Function at 0x140019550
Capabilities:
Copy file
Create directory

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xab0
lea rbp, [rsp + 0x80]
and rbp, 0xffffffffffffffc0
mov rax, qword [0x140193440]
xor rax, rsp
mov qword [rbp + 0xa20], rax
mov qword [rbp + 0x38], rcx
xor edi, edi
mov ecx, 0x10000
mov qword [rbp], rdi
mov r14, r8
mov qword [rbp + 0x28], r8
mov rbx, rdx
xor r15d, r15d
call fcn.1400e9094
mov qword [rbp + 0x10], rax
mov rsi, rax
test rbx, rbx
je 0x14001a04b
test r14, r14
je 0x14001a04b
test rax, rax
je 0x14001a04b
lea r13, [rdi - 1]
cmp byte [r14], dil
jne 0x1400195e5
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea edx, [rdi + 1]
mov ecx, r13d
call fcn.140066e30
mov rcx, rbx
call fcn.140077020
mov qword [rbp + 8], rax
mov r12, rax
test rax, rax
je 0x14001a03f
lea rsi, [0x140000000]
nop dword [rax]
nop dword [rax + rax]
cmp dword [0x14019f0a0], 0
jne 0x14001a033
test r12, r12
jne 0x140019626
xor edi, edi
jmp 0x140019638
mov rax, qword [r12]
lea rdi, [0x14015ba58]
test rax, rax
cmovne rdi, rax
mov qword [rbp + 0x30], rdi
mov rax, r13
nop
inc rax
cmp byte [rdi + rax], 0
jne 0x140019640
test rax, rax
je 0x140019f3c
mov rax, r13
inc rax
cmp byte [r14 + rax], 0
jne 0x140019655
mov rdx, qword [0x1401d0d80]
mov rcx, r13
nop dword [rax]
inc rcx
cmp byte [rdx + rcx], 0
jne 0x140019670
add eax, ecx
mov rcx, r13
nop
inc rcx
cmp byte [rdi + rcx], 0
jne 0x140019680
add ecx, 0x1b
add eax, ecx
mov ecx, 1
movsxd rbx, eax
mov rdx, rbx
call fcn.1400c537c
mov qword [rbp + 0x20], rax
mov r15, rax
test rax, rax
je 0x14001a01f
mov rax, qword [0x1401d0d80]
lea r9, [0x14015b878]
mov qword [rsp + 0x30], rdi
mov r8, r13
mov qword [rsp + 0x28], r14
mov rdx, rbx
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.140004960
test eax, eax
js 0x14001a02b
test r12, r12
je case.0x140019719.4
lea rcx, [rbp + 0x40]
mov r8d, 0x800
lea rdx, [r12 + 0x40]
call fcn.1401362c0
mov rax, qword [rbp + 0x58]
shr rax, 0x18
movzx eax, al
add eax, 0xfffffffc
cmp eax, 8
ja case.0x140019719.4
cdqe
mov ecx, dword [rsi + rax*4 + 0x1a084]
add rcx, rsi
jmp rcx
mov byte [0x1401e8fd8], 2
cmp byte [r12 + 8], 0
je 0x14001994f
cmp dword [0x1401d0c44], 0
jne 0x1400198aa
mov rcx, r15
call fcn.1400fcc44
mov r14, rax
test rax, rax
jne 0x140019901
lea rcx, str.Could_not_allocate_string_for_sanitized_path
call fcn.14004f910
mov rcx, r14
call fcn.140017520
mov rcx, rax
mov rbx, rax
call fcn.1401049a4
test rbx, rbx
je 0x14001977b
mov rcx, rbx
call fcn.1400e9080
cmp dword [0x14019f538], 0
je 0x1400198a2
mov rcx, r12
call fcn.140075da0
movsxd rdx, dword [0x1401d0c40]
movabs rdi, 0x2b6109100
add rax, rdi
imul rcx, rax, 0x989680
lea eax, [rdx + 1]
movsxd rbx, eax
lea rsi, [rsi + rdx*8]
mov dword [rsi + 0x1d0da0], ecx
lea rsi, [rsi + 0x1d0da0]
sar rcx, 0x20
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
mov dword [rsi + 4], ecx
mov rcx, r12
shr rdx, 1
lea rax, [rdx + rdx*2]
sub rbx, rax
call fcn.140075c60
add rax, rdi
lea rdx, [0x140000000]
imul rcx, rax, 0x989680
movsxd rax, ebx
lea rdi, [rdx + 0x1d0da0]
lea rdi, [rdi + rax*8]
movsxd rbx, ebx
mov dword [rdi], ecx
inc rbx
sar rcx, 0x20
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
mov dword [rdi + 4], ecx
mov rcx, r12
shr rdx, 1
lea rax, [rdx + rdx*2]
sub rbx, rax
call fcn.140075b20
movabs rcx, 0x2b6109100
lea rdx, [0x140000000]
add rax, rcx
lea r9, [rdx + 0x1d0da0]
imul rcx, rax, 0x989680
movsxd rax, ebx
mov r8, rdi
lea r9, [r9 + rax*8]
mov dword [r9], ecx
lea eax, [rbx + 1]
movsxd r10, eax
movabs rax, 0xaaaaaaaaaaaaaaab
mul r10
sar rcx, 0x20
shr rdx, 1
mov dword [r9 + 4], ecx
mov rcx, r14
mov qword [0x1401d0d88], r9
lea rax, [rdx + rdx*2]
mov rdx, rsi
sub r10, rax
mov dword [0x1401d0c40], r10d
call fcn.140019460
mov rcx, r14
call fcn.1400e9080
mov rcx, r12
call fcn.140076e90
mov rdx, rax
test rax, rax
je 0x1400198e2
mov rax, qword [0x1401d0d80]
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x1400198c4
mov rcx, qword [rbp + 0x38]
add r8, r15
call fcn.140019550
test eax, eax
jne 0x14001a02b
mov r12, qword [rbp + 8]
mov rcx, r15
call fcn.1400e9080
mov r14, qword [rbp + 0x28]
lea rsi, [0x140000000]
xor r15d, r15d
jmp 0x140019f40
lea rdx, [rax + 2]
nop word [rax + rax]
mov rax, r13
inc rax
cmp byte [r14 + rax], 0
jne 0x140019913
mov rcx, rdx
sub rcx, r14
cmp rcx, rax
jae 0x14001975b
movzx eax, byte [rdx]
cmp al, 0x2a
je 0x140019947
cmp al, 0x3f
je 0x140019947
cmp al, 0x3c
je 0x140019947
cmp al, 0x3e
je 0x140019947
cmp al, 0x3a
je 0x140019947
cmp al, 0x7c
jne 0x14001994a
mov byte [rdx], 0x5f
inc rdx
jmp 0x140019910
mov rsi, qword [r12 + 0x78]
lea rax, [rbp + 0x840]
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov r9, r15
mov r8, rdi
mov rcx, r14
call fcn.140017b60
mov rcx, r15
test eax, eax
je 0x140019985
call fcn.1400e9080
xor r15d, r15d
jmp 0x140019f35
mov rdx, rsi
call fcn.140019080
xor ebx, ebx
nop
cmp byte [rbp + rbx + 0x845], 0
je 0x140019a6f
lea rax, [0x140000000]
cmp dword [rax + rbx*4 + 0x19f540], 0
je 0x140019a6f
mov rax, qword [rax + rbx*8 + 0x1500c8]
lea r9, str._s_syslinux__s__s
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x9a0]
lea rax, [0x140196f48]
mov r8, r13
mov qword [rsp + 0x28], rax
mov edx, 0x80
lea rax, [0x1401569ec]
mov qword [rsp + 0x20], rax
call fcn.140004960
lea rcx, [rbp + 0x9a0]
mov byte [rbp + 0xa1f], 0
call fcn.140017520
mov rcx, r15
mov r14, rax
call fcn.140017520
xor r8d, r8d
mov rdx, rax
mov rcx, r14
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
test r14, r14
je 0x140019a3c
mov rcx, r14
call fcn.1400e9080
test rdi, rdi
je 0x140019a49
mov rcx, rdi
call fcn.1400e9080
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r15d, r15d
jne 0x140019a81
call fcn.140050120
mov rdx, rax
lea rcx, str.__Could_not_replace_file:__s
call fcn.14004f910
mov r15, qword [rbp + 0x20]
inc rbx
cmp rbx, 2
jb 0x140019990
jmp 0x140019b05
lea r8, [rbp + 0x980]
mov ecx, 2
lea rdx, [rbp + 0x9a0]
call fcn.140047970
test eax, eax
je 0x140019ad7
xor edi, edi
nop
lea rax, [0x140197810]
movsxd rdx, edi
add rdx, rax
lea rcx, [rbp + 0x980]
mov r8d, 0x20
call fcn.140136d00
test eax, eax
je 0x140019ad2
add edi, 0x20
cmp edi, 0xbe0
jb 0x140019aa0
xor eax, eax
jmp 0x140019ad7
mov eax, 1
test eax, eax
lea rdx, [0x1401589b4]
lea rax, [0x1401589b0]
cmovne rdx, rax
lea rcx, str.__Replaced_with_local_version__s
call fcn.14004f910
mov r15, qword [rbp + 0x20]
cmp rbx, 2
jb 0x140019f31
mov rcx, r15
mov ebx, 1
call fcn.1400fcc44
mov r14, rax
test rax, rax
jne 0x140019b28
lea rcx, str.Could_not_allocate_string_for_sanitized_path
call fcn.14004f910
jmp 0x140019b97
lea rdx, [rax + 2]
nop dword [rax]
mov rcx, r13
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140019b33
mov rax, rdx
sub rax, r14
cmp rax, rcx
jae 0x140019b84
movzx eax, byte [rdx]
cmp al, 0x2a
je 0x140019b70
cmp al, 0x3f
je 0x140019b70
cmp al, 0x3c
jne 0x140019b77
mov byte [rdx], 0x5f
xor ebx, ebx
mov al, 0x5f
cmp al, 0x3a
je 0x140019b66
cmp al, 0x7c
jne 0x140019b6b
xor ebx, ebx
mov byte [rdx], 0x5f
inc rdx
jmp 0x140019b30
mov byte [rdx], 0x5f
xor ebx, ebx
mov al, 0x5f
cmp al, 0x3e
jne 0x140019b5e
mov byte [rdx], 0x5f
xor ebx, ebx
mov al, 0x5f
jmp 0x140019b62
test ebx, ebx
jne 0x140019b97
mov rdx, r14
lea rcx, str.__File_name_sanitized_to__s
call fcn.14004f910
mov rcx, r14
mov qword [rsp + 0x30], rsi
call fcn.1400510c0
mov qword [rbp], rax
mov rdi, rax
cmp rax, r13
jne 0x140019c0f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140050120
mov rdx, rax
lea rcx, str.__Unable_to_create_file:__s
call fcn.14004f910
lea ecx, [rbx - 5]
cmp ecx, 1
ja 0x140019f61
lea rdx, [r14 + 3]
test rdx, rdx
lea rcx, str._NULL_
cmovne rcx, rdx
lea rdx, str.autorun.inf
call fcn.140113960
test eax, eax
jne 0x140019f61
lea rcx, str.__NOTE:_This_is_usually_caused_by_a_poorly_designed_security_solution._See_https:__bit.ly_40qDtyF._r_n__This_file_will_be_skipped_for_now__but_you_should_really_look_into_using_a_SMARTER_antivirus_solution.
call fcn.14004f910
jmp 0x140019d8c
cmp qword [0x1401d0de0], 0
je 0x140019c25
lea rcx, [rbp + 0x880]
call fcn.140042070
test rsi, rsi
jle 0x140019d30
mov r12, qword [rbp + 8]
cmp dword [0x14019f0a0], 0
jne 0x140019f84
lea rax, [rsi + 0x7ff]
mov rcx, r12
cqo
and edx, 0x7ff
add rax, rdx
mov rdx, qword [rbp + 0x10]
sar rax, 0xb
mov rdi, rax
cmp rax, 0x20
mov eax, 0x20
cmovg rdi, rax
mov r8, rdi
call fcn.140076130
mov rbx, rax
test rax, rax
js 0x140019ffc
cmp rsi, rax
cmovl ebx, esi
cmp qword [0x1401d0de0], 0
je 0x140019ca3
mov rdx, qword [rbp + 0x10]
lea rcx, [rbp + 0x880]
mov r8d, ebx
call fcn.140047330
mov rdx, qword [rbp + 0x10]
lea r9, [rbp + 0x18]
mov rcx, qword [rbp]
mov r8d, ebx
call fcn.140050f30
inc qword [0x1401954e0]
test eax, eax
je 0x140019f70
mov eax, dword [rbp + 0x18]
cmp eax, ebx
jne 0x140019f67
mov r8, qword [0x1401d0dc8]
sub rsi, rax
add r8, rdi
mov rax, r8
mov qword [0x1401d0dc8], r8
sub rax, qword [0x1401d0d58]
cmp rax, 0x80
jb 0x140019d23
mov r9, qword [0x1401d0dc0]
mov edx, 0xc9f
mov ecx, 7
mov dword [rsp + 0x20], 0
call fcn.140066e30
mov rax, qword [0x1401d0dc8]
mov qword [0x1401d0d58], rax
test rsi, rsi
jg 0x140019c32
mov rdi, qword [rbp]
cmp qword [0x1401d0de0], 0
je 0x140019d8c
lea rcx, [rbp + 0x880]
call fcn.140047880
xor ebx, ebx
nop dword [rax + rax]
movzx r8d, byte [rbp + rbx + 0x880]
lea rdx, str._02x
mov rcx, qword [0x1401d0de0]
call fcn.140001060
inc rbx
cmp rbx, 0x10
jb 0x140019d50
mov rcx, qword [0x1401d0de0]
lea r8, [r15 + 3]
lea rdx, str.__.__s_n
call fcn.140001060
cmp dword [0x14019f538], 0
mov r12, qword [rbp + 8]
je 0x140019edd
mov rcx, r12
call fcn.140075c60
movsxd rdx, dword [0x1401d0c40]
lea rdi, [0x140000000]
movabs rcx, 0x2b6109100
lea rsi, [rdi + 0x1d0da0]
add rax, rcx
lea rsi, [rsi + rdx*8]
imul rcx, rax, 0x989680
lea eax, [rdx + 1]
movsxd rbx, eax
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
mov dword [rsi], ecx
sar rcx, 0x20
shr rdx, 1
mov dword [rsi + 4], ecx
mov rcx, r12
lea rax, [rdx + rdx*2]
sub rbx, rax
call fcn.140075da0
movabs rcx, 0x2b6109100
add rax, rcx
imul rcx, rax, 0x989680
movsxd rax, ebx
movsxd rbx, ebx
inc rbx
lea rdi, [rdi + rax*8]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
mov dword [rdi + 0x1d0da0], ecx
lea rdi, [rdi + 0x1d0da0]
sar rcx, 0x20
shr rdx, 1
mov dword [rdi + 4], ecx
mov rcx, r12
lea rax, [rdx + rdx*2]
sub rbx, rax
call fcn.140075b20
movabs rcx, 0x2b6109100
lea rdx, [0x140000000]
add rax, rcx
lea r9, [rdx + 0x1d0da0]
imul rcx, rax, 0x989680
movsxd rax, ebx
mov r8, rsi
lea r9, [r9 + rax*8]
mov dword [r9], ecx
lea eax, [rbx + 1]
sar rcx, 0x20
mov dword [r9 + 4], ecx
movsxd rcx, eax
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
mov qword [0x1401d0d88], r9
shr rdx, 1
lea rax, [rdx + rdx*2]
mov rdx, rdi
mov rdi, qword [rbp]
sub rcx, rax
mov dword [0x1401d0c40], ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x140019edd
call fcn.140050120
mov rdx, rax
lea rcx, str.__Could_not_set_timestamp:__s
call fcn.14004f910
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140019ef4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp], r13
inc qword [0x1401954e0]
cmp byte [rbp + 0x840], 0
jne 0x140019f0d
cmp byte [rbp + 0x841], 0
je 0x140019f24
mov r8, qword [rbp + 0x30]
lea r9, [rbp + 0x840]
mov rdx, qword [rbp + 0x28]
mov rcx, r14
call fcn.1400186b0
mov rcx, r14
call fcn.1400e9080
jmp 0x1400198e6
mov r14, qword [rbp + 0x28]
lea rsi, [0x140000000]
mov r12, qword [rbp + 8]
mov rcx, r12
call fcn.140077020
mov qword [rbp + 8], rax
mov r12, rax
test rax, rax
je 0x14001a03b
mov rdi, qword [rbp]
jmp 0x140019610
mov r12, qword [rbp + 8]
jmp 0x140019f88
lea rax, str.Short_write_detected
jmp 0x140019f75
call fcn.140050120
mov rdx, rax
lea rcx, str.__Error_writing_file:__s
call fcn.14004f910
mov rdi, qword [rbp]
test r12, r12
je 0x140019fcc
mov rcx, qword [r12]
mov qword [r12 + 0x38], 0
test rcx, rcx
je 0x140019fa4
call fcn.1400e9080
mov rcx, qword [r12 + 0x30]
mov qword [r12], 0
test rcx, rcx
je 0x140019fbb
call fcn.1400e9080
mov rcx, r12
mov qword [r12 + 0x30], 0
call fcn.1400e9080
lea rcx, [rdi - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140019fdf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc qword [0x1401954e0]
mov rcx, r14
call fcn.1400e9080
mov rcx, r15
call fcn.1400e9080
mov rcx, qword [rbp + 0x10]
jmp 0x14001a04e
mov rax, qword [0x1401d0d80]
cmp byte [rax + r13 + 1], 0
lea r13, [r13 + 1]
jne 0x14001a003
lea rdx, [r15 + r13]
lea rcx, str.__Error_reading_UDF_file__s
jmp 0x140019f7f
lea rcx, str.Error_allocating_file_name
call fcn.14004f910
xor r14d, r14d
jmp 0x140019f84
xor r14d, r14d
jmp 0x140019f88
mov rsi, qword [rbp + 0x10]
mov rcx, rsi
call fcn.1400e9080
xor eax, eax
jmp 0x14001a058
mov rcx, rax
call fcn.1400e9080
mov eax, 1
mov rcx, qword [rbp + 0xa20]
xor rcx, rsp
call fcn.1400b1f80
mov rbx, qword [rsp + 0xb08]
add rsp, 0xab0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret