Function at 0x140037e90
Capabilities:
Create restart manager session
Enumerate processes that use resource
Get file size
Move file
Read file on windows
Set file attributes
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1af8]
mov eax, 0x1bf8
call fcn.1400721c0
sub rsp, rax
mov r13d, r9d
mov r14d, r8d
mov r15, rdx
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x140037edb
mov rax, qword [rdx]
mov qword [rbp - 0x60], rax
xor r12d, r12d
mov dword [rsp + 0x44], r12d
movups xmm0, xmmword [str.MySession]
movaps xmmword [rbp - 0x20], xmm0
mov eax, dword [0x1400d68c0]
mov dword [rbp - 0x10], eax
xorps xmm0, xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
mov dword [rsp + 0x68], 0xa
lea r8, [rbp - 0x20]
xor edx, edx
lea rcx, [rsp + 0x44]
call qword [sym.imp.RstrtMgr.DLL_RmStartSession]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp - 0x60]
lea edx, [r12 + 1]
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.RstrtMgr.DLL_RmRegisterResources]
mov ebx, eax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xd0]
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x68]
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.RstrtMgr.DLL_RmGetList]
mov edi, eax
xor r8d, r8d
lea edx, [r12 + 1]
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.RstrtMgr.DLL_RmShutdown]
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.RstrtMgr.DLL_RmEndSession]
mov eax, r14d
and eax, 1
mov dword [rbp - 0x70], eax
je 0x140037fb7
mov rcx, r15
cmp qword [r15 + 0x18], 8
jb 0x140037fab
mov rcx, qword [r15]
mov edx, r14d
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
mov rdi, qword [r15 + 0x10]
mov rsi, r15
cmp qword [r15 + 0x18], 8
jb 0x140037fd0
mov rsi, qword [r15]
cmp rdi, 8
jae 0x140037fe8
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x78], 7
jmp 0x14003802a
mov rbx, rdi
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x70]
call fcn.140037c60
mov qword [rsp + 0x70], rax
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.140073d70
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x80], rdi
mov r8d, 0xa
lea rdx, str..inprocess
lea rcx, [rsp + 0x70]
call fcn.140038d10
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
mov rcx, r15
cmp qword [r15 + 0x18], 8
jb 0x140038062
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x1400389bc
xor bl, bl
mov byte [rsp + 0x40], bl
xor dil, dil
mov byte [rsp + 0x48], dil
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rcx, qword [rsp + 0x70]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
mov qword [rbp - 0x60], rax
cmp rax, 0xffffffffffffffff
je 0x1400389bc
lea rdx, [rbp - 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003883a
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14003883a
cmp r13d, 2
jne 0x140038155
mov dword [rbp + 0x1b58], 1
movabs rax, 0x140000000
cmp rcx, rax
jle 0x140038110
mov dword [rbp + 0x1b58], 1
mov rax, qword [0x1401252a0]
mov r14, rcx
cmp qword [rax], rcx
cmovl r14, qword [rax]
test r14, r14
je 0x140038833
cmp r14, rcx
je 0x140038172
mov rax, r14
cqo
and edx, 0x1fff
add rax, rdx
and eax, 0x1fff
cmp rax, rdx
je 0x140038172
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140038848
mov edx, r13d
sub edx, 1
je 0x140038110
cmp edx, 1
jne 0x14003883a
mov r14, rcx
mov dword [rbp + 0x1b58], r13d
jmp 0x140038121
mov byte [rbp - 0x18], bl
lea rcx, [rbp - 0x20]
mov qword [rbp - 8], rcx
lea rax, [0x1400d5410]
mov qword [rbp - 0x20], rax
lea rax, [0x1400d53c8]
mov qword [rbp - 0x10], rax
xorps xmm0, xmm0
xor eax, eax
movaps xmmword [rbp], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rax
xor r13d, r13d
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r13
movdqa xmmword [rbp + 0x60], xmm0
mov rax, qword [rcx]
call qword [rax + VariantCopy]
cmp byte [rax + 8], bl
je 0x14003882a
mov edi, r13d
mov qword [rsp + 0x50], r13
mov ebx, r13d
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], r13
lea rcx, [rbp + 0x70]
call fcn.140044980
mov r15d, r13d
lea rax, [r15 + 0x2000]
mov rcx, r14
sub rcx, r15
mov esi, 0x2000
cmp rax, r14
cmovg rsi, rcx
mov rcx, rbx
sub rcx, rdi
cmp rsi, rcx
jae 0x14003821a
lea rbx, [rsi + rdi]
jmp 0x140038255
jbe 0x14003825a
mov rax, qword [rsp + 0x60]
sub rax, rdi
cmp rsi, rax
jbe 0x140038242
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140039040
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
jmp 0x14003825a
sub rsi, rcx
mov r8, rsi
xor edx, edx
mov rcx, rbx
call fcn.140074220
add rbx, rsi
mov qword [rsp + 0x58], rbx
mov r8d, ebx
sub r8d, edi
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x44]
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400387cb
mov esi, dword [rsp + 0x44]
mov rcx, rbx
sub rcx, rdi
cmp rsi, rcx
jae 0x140038298
lea rax, [rsi + rdi]
mov qword [rsp + 0x58], rax
jmp 0x1400382ce
jbe 0x1400382ce
mov rax, qword [rsp + 0x60]
sub rax, rdi
cmp rsi, rax
jbe 0x1400382b6
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140039040
jmp 0x1400382ce
sub rsi, rcx
mov r8, rsi
xor edx, edx
mov rcx, rbx
call fcn.140074220
add rbx, rsi
mov qword [rsp + 0x58], rbx
mov eax, dword [rsp + 0x44]
add r15, rax
mov qword [rbp + 0xc0], r15
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x70]
call fcn.140045670
test al, al
je 0x1400387c6
cmp r15, r14
sete r8b
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.140045030
test al, al
je 0x1400387c6
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov edx, dword [rsp + 0x44]
cmp r15, r14
je 0x140038331
mov rcx, rbx
sub rcx, rdi
cmp rcx, rdx
jne 0x1400387cb
neg edx
mov r9d, 1
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1400387cb
mov byte [rsp + 0x48], 1
mov r8d, ebx
sub r8d, edi
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x44]
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400387cb
mov rcx, rbx
sub rcx, rdi
mov eax, dword [rsp + 0x44]
cmp rcx, rax
jne 0x1400387cb
cmp r15, r14
jne 0x1400381f0
mov rcx, rbx
sub rcx, rdi
mov esi, 0x10000
cmp rcx, rsi
jbe 0x1400383ac
lea rbx, [rdi + 0x10000]
jmp 0x1400383e7
jae 0x1400383ec
mov rax, qword [rsp + 0x60]
sub rax, rdi
cmp rax, rsi
jae 0x1400383d4
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140039040
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
jmp 0x1400383ec
sub rsi, rcx
mov r8, rsi
xor edx, edx
mov rcx, rbx
call fcn.140074220
add rbx, rsi
mov qword [rsp + 0x58], rbx
mov rsi, qword [rbp - 0x68]
cmp r14, rsi
je 0x140038505
nop dword [rax]
mov rcx, rbx
sub rcx, rdi
lea rax, [rcx + r14]
cmp rax, rsi
jle 0x14003845d
sub rsi, r14
cmp rsi, rcx
jae 0x14003841d
lea rbx, [rsi + rdi]
jmp 0x140038458
jbe 0x14003845d
mov rax, qword [rsp + 0x60]
sub rax, rdi
cmp rsi, rax
jbe 0x140038445
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140039040
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
jmp 0x14003845d
sub rsi, rcx
mov r8, rsi
xor edx, edx
mov rcx, rbx
call fcn.140074220
add rbx, rsi
mov qword [rsp + 0x58], rbx
mov r8d, ebx
sub r8d, edi
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x44]
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400387cb
mov esi, dword [rsp + 0x44]
mov rcx, rbx
sub rcx, rdi
cmp rsi, rcx
jae 0x14003849b
lea rax, [rsi + rdi]
mov qword [rsp + 0x58], rax
jmp 0x1400384d1
jbe 0x1400384d1
mov rax, qword [rsp + 0x60]
sub rax, rdi
cmp rsi, rax
jbe 0x1400384b9
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140039040
jmp 0x1400384d1
sub rsi, rcx
mov r8, rsi
xor edx, edx
mov rcx, rbx
call fcn.140074220
add rbx, rsi
mov qword [rsp + 0x58], rbx
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x70]
call fcn.140045670
test al, al
je 0x1400387c6
mov eax, dword [rsp + 0x44]
add r14, rax
mov rsi, qword [rbp - 0x68]
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
cmp r14, rsi
jne 0x140038400
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
lea rdx, [rbp - 0x58]
call qword [rax + 0x10]
mov rsi, qword [rax]
mov qword [rbp - 0x38], rsi
mov r14, qword [rax + 8]
mov qword [rbp - 0x30], r14
mov rcx, qword [rax + 0x10]
mov qword [rbp - 0x28], rcx
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14003856f
mov rdx, qword [rbp - 0x48]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003856a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038a39
call fcn.140071ab4
cmp rsi, r14
je 0x14003878b
mov rcx, qword [rbp + 0x1b40]
add rcx, 0x50
mov r8b, 1
lea rdx, [rbp - 0x38]
call fcn.1400447f0
test al, al
je 0x140038787
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x70]
call fcn.1400456f0
mov r14, qword [rax]
mov r15, qword [rax + 8]
mov r12, qword [rax + 0x10]
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400385f4
mov rdx, qword [rbp - 0x48]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400385ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038a3f
call fcn.140071ab4
mov rsi, qword [rbp - 0x38]
cmp r14, r15
je 0x140038749
sub r15, r14
mov r8, r15
mov rdx, r14
lea rcx, [rbp + 0x98]
call fcn.140073d70
mov r13, qword [rbp - 0x30]
mov r15d, r13d
sub r15d, esi
mov dword [rsp + 0x68], r15d
mov dword [rbp + 0xbc], r15d
mov eax, dword [rbp + 0x1b58]
mov dword [rbp + 0xb8], eax
mov rcx, rbx
sub rcx, rdi
cmp rcx, 0x30
jbe 0x14003864f
lea rax, [rdi + 0x30]
mov qword [rsp + 0x58], rax
jmp 0x140038698
jae 0x140038698
mov rax, qword [rsp + 0x60]
sub rax, rdi
cmp rax, 0x30
jae 0x140038675
mov edx, 0x30
lea rcx, [rsp + 0x50]
call fcn.140039040
mov rdi, qword [rsp + 0x50]
jmp 0x140038698
mov r15d, 0x30
sub r15, rcx
mov r8, r15
xor edx, edx
mov rcx, rbx
call fcn.140074220
add rbx, r15
mov qword [rsp + 0x58], rbx
mov r15d, dword [rsp + 0x68]
movups xmm0, xmmword [rbp + 0x98]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp + 0xa8]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [rbp + 0xb8]
movups xmmword [rdi + 0x20], xmm0
mov r8b, 1
lea rdx, [rsp + 0x50]
mov rcx, qword [rbp + 0x1b40]
add rcx, 0x50
call fcn.1400447f0
mov rdi, qword [rsp + 0x50]
test al, al
je 0x140038744
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, r15d
mov rdx, rsi
mov r15, qword [rbp - 0x60]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140038744
sub r13, rsi
mov eax, dword [rsp + 0x44]
cmp r13, rax
jne 0x140038744
mov rbx, qword [rsp + 0x58]
mov r8d, ebx
sub r8d, edi
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140038744
sub rbx, rdi
mov eax, dword [rsp + 0x44]
cmp rbx, rax
mov byte [rsp + 0x40], 1
je 0x140038749
mov byte [rsp + 0x40], 0
test r14, r14
je 0x140038781
sub r12, r14
cmp r12, 0x1000
jb 0x140038776
add r12, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x140038a45
mov r14, rcx
mov rdx, r12
mov rcx, r14
call fcn.140071ab4
mov r12, qword [rbp - 0x60]
jmp 0x14003878b
mov rsi, qword [rbp - 0x38]
test rsi, rsi
je 0x1400387cb
mov rdx, qword [rbp - 0x28]
sub rdx, rsi
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400387bc
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038a45
mov rcx, rsi
call fcn.140071ab4
jmp 0x1400387cb
mov rdi, qword [rsp + 0x50]
lea rax, [0x1400d5408]
mov qword [rbp + 0x70], rax
lea rcx, [rbp + 0x70]
call fcn.140045640
test rdi, rdi
je 0x140038819
mov rdx, qword [rsp + 0x60]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x140038811
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038a4b
mov rcx, rdi
call fcn.140071ab4
movzx edi, byte [rsp + 0x48]
movzx ebx, byte [rsp + 0x40]
mov r15, qword [rbp + 0x1b48]
lea rcx, [rbp - 0x20]
call fcn.140044f80
mov r14d, dword [rbp + 0x1b50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test dil, dil
jne 0x140038870
mov rdx, r15
cmp qword [r15 + 0x18], 8
jb 0x140038855
mov rdx, qword [r15]
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x1400389bc
test bl, bl
je 0x1400389bc
mov rdx, r15
lea rcx, [rbp - 0x58]
call fcn.140038c70
mov r8d, 5
lea rdx, str..1btc
lea rcx, [rbp - 0x58]
call fcn.140038d10
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rdx, qword [rbp - 0x58]
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14003897c
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rcx, qword [rbp - 0x58]
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rbx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x140038921
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003891c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038a51
call fcn.140071ab4
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], ax
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140038974
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov r8, rcx
cmp rdx, 0x1000
jb 0x14003896f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x140038a51
call fcn.140071ab4
mov rax, rbx
jmp 0x140038a1f
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x1400389bc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400389b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038a51
call fcn.140071ab4
cmp dword [rbp - 0x70], 0
je 0x1400389db
cmp qword [r15 + 0x18], 8
jb 0x1400389cc
mov r15, qword [r15]
mov edx, dword [rbp + 0x1b50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140038a18
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038a13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038a33
call fcn.140071ab4
mov rax, 0xffffffffffffffff
add rsp, 0x1bf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140077e4c
int3
call fcn.140077e4c
int3
call fcn.140077e4c
int3
call fcn.140077e4c
int3
call fcn.140077e4c
int3
call fcn.140077e4c
int3