Function at 0x14000dc84
Capabilities:
Copy file
Delete file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5b8]
sub rsp, 0x6b8
mov rax, qword [0x1400a3ac8]
xor rax, rsp
mov qword [rbp + 0x5a0], rax
xor ebx, ebx
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x48], rbx
mov r12d, ebx
mov rsi, r8
mov qword [rsp + 0x60], r8
mov r15, rdx
mov qword [rsp + 0x68], rdx
mov r13, rcx
mov rcx, qword [str._0_n_]
lea rax, str._0_n_
cmp rcx, rax
je 0x14000dd05
test byte [rcx + 0x1c], 4
je 0x14000dd05
cmp byte [rcx + 0x19], 5
jb 0x14000dd05
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x7d]
lea r8, [0x140092d00]
call fcn.14000459c
mov edi, dword [rbp + 0x620]
test edi, edi
jne 0x14000dd17
lea eax, [rdi + 0x57]
jmp 0x14000e47f
mov dword [rsp + 0x28], ebx
mov edx, 0x80000000
mov r8d, 1
mov dword [rsp + 0x20], 3
mov rcx, r13
call fcn.14006c054
mov qword [rsp + 0x50], rax
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14000dd9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [str._0_n_]
lea rax, str._0_n_
cmp rcx, rax
je 0x14000e47d
test byte [rcx + 0x1c], 4
je 0x14000e47d
cmp byte [rcx + 0x19], 2
jb 0x14000e47d
mov rcx, qword [rcx + 0x10]
lea edx, [r14 + 0x7f]
mov r9, r13
mov dword [rsp + 0x20], ebx
lea r8, [0x140092d00]
call fcn.14000c804
jmp 0x14000e47d
lea r9, [rbp + 0x390]
xor r8d, r8d
call fcn.1400072d0
xor r8d, r8d
mov ebx, eax
test eax, eax
je 0x14000ddff
mov rcx, qword [str._0_n_]
lea rax, str._0_n_
cmp rcx, rax
je 0x14000e463
test byte [rcx + 0x1c], 4
je 0x14000e463
cmp byte [rcx + 0x19], 2
jb 0x14000e463
mov rcx, qword [rcx + 0x10]
lea edx, [r8 + 0x7f]
lea r8, [0x140092d00]
mov r9d, ebx
call fcn.140004900
mov r15, r12
jmp 0x14000e466
mov eax, 8
mul rdi
mov rdi, rax
test rdx, rdx
jne 0x14000e33b
mov rcx, rax
call fcn.14006a264
mov qword [rsp + 0x48], rax
mov rbx, rax
test rax, rax
jne 0x14000de6a
lea ebx, [rax + 8]
mov rcx, qword [str._0_n_]
lea rax, str._0_n_
cmp rcx, rax
je 0x14000de60
test byte [rcx + 0x1c], 4
je 0x14000de60
cmp byte [rcx + 0x19], 2
jb 0x14000de60
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x79]
mov r9d, edi
lea r8, [0x140092d00]
call fcn.140004900
mov r15, qword [rsp + 0x48]
jmp 0x14000e466
mov r8, rdi
xor edx, edx
mov rcx, rbx
call sub.msvcrt.dll_memset
mov rcx, qword [rsi]
call fcn.14006bd20
xor edi, edi
mov r14, rax
test rax, rax
jne 0x14000decb
lea ebx, [rax + 8]
mov rcx, qword [str._0_n_]
lea rax, str._0_n_
cmp rcx, rax
je 0x14000dec1
test byte [rcx + 0x1c], 4
je 0x14000dec1
cmp byte [rcx + 0x19], 2
jb 0x14000dec1
mov r9, qword [rsi]
lea edx, [rbx + 0x7a]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140092d00]
call fcn.140004764
mov r15, qword [rsp + 0x48]
jmp 0x14000e109
mov eax, edi
mov dword [rsp + 0x40], eax
cmp dword [rbp + 0x620], edi
jbe 0x14000dfec
mov r15, qword [rsp + 0x58]
mov r12, rbx
sub r12, r15
mov edx, 0x3b
mov rcx, r14
mov edi, eax
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
xor ebx, ebx
mov rsi, rax
test rax, rax
je 0x14000df0b
mov word [rax], bx
call fcn.14005266c
mov qword [r12 + r15], rax
test rax, rax
je 0x14000e222
mov rdx, qword [r15]
lea r9, [rbp + 0x180]
mov r8, rax
call fcn.1400086f8
mov ebx, eax
test eax, eax
jne 0x14000e1ed
lea rax, [rbp + 0x180]
mov edx, 0x104
lea r9, [rbp + 0x390]
mov qword [rsp + 0x20], rax
lea r8, [0x140092720]
lea rcx, [rsp + 0x70]
call fcn.140004520
mov r9d, eax
test eax, eax
js 0x14000e195
lea r8d, [rbx + 1]
mov rcx, r13
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop dword [rax + rax]
test eax, eax
je 0x14000e0a1
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x70]
mov r8, r14
call fcn.140005798
mov ebx, eax
test eax, eax
jne 0x14000e060
xor edi, edi
lea r14, [rsi + 2]
test rsi, rsi
jne 0x14000dfb7
mov r14d, edi
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax + rax]
mov eax, dword [rsp + 0x40]
add r15, 8
inc eax
mov dword [rsp + 0x40], eax
cmp eax, dword [rbp + 0x620]
jb 0x14000dee8
mov r15, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test eax, eax
jne 0x14000e268
mov rax, qword [str._0_n_]
lea rsi, str._0_n_
cmp rax, rsi
je 0x14000e26f
test byte [rax + 0x1c], 4
je 0x14000e26f
cmp byte [rax + 0x19], 3
jb 0x14000e26f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [str._0_n_]
lea r8, [0x140092d00]
mov edx, 0x88
mov r9d, eax
mov rcx, qword [rcx + 0x10]
call fcn.140004900
jmp 0x14000e26f
mov rcx, qword [str._0_n_]
lea rax, str._0_n_
cmp rcx, rax
je 0x14000e097
test byte [rcx + 0x1c], 4
je 0x14000e097
cmp byte [rcx + 0x19], 2
jb 0x14000e097
mov edx, 0x87
mov rcx, qword [rcx + 0x10]
lea r8, [0x140092d00]
mov r9d, ebx
call fcn.140004900
mov r12d, dword [rsp + 0x40]
jmp 0x14000dec1
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [str._0_n_]
lea rsi, str._0_n_
cmp rcx, rsi
je 0x14000e0e6
test byte [rcx + 0x1c], 4
je 0x14000e0e6
cmp byte [rcx + 0x19], 2
jb 0x14000e0e6
mov edx, 0x86
mov r9d, eax
mov rcx, qword [rcx + 0x10]
lea r8, [0x140092d00]
call fcn.140004900
mov r14, qword [rsp + 0x50]
mov r12d, dword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
mov edi, r12d
test ebx, ebx
je 0x14000e45b
test r15, r15
je 0x14000e45b
mov r14, qword [rsp + 0x58]
lea eax, [r12 - 1]
mov rsi, r15
mov r13b, 4
sub rsi, r14
lea r15, str._0_n_
cmp r12d, dword [rbp + 0x620]
cmovne eax, edi
lea edi, [rax + 1]
mov r8, qword [r14 + rsi]
test r8, r8
je 0x14000e443
mov rdx, qword [r14]
lea r9, [rbp + 0x180]
call fcn.1400086f8
test eax, eax
je 0x14000e38d
mov rcx, qword [str._0_n_]
cmp rcx, r15
je 0x14000e443
test byte [rcx + 0x1c], r13b
je 0x14000e443
cmp byte [rcx + 0x19], 3
jb 0x14000e443
mov rcx, qword [rcx + 0x10]
lea r8, [0x140092d00]
mov edx, 0x8b
mov r9d, eax
call fcn.140004900
jmp 0x14000e443
and eax, 0x1fff0000
movzx ebx, r9w
cmp eax, 0x70000
je 0x14000e1a8
mov ebx, r9d
mov rcx, qword [str._0_n_]
lea rax, str._0_n_
cmp rcx, rax
je 0x14000e0e6
test byte [rcx + 0x1c], 4
je 0x14000e0e6
cmp byte [rcx + 0x19], 2
jb 0x14000e0e6
mov rcx, qword [rcx + 0x10]
lea r8, [0x140092d00]
mov edx, 0x85
call fcn.1400045c8
jmp 0x14000e0e6
mov rcx, qword [str._0_n_]
lea rax, str._0_n_
cmp rcx, rax
je 0x14000e097
test byte [rcx + 0x1c], 4
je 0x14000e097
cmp byte [rcx + 0x19], 2
jb 0x14000e097
mov edx, 0x84
jmp 0x14000e084
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [str._0_n_]
lea rax, str._0_n_
cmp rcx, rax
je 0x14000e0e6
test byte [rcx + 0x1c], 4
je 0x14000e0e6
cmp byte [rcx + 0x19], 2
jb 0x14000e0e6
mov edx, 0x83
mov r9d, ebx
jmp 0x14000e0d6
lea rsi, str._0_n_
or r14, 0xffffffffffffffff
mov rcx, r13
mov qword [rsp + 0x50], r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x14000e2de
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [str._0_n_]
cmp rcx, rsi
je 0x14000e0eb
test byte [rcx + 0x1c], 4
je 0x14000e0eb
cmp byte [rcx + 0x19], 2
jb 0x14000e0eb
mov rcx, qword [rcx + 0x10]
lea r8, [0x140092d00]
mov edx, 0x89
mov dword [rsp + 0x20], eax
mov r9, r13
call fcn.14000c804
jmp 0x14000e0eb
mov r9d, dword [rbp + 0x620]
mov rdx, rbx
mov r8, qword [rsp + 0x58]
mov rcx, r15
call fcn.140059574
mov ebx, eax
test eax, eax
je 0x14000e0eb
mov rcx, qword [str._0_n_]
cmp rcx, rsi
je 0x14000e32f
test byte [rcx + 0x1c], 4
je 0x14000e32f
cmp byte [rcx + 0x19], 3
jb 0x14000e32f
mov rcx, qword [rcx + 0x10]
lea r8, [0x140092d00]
mov edx, 0x8a
mov r9d, eax
call fcn.140004900
mov r15, qword [rsp + 0x48]
mov ebx, edi
jmp 0x14000e475
mov esi, 0x80070216
mov ebx, 0x216
mov rcx, qword [str._0_n_]
lea rax, str._0_n_
cmp rcx, rax
je 0x14000e0f0
test byte [rcx + 0x1c], 4
je 0x14000e0f0
cmp byte [rcx + 0x19], 2
jb 0x14000e0f0
mov rcx, qword [rcx + 0x10]
lea r8, [0x140092d00]
mov edx, 0x80
mov r9d, esi
call fcn.1400045c8
jmp 0x14000e0f0
lea rax, [rbp + 0x180]
mov edx, 0x104
lea r9, [rbp + 0x390]
mov qword [rsp + 0x20], rax
lea r8, [0x140092720]
lea rcx, [rsp + 0x70]
call fcn.140004520
test eax, eax
jns 0x14000e3ec
mov rcx, qword [str._0_n_]
cmp rcx, r15
je 0x14000e443
test byte [rcx + 0x1c], r13b
je 0x14000e443
cmp byte [rcx + 0x19], 3
jb 0x14000e443
mov rcx, qword [rcx + 0x10]
lea r8, [0x140092d00]
mov edx, 0x8c
mov r9d, eax
call fcn.1400045c8
jmp 0x14000e443
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x14000e443
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [str._0_n_]
cmp rcx, r15
je 0x14000e443
test byte [rcx + 0x1c], r13b
je 0x14000e443
cmp byte [rcx + 0x19], 3
jb 0x14000e443
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x70]
mov edx, 0x8d
mov dword [rsp + 0x20], eax
lea r8, [0x140092d00]
call fcn.14000c804
add r14, 8
sub rdi, 1
jne 0x14000e130
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x48]
cmp r14, 0xffffffffffffffff
je 0x14000e475
jmp 0x14000e466
mov r15, r8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, r15
call fcn.14006a328
mov eax, ebx
mov rcx, qword [rbp + 0x5a0]
xor rcx, rsp
call fcn.140001b10
add rsp, 0x6b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret