mov r8d, 0x1505
test edx, edx
je 0x14000383f
nop dword [rax]
lea eax, [rdx - 0x41]
cmp eax, 0x1a
lea ecx, [rdx + 0x20]
lea rbx, [rbx + 1]
cmovb edx, ecx
imul r8d, r8d, 0x21
add r8d, edx
movzx edx, byte [rbx - 1]
test edx, edx
jne 0x140003820
test r8d, r8d
lea rcx, [rbp - 8]
mov r9d, 1
mov rdx, r12
cmovne r9d, r8d
mov r8, r13
call fcn.140049670
mov r9, qword [rbp]
mov rax, qword [rbp - 0x30]
cmp r9, rax
jne 0x140003ad8
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400038ae
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400038a9
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003eed
mov rcx, r8
call fcn.14004c810
mov rdx, qword [rbp - 0x80]
xor esi, esi
mov word [rsp + 0x40], si
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rsi
cmp rdx, 8
jb 0x140003904
mov rcx, qword [rsp + 0x68]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400038ff
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003eed
mov rcx, r8
call fcn.14004c810
mov r10, qword [rbp - 0x70]
add r14, 8
inc r10
mov qword [rbp + 0x468], r14
mov qword [rbp - 0x70], r10
cmp r10, qword [rbp + 0x478]
jae 0x140003e55
mov r8, qword [rbp + 0x470]
jmp 0x14000346a
mov rdi, 0xffffffffffffffff
lea r8, str.The_target_path_already_exists_and_is_read_only.
mov edx, 0x400
mov dword [r15], edi
lea rcx, [rbp + 0x10]
call fcn.1400033a0
xor esi, esi
jmp 0x140003e5c
mov rdi, 0xffffffffffffffff
lea r8, str.The_target_path__s_already_exists_as_a_directory.
mov r9, r13
mov dword [r15], edi
mov edx, 0x400
lea rcx, [rbp + 0x10]
call fcn.1400033a0
xor esi, esi
jmp 0x140003e5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
lea rcx, [rbp + 0x460]
mov r9d, 0x400
mov dword [r15], eax
mov qword [rsp + 0x30], rsi
mov r8d, eax
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rcx
mov ecx, 0x1300
mov qword [rbp + 0x460], rsi
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rdx, qword [rbp + 0x460]
lea rcx, [rbp - 0x68]
call fcn.140014150
cmp qword [rax + 0x18], 0x10
jb 0x1400039d9
mov rax, qword [rax]
mov r9, rax
lea r8, str.Clearing_the_readonly_flag_on_the_file_failed:__s
mov edx, 0x400
lea rcx, [rbp + 0x10]
call fcn.1400033a0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140003a2c
mov rcx, qword [rbp - 0x68]
inc rdx
cmp rdx, 0x1000
jb 0x140003a27
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003ee7
mov rcx, r8
call fcn.14004c810
mov rcx, qword [rbp + 0x460]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140003a7b
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003a76
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003ee1
mov rcx, r8
call fcn.14004c810
mov rdx, qword [rbp - 0x80]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
cmp rdx, 8
jb 0x140003e55
mov rcx, qword [rsp + 0x68]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003ace
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003ee1
mov rcx, r8
call fcn.14004c810
jmp 0x140003e55
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
lea r8, str.The_copied_file_is__llu_bytes__but_the_source_file_was__llu_bytes.
mov dword [r15], edi
mov edx, 0x400
lea rcx, [rbp + 0x10]
call fcn.1400033a0
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140003b3e
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003b39
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003eed
mov rcx, r8
call fcn.14004c810
mov rdx, qword [rbp - 0x80]
xor esi, esi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
cmp rdx, 8
jb 0x140003e5c
mov rcx, qword [rsp + 0x68]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003b93
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003eed
mov rcx, r8
call fcn.14004c810
jmp 0x140003e5c
mov r8d, dword [r15]
lea rax, [rbp + 0x460]
xor esi, esi
mov r9d, 0x400
mov qword [rsp + 0x30], rsi
xor edx, edx
mov dword [rsp + 0x28], esi
mov ecx, 0x1300
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x460], rsi
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rdx, qword [rbp + 0x460]
lea rcx, [rbp - 0x68]
call fcn.140014150
cmp qword [rax + 0x18], 0x10
jb 0x140003beb
mov rax, qword [rax]
mov r9, rax
lea r8, str.Updating_the_timestamp_on_the_file_failed:__s
mov edx, 0x400
lea rcx, [rbp + 0x10]
call fcn.1400033a0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140003c3e
mov rcx, qword [rbp - 0x68]
inc rdx
cmp rdx, 0x1000
jb 0x140003c39
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003ef3
mov rcx, r8
call fcn.14004c810
mov rcx, qword [rbp + 0x460]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140003c8d
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003c88
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003ed5
mov rcx, r8
call fcn.14004c810
mov rdx, qword [rbp - 0x80]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
cmp rdx, 8
jb 0x140003e55
mov rcx, qword [rsp + 0x68]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003ace
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003ed5
jmp 0x140003acb
mov r8d, dword [r15]
lea rax, [rbp + 0x460]
xor esi, esi
mov r9d, 0x400
mov qword [rsp + 0x30], rsi
xor edx, edx
mov dword [rsp + 0x28], esi
mov ecx, 0x1300
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x460], rsi
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rdx, qword [rbp + 0x460]
lea rcx, [rbp - 0x68]
call fcn.140014150
cmp qword [rax + 0x18], 0x10
jb 0x140003d34
mov rax, qword [rax]
mov r9, rax
lea r8, str.Copying_the_file_failed:__s
mov edx, 0x400
lea rcx, [rbp + 0x10]
call fcn.1400033a0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140003d87
mov rcx, qword [rbp - 0x68]
inc rdx
cmp rdx, 0x1000
jb 0x140003d82
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003ecf
mov rcx, r8
call fcn.14004c810
mov rcx, qword [rbp + 0x460]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140003dd6
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003dd1
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003edb
mov rcx, r8
call fcn.14004c810
mov rdx, qword [rbp - 0x80]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
cmp rdx, 8
jb 0x140003e55
mov rcx, qword [rsp + 0x68]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003ace
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003edb
jmp 0x140003acb
lea r8, str.The_source_path__s_is_a_directory__which_is_not_supported.
jmp 0x140003e3b
lea r8, str.The_source_path__s_does_not_exist.
mov r9, rdi
mov dword [r15], 0xffffffff
mov edx, 0x400
lea rcx, [rbp + 0x10]
call fcn.1400033a0
xor esi, esi
mov rdi, 0xffffffffffffffff
cmp dword [r15], 0
je 0x140003eb8
mov ebx, 0x2800
mov dword [r15 + 0x20], esi
mov qword [r15 + 0x18], rbx
lea ecx, [rbx + 8]
call fcn.140057c1c
mov rcx, qword [rbp + 0x488]
mov qword [rax], rbx
lock xadd qword [rcx], rbx
add rax, 8
mov qword [r15 + 0x10], rax
mov byte [rax], 0
lea rax, [rbp + 0x10]
mov qword [r15 + 0x28], rcx
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140003ea0
mov r8, rdi
lea rdx, [rbp + 0x10]
mov rcx, r15
call fcn.140025b90
mov rax, r15
add rsp, 0x518
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400561ac
int3
call fcn.1400561ac
int3
call fcn.1400561ac
int3
call fcn.1400561ac
int3
call fcn.1400561ac
int3
call fcn.1400561ac
int3
call fcn.1400561ac
int3