Function at 0x140003200
Capabilities:
Copy file
Get file attributes
Hash data using djb2
Set file attributes
Timestomp file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x400]
sub rsp, 0x500
xor ebx, ebx
xorps xmm0, xmm0
mov qword [rbp - 0x80], rbx
mov r15, rdx
mov rsi, rcx
movups xmmword [rcx], xmm0
lea r12, [rbx - 1]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
test r9, r9
je 0x140003b8e
mov r13, qword [rbp + 0x460]
mov rax, r8
sub rax, rdx
add rax, 4
sub r8, rdx
mov qword [rbp - 0x58], rax
mov qword [rbp + 0x450], r8
movsxd rdi, dword [r15]
lea r9, [r13 + 0x10]
add rdi, r15
mov eax, ebx
sub eax, dword [r15]
neg eax
sbb rax, rax
and rdi, rax
mov eax, ebx
sub eax, dword [r8 + r15]
mov ebx, 0x1505
neg eax
movsxd rax, dword [r8 + r15]
movzx edx, byte [rdi]
sbb r14, r14
add rax, r8
lea r8, [rdi + 1]
add rax, r15
and r14, rax
test edx, edx
je 0x1400032ce
nop dword [rax]
lea eax, [rdx - 0x41]
cmp eax, 0x1a
lea ecx, [rdx + 0x20]
lea r8, [r8 + 1]
cmovb edx, ecx
imul ebx, ebx, 0x21
add ebx, edx
movzx edx, byte [r8 - 1]
test edx, edx
jne 0x1400032b0
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edx, 1
lea rcx, [r13 + 0x18]
test ebx, ebx
mov r8, rdi
cmovne edx, ebx
call fcn.140015f50
cmp eax, r12d
je 0x14000330b
cdqe
lea rcx, [rax + rax*2]
mov rax, qword [r13 + 0x40]
lea rdx, [rax + rcx*8]
test rdx, rdx
je 0x14000330b
mov dword [rdx], 0x40000000
lea rcx, [r13 + 0x10]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
movzx edx, byte [rdi]
lea r9, [rdi + 1]
mov r8d, 0x1505
test edx, edx
je 0x140003350
nop word [rax + rax]
lea eax, [rdx - 0x41]
cmp eax, 0x1a
lea ecx, [rdx + 0x20]
lea r9, [r9 + 1]
cmovb edx, ecx
imul r8d, r8d, 0x21
add r8d, edx
movzx edx, byte [r9 - 1]
test edx, edx
jne 0x140003330
test r8d, r8d
lea rcx, [rbp - 0x48]
mov r9d, 1
mov rdx, r13
cmovne r9d, r8d
mov r8, rdi
call fcn.140045a80
mov ebx, dword [rbp - 0x48]
test bl, 1
je 0x140003b71
mov eax, ebx
shr eax, 3
test al, 1
jne 0x140003b68
movzx edx, byte [r14]
lea r9, [r14 + 1]
mov r8d, 0x1505
test edx, edx
je 0x1400033c0
nop word [rax + rax]
lea eax, [rdx - 0x41]
cmp eax, 0x1a
lea ecx, [rdx + 0x20]
lea r9, [r9 + 1]
cmovb edx, ecx
imul r8d, r8d, 0x21
add r8d, edx
movzx edx, byte [r9 - 1]
test edx, edx
jne 0x1400033a0
test r8d, r8d
lea rcx, [rbp - 0x30]
mov r9d, 1
mov rdx, r13
cmovne r9d, r8d
mov r8, r14
call fcn.140045a80
mov ecx, dword [rbp - 0x30]
test cl, 1
je 0x1400033fd
mov eax, ecx
shr eax, 3
test al, 1
jne 0x1400036bb
shr ecx, 5
test cl, 1
jne 0x14000369e
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.140013c40
lea rcx, [rsp + 0x60]
call fcn.140013ed0
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.140013c40
lea rcx, [rsp + 0x40]
call fcn.140013ed0
xor edi, edi
mov dword [rsp + 0x28], 0x800
cmp qword [rsp + 0x58], 7
lea rax, [rbp + 0x440]
lea rdx, [rsp + 0x40]
mov dword [rbp + 0x440], edi
cmova rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
mov qword [rsp + 0x20], rax
cmova rcx, qword [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
jne 0x140003481
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rax, qword [rbp - 0x58]
mov rdx, r14
mov rcx, r13
mov r8d, dword [rax + r15]
call fcn.140045a00
cmp dword [rsi], edi
jne 0x140003a21
mov eax, ebx
shr eax, 4
test al, 1
jne 0x1400035dd
cmp qword [rsp + 0x58], 7
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
mov edx, pe_nt_image_headers64
cmova rcx, qword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, r12
jne 0x1400034f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
jmp 0x140003523
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea r9, [rbp - 0x50]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x14000351a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsi], 0
jne 0x1400038d7
shr ebx, 5
test bl, 1
je 0x14000356f
cmp qword [rsp + 0x58], 7
lea rcx, [rsp + 0x40]
cmova rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp qword [rsp + 0x58], 7
lea rcx, [rsp + 0x40]
cmova rcx, qword [rsp + 0x40]
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1400036ca
movzx edx, byte [r14]
lea r9, [r14 + 1]
mov r8d, 0x1505
test edx, edx
je 0x1400035b0
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx - 0x41]
cmp eax, 0x1a
lea ecx, [rdx + 0x20]
lea r9, [r9 + 1]
cmovb edx, ecx
imul r8d, r8d, 0x21
add r8d, edx
movzx edx, byte [r9 - 1]
test edx, edx
jne 0x140003590
test r8d, r8d
lea rcx, [rbp - 0x18]
mov r9d, 1
mov rdx, r13
cmovne r9d, r8d
mov r8, r14
call fcn.140045a80
mov r9, qword [rbp - 0x10]
mov rax, qword [rbp - 0x40]
cmp r9, rax
jne 0x14000381c
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14000361f
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000361a
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003c14
mov rcx, r8
call fcn.140048124
mov rdx, qword [rsp + 0x78]
xor ebx, ebx
mov word [rsp + 0x40], bx
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
cmp rdx, 7
jbe 0x140003676
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003671
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003c14
mov rcx, r8
call fcn.140048124
mov rcx, qword [rbp - 0x80]
add r15, 8
inc rcx
mov qword [rbp - 0x80], rcx
cmp rcx, qword [rbp + 0x458]
jae 0x140003b8e
mov r8, qword [rbp + 0x450]
jmp 0x14000326a
lea r8, str.The_target_path_already_exists_and_is_read_only.
mov dword [rsi], r12d
mov edx, 0x400
lea rcx, [rbp]
call fcn.1400031a0
jmp 0x140003b8c
mov r9, r14
lea r8, str.The_target_path__s_already_exists_as_a_directory.
jmp 0x140003b7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
lea rcx, [rbp + 0x458]
mov r9d, 0x400
mov dword [rsi], eax
mov qword [rsp + 0x30], rbx
mov r8d, eax
mov dword [rsp + 0x28], ebx
xor edx, edx
mov qword [rsp + 0x20], rcx
mov ecx, 0x1300
mov qword [rbp + 0x458], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rdx, qword [rbp + 0x458]
lea rcx, [rbp - 0x78]
call fcn.140013d10
cmp qword [rax + 0x18], 0xf
jbe 0x140003720
mov rax, qword [rax]
mov r9, rax
lea r8, str.Clearing_the_readonly_flag_on_the_file_failed:__s
mov edx, 0x400
lea rcx, [rbp]
call fcn.1400031a0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140003773
mov rcx, qword [rbp - 0x78]
inc rdx
cmp rdx, 0x1000
jb 0x14000376e
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003c20
mov rcx, r8
call fcn.140048124
mov rcx, qword [rbp + 0x458]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400037c2
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400037bd
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003c0e
mov rcx, r8
call fcn.140048124
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bx
cmp rdx, 7
jbe 0x140003b8e
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003b61
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003c0e
jmp 0x140003b5e
lea r8, str.The_copied_file_is__llu_bytes__but_the_source_file_was__llu_bytes.
mov dword [rsi], r12d
mov edx, 0x400
mov qword [rsp + 0x20], rax
lea rcx, [rbp]
call fcn.1400031a0
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14000387b
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003876
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003c14
mov rcx, r8
call fcn.140048124
mov rdx, qword [rsp + 0x78]
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bx
cmp rdx, 7
jbe 0x140003b8e
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003b61
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003c14
jmp 0x140003b5e
mov r8d, dword [rsi]
lea rax, [rbp + 0x458]
xor ebx, ebx
mov r9d, 0x400
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
mov ecx, 0x1300
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x458], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rdx, qword [rbp + 0x458]
lea rcx, [rbp - 0x78]
call fcn.140013d10
cmp qword [rax + 0x18], 0xf
jbe 0x140003925
mov rax, qword [rax]
mov r9, rax
lea r8, str.Updating_the_timestamp_on_the_file_failed:__s
mov edx, 0x400
lea rcx, [rbp]
call fcn.1400031a0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140003978
mov rcx, qword [rbp - 0x78]
inc rdx
cmp rdx, 0x1000
jb 0x140003973
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003c26
mov rcx, r8
call fcn.140048124
mov rcx, qword [rbp + 0x458]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400039c7
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400039c2
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003c1a
mov rcx, r8
call fcn.140048124
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bx
cmp rdx, 7
jbe 0x140003b8e
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003b61
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003c1a
jmp 0x140003b5e
mov r8d, dword [rsi]
lea rax, [rbp + 0x458]
xor ebx, ebx
mov r9d, 0x400
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
mov ecx, 0x1300
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x458], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rdx, qword [rbp + 0x458]
lea rcx, [rbp - 0x78]
call fcn.140013d10
cmp qword [rax + 0x18], 0xf
jbe 0x140003a6f
mov rax, qword [rax]
mov r9, rax
lea r8, str.Copying_the_file_failed:__s
mov edx, 0x400
lea rcx, [rbp]
call fcn.1400031a0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140003ac2
mov rcx, qword [rbp - 0x78]
inc rdx
cmp rdx, 0x1000
jb 0x140003abd
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003c08
mov rcx, r8
call fcn.140048124
mov rcx, qword [rbp + 0x458]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140003b11
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003b0c
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003c2c
mov rcx, r8
call fcn.140048124
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bx
cmp rdx, 7
jbe 0x140003b8e
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003b61
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003c2c
mov rcx, r8
call fcn.140048124
jmp 0x140003b8e
lea r8, str.The_source_path__s_is_a_directory__which_is_not_supported.
jmp 0x140003b78
lea r8, str.The_source_path__s_does_not_exist.
mov r9, rdi
mov edx, 0x400
mov dword [rsi], r12d
lea rcx, [rbp]
call fcn.1400031a0
xor ebx, ebx
cmp dword [rsi], 0
je 0x140003bea
mov ecx, 0x2808
mov qword [rsi + 0x18], 0x2800
mov dword [rsi + 0x20], ebx
call fcn.140053cb4
mov rcx, qword [rbp + 0x468]
mov qword [rax], 0x2800
lock add qword [rcx], 0x2800
add rax, 8
mov qword [rsi + 0x10], rax
mov byte [rax], 0
lea rax, [rbp]
mov qword [rsi + 0x28], rcx
inc r12
cmp byte [rax + r12], 0
jne 0x140003bd1
mov r8, r12
lea rdx, [rbp]
mov rcx, rsi
call fcn.140023b10
mov rbx, qword [rsp + 0x548]
mov rax, rsi
add rsp, 0x500
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140052424
int3
call fcn.140052424
int3
call fcn.140052424
int3
call fcn.140052424
int3
call fcn.140052424
int3
call fcn.140052424
int3
call fcn.140052424
int3