Function at 0x140061608
Capabilities:
Copy file
Get common file path
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov r13, rcx
call fcn.140047fa0
lea rcx, [rsp + 0x108]
mov qword [rsp + 0x60], rax
call fcn.140044ef4
lea rdx, [rsp + 0x108]
lea rcx, str._dir
mov r8d, 4
call fcn.14004b880
xor esi, esi
mov byte [rsp + 0x41], al
mov rax, qword [rsp + 0x108]
mov byte [rsp + 0x118], sil
add rax, 0xfffffffffffffffe
mov rcx, rax
mov qword [rsp + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x98]
lea edx, [rax + rax + 0x410]
mov dword [rsp + 0x50], eax
call fcn.14004bedc
mov rdi, qword [rsp + 0x98]
lea rcx, [rsp + 0x78]
lea rax, [rdi + 0x20a]
mov qword [rsp + 0xa8], rax
lea rbp, [rax + 0x12]
mov word [rbp], si
call fcn.14004be6c
lea rcx, [rsp + 0x80]
call fcn.14004be6c
lea rcx, [rsp + 0x68]
call fcn.14004be6c
lea rcx, [rsp + 0x58]
call fcn.14004be6c
lea rbx, [0x1400defc0]
lea r8d, [rsi + 6]
lea rdx, [rsp + 0x108]
lea rcx, str._base:
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x70], rsi
call fcn.14004b880
lea r15d, [rsi + 0x2c]
lea r14d, [rsi + 1]
cmp al, sil
je 0x14006175e
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x108]
mov r9d, r15d
mov rcx, r13
mov word [rsp + 0x20], si
call fcn.14003f478
mov rdx, qword [rsp + 0x68]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [rsp + 0x68]
mov byte [rsp + 0x118], r14b
mov word [rax], si
mov rax, qword [rsp + 0x108]
mov ecx, 0x2a
lea r12d, [rcx - 0x28]
cmp cx, word [rax]
jne 0x1400617b6
add rax, r12
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x108]
mov r9d, r15d
mov rcx, r13
mov word [rsp + 0x20], si
mov qword [rsp + 0x108], rax
call fcn.14003f478
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x108]
mov qword [rsp + 0x88], rax
call fcn.140044ef4
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x108]
mov r9d, r15d
mov rcx, r13
mov word [rsp + 0x20], si
call fcn.14003f478
mov r15, qword [rsp + 0x78]
lea rcx, [rsp + 0x108]
call fcn.140044ef4
mov r9, qword [rsp + 0x108]
lea rcx, [0x1400defa8]
mov rdx, r9
call fcn.140045ff4
cmp al, sil
je 0x140061914
cmp qword [0x1400f1cb8], rsi
je 0x14006208c
cmp word [r15], si
cmovne rbx, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbp, rax
cmp rax, rsi
jne 0x14006183e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
cmove eax, r14d
mov esi, eax
jmp 0x14006208c
lea rcx, [rsp + 0x118]
mov edx, 0x1032
call fcn.14004bc80
mov rcx, qword [0x1400f1cb8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x44], esi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rbx, qword [rsp + 0x118]
mov edi, r14d
lea r8, [rbx + 0x19]
mov r9d, 0x1000
mov edx, edi
mov rcx, rbp
mov byte [rbx + 0x19], sil
call qword [sym.imp.USER32.dll_LoadStringA]
cmp eax, esi
je 0x1400618da
lea rdx, str._r_n__12d_0x__7X
mov r9d, edi
mov r8d, edi
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, rbx
mov byte [rbx + 0x18], 0x3a
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [0x1400f1cb8]
movsxd rdx, r12d
sub eax, r12d
lea r9, [rsp + 0x44]
add rdx, rbx
mov r8d, eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r12d, esi
add edi, r14d
cmp edi, 0xffff
jle 0x140061874
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [0x1400f1cb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x118]
mov qword [0x1400f1cb8], rsi
call fcn.140044f24
jmp 0x14006208c
cmp word [r15], si
jne 0x140061924
mov esi, 0x80070057
jmp 0x14006208c
mov eax, 0x2d
mov r13d, esi
cmp ax, word [r9]
jne 0x140061940
add r9, r12
mov r13d, r14d
mov qword [rsp + 0x108], r9
cmp word [r9], si
je 0x14006195f
lea rcx, str.StartMenu
mov rdx, r9
call fcn.140045ff4
mov byte [rsp + 0x40], sil
cmp al, sil
je 0x140061964
mov byte [rsp + 0x40], r14b
lea rcx, str.TaskBand
mov rdx, r9
call fcn.140045ff4
mov ecx, dword [0x1400f2ca8]
mov byte [rsp + 0x42], al
test r14b, cl
jne 0x1400619a4
or ecx, r14d
mov qword [0x1400f2ca0], rsi
mov dword [0x1400f2ca8], ecx
lea rcx, [0x1400d4284]
call fcn.1400b9954
mov ecx, dword [0x1400f2ca8]
test r12b, cl
jne 0x1400619c5
or ecx, r12d
mov qword [0x1400f2c98], rsi
mov dword [0x1400f2ca8], ecx
lea rcx, [0x1400d4278]
call fcn.1400b9954
mov bl, byte [rsp + 0x118]
cmp r13d, esi
lea rax, [0x1400f2c98]
lea r14, [0x1400f2ca0]
cmovne r14, rax
cmp bl, sil
jne 0x1400619f7
mov r8d, 0x104
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, rbp
lea ecx, [rax + 1]
mov dword [rsp + 0x44], eax
movsxd r8, ecx
mov rcx, rdi
add r8, r8
call fcn.1400177f8
movabs r11, 0xa00000000
cmp qword [rsp + 0x60], r11
jb 0x140061dcd
cmp byte [rsp + 0x42], sil
je 0x140061b1e
cmp byte [rsp + 0x41], sil
jne 0x140061b1e
cmp bl, sil
jne 0x140061c19
lea rcx, str.NODELAYEXPLORER
call fcn.1400159ac
cmp eax, esi
jg 0x140061b27
lea rcx, [rsp + 0x48]
mov edx, 0x1208
call fcn.14004bedc
mov rbx, qword [rsp + 0x48]
xor r9d, r9d
lea r8d, [r9 + 0x24]
mov rdx, rbx
xor ecx, ecx
mov word [rbx], si
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, str.Explorer.exe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
jne 0x140061b0d
mov word [rbx], si
mov rcx, qword [0x1400f1ca0]
mov r9d, 0x1207
mov r8, rbx
mov edx, 0x2728
call fcn.140045194
cmp word [rbx], si
je 0x140061b0d
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x118]
mov rdx, rbx
mov r8, rcx
mov qword [rsp + 0x28], rsi
mov word [rsp + 0x118], si
mov dword [rsp + 0x20], esi
call fcn.14000a168
lea rcx, [rsp + 0x48]
mov esi, eax
call fcn.140044f24
jmp 0x14006208c
lea rcx, [rsp + 0x48]
call fcn.140044f24
mov bl, byte [rsp + 0x118]
cmp bl, sil
jne 0x140061c19
xor edx, edx
mov rcx, rbp
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp rax, rsi
je 0x140061c19
add rax, r12
je 0x140061c19
lea rdx, [0x1400def18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x140061c19
lea rdx, str.__hide__
lea rcx, [rdi + 0x20a]
mov r8d, 0x12
call fcn.1400177f8
movsxd rbx, dword [rsp + 0x44]
lea rdx, str..DirExplorer.exe
lea rax, [rbx + rbx]
mov r8d, 0x24
lea rcx, [rax + rbp]
mov qword [rsp + 0x60], rax
call fcn.1400177f8
lea eax, [rbx + 0x11]
mov rcx, rbp
mov dword [rsp + 0x118], eax
call fcn.1400b8b5c
lea rcx, [0x1400f2c58]
cmp eax, esi
mov ebx, esi
sete bl
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, ebx
neg r11d
lea rax, str.GlobalPECMD:main:lock:PINT:FILE
lea rcx, [rsp + 0x90]
sbb rdx, rdx
and rdx, rax
call fcn.140011e0c
cmp ebx, esi
je 0x140061e7b
lea rcx, str.NOTMPEXPLORER
call fcn.1400159ac
cmp eax, esi
jle 0x140061e06
lea rcx, [rsp + 0x90]
call fcn.140011e30
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [rsp + 0x40], sil
je 0x140061f1f
cmp qword [r14], rsi
jne 0x140061dcd
lea rax, str..FromStartMenu
lea rdx, str..ToStartMenu
cmp r13d, esi
cmovne rdx, rax
movsxd rax, dword [rsp + 0x44]
lea rcx, [rbp + rax*2]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x60]
mov edx, 0x400
mov qword [rsp + 0x48], rsi
call fcn.14004bedc
mov rbp, qword [rsp + 0x60]
mov rdx, qword [rsp + 0xa8]
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 0x80
lea rdi, [rbp + 2]
lea rcx, [rsp + 0x48]
mov r9d, 7
mov word [rdi], si
mov r8d, 0x80000000
add rdx, 0x12
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rsi
mov word [rbp], si
call fcn.1400034e0
mov rbx, qword [rsp + 0x48]
lea r9, [rsp + 0x118]
mov rcx, rbx
mov r8d, 0x7fe
mov rdx, rbp
mov dword [rsp + 0x118], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11d, dword [rsp + 0x118]
mov eax, 0x3ff
shr r11d, 1
cmp r11d, eax
cmova r11d, eax
mov dword [rsp + 0x118], r11d
movsxd rax, r11d
mov word [rbp + rax*2], si
mov eax, 0xfeff
cmp ax, word [rbp]
cmove rbp, rdi
cmp word [rbp], si
jne 0x140061da4
lea rax, str.WIN10FromStartMenu
lea r8, str.WIN10ToStartMenu
cmp r13d, esi
cmovne r8, rax
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREPELOGONUSRCFG
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x44], 1
mov word [rbp], si
mov dword [rsp + 0x50], 0x7fc
call fcn.140045db0
cmp eax, esi
je 0x140061d73
mov word [rbp], si
mov word [rbp + 0x7fc], si
cmp word [rbp], si
jne 0x140061da4
mov rcx, qword [0x1400f1ca0]
mov eax, r13d
mov r9d, 0x3fe
neg eax
mov r8, rbp
sbb edx, edx
neg edx
add edx, 0x1505
call fcn.140045194
mov rdx, rbp
mov rcx, r14
call fcn.1400589a0
lea rcx, [rsp + 0x60]
call fcn.140044f24
cmp rbx, rsi
je 0x140061dcd
cmp rbx, 0xffffffffffffffff
je 0x140061dcd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rsp + 0x40], sil
je 0x140061f1f
mov rdx, qword [r14]
lea ebx, [r13 + 0x1505]
cmp rdx, rsi
je 0x140061f89
cmp word [rdx], si
je 0x140061f89
lea rcx, [rsp + 0x58]
call fcn.140058a38
mov rbx, qword [rax]
jmp 0x140061fec
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rsi
call fcn.1400036f4
movsxd rbx, eax
cmp ebx, esi
jle 0x140061e71
mov rcx, qword [rsp + 0x48]
cmp word [rcx], si
je 0x140061e71
lea rcx, [rcx + rbx*2]
lea rdx, [0x1400def18]
mov r8d, 0x1a
call fcn.1400177f8
mov rdx, qword [rsp + 0x48]
mov r8d, 1
mov rcx, rdi
add ebx, 0xc
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rdx, qword [rsp + 0x48]
lea r11d, [rbx + 1]
movsxd r8, r11d
mov rcx, rbp
add r8, r8
call fcn.1400177f8
mov dword [rsp + 0x118], ebx
lea rcx, [rsp + 0x48]
call fcn.140044f24
movsxd rax, dword [rsp + 0x118]
lea rdx, str.__PINT__dir__base:__
mov r8d, 0x2a
lea rbx, [rbp + rax*2]
mov rcx, rbx
call fcn.1400177f8
mov rbp, qword [rsp + 0x60]
lea rcx, [rbx + 0x28]
mov r8, rbp
mov rdx, rdi
call fcn.1400177b0
mov rdx, qword [rsp + 0xa0]
mov eax, 0x22
mov word [rbx + rbp + 0x28], ax
mov eax, dword [rsp + 0x50]
lea rcx, [rbx + rbp + 0x2a]
inc eax
movsxd r8, eax
add r8, r8
call fcn.1400177f8
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x118]
lea rdx, [rdi + 0x20a]
mov r8, rcx
mov qword [rsp + 0x28], rsi
mov word [rsp + 0x118], si
mov dword [rsp + 0x20], 1
call fcn.14000a168
lea rcx, [rsp + 0x90]
jmp 0x140062078
mov r9, qword [rsp + 0x108]
mov eax, 0x23
cmp ax, word [r9]
jne 0x140061f6e
or dword [rsp + 0x118], 0xffffffff
add r9, r12
lea r8d, [rax + 9]
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x108]
mov qword [rsp + 0x108], r9
call fcn.14004f968
mov ebx, dword [rsp + 0x118]
cmp ebx, esi
jge 0x140061f89
jmp 0x14006191a
lea rcx, str.TaskBand
mov rdx, r9
call fcn.140045ff4
cmp al, sil
je 0x140061fda
lea ebx, [r13 + 0x150a]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
cmp rax, rsi
jne 0x140061fa9
mov esi, 1
jmp 0x14006208c
lea rcx, [rsp + 0x58]
mov edx, 0x1001
call fcn.14004bf70
mov r8, qword [rsp + 0x58]
mov r9d, 0x1000
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov rbx, qword [rsp + 0x58]
cmp word [rbx], si
jne 0x140061fec
jmp 0x140061f9f
lea rcx, [rsp + 0x58]
mov rdx, r9
call fcn.140058a38
mov rbx, qword [rsp + 0x58]
cmp word [r15], si
je 0x14006191a
mov rcx, r15
call fcn.140015cb4
mov rcx, rax
mov rdi, rax
call fcn.1400b8b5c
cmp eax, esi
jne 0x140062012
mov esi, r12d
jmp 0x14006208c
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x80]
mov rcx, rdi
call fcn.1400a6f3c
mov r11, qword [rsp + 0x70]
cmp r11, rsi
je 0x140061f9f
lea rcx, [0x1400f2c58]
mov word [r11 - 2], si
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, str.GlobalPECMD:main:lock:PINT
lea rcx, [rsp + 0xb0]
call fcn.140011e0c
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x80]
mov r8, rbx
call fcn.140007544
lea rcx, [rsp + 0xb0]
mov esi, eax
call fcn.140011e30
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x58]
call fcn.140044f24
lea rcx, [rsp + 0x68]
call fcn.140044f24
lea rcx, [rsp + 0x80]
call fcn.140044f24
lea rcx, [rsp + 0x78]
call fcn.140044f24
lea rcx, [rsp + 0x98]
call fcn.140044f24
mov rbx, qword [rsp + 0x110]
mov eax, esi
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret