Function at 0x14001b780
Capabilities:
Copy file
Create directory
Encode data using xor
Enumerate files on windows
Move file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x4e0], rbx
mov rax, qword [0x140320c20]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov r12, r9
mov rax, r8
mov qword [rsp + 0x50], rax
mov rsi, rdx
mov qword [rsp + 0x48], rdx
mov dil, 1
mov byte [rsp + 0x30], dil
mov qword [rbp + 0x118], 7
xor r13d, r13d
mov qword [rbp + 0x110], r13
mov word [rbp + 0x100], r13w
lea r8, [rbp + 0x100]
mov rdx, rax
call fcn.14001c380
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
xor edx, edx
call fcn.140023dd0
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
xor r8d, r8d
xor edx, edx
call fcn.140004d20
mov rbx, rax
mov qword [rbp + 0x30], rax
mov r9, rsi
mov r8, qword [rax + 8]
mov rdx, rax
call fcn.140011240
mov rcx, rax
movabs rax, 0x555555555555554
mov r14, qword [rbp + 0x38]
sub rax, r14
cmp rax, 1
jae 0x14001b88f
lea rcx, str.list_T__too_long
call fcn.140216538
int3
add r14, 1
mov qword [rbp + 0x38], r14
mov qword [rbx + 8], rcx
mov rax, qword [rcx + 8]
mov qword [rax], rcx
je 0x14001c06b
mov r15, qword [rbp + 0x30]
nop dword [rax]
mov rdx, qword [r15]
add rdx, 0x10
lea r8, [0x140297498]
lea rcx, [rbp + 0xe0]
call fcn.1400107c0
nop
mov rdi, qword [r15]
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec r14
mov qword [rbp + 0x38], r14
lea rbx, [rdi + 0x10]
mov r8, qword [rbx + 0x18]
cmp r8, 8
jb 0x14001b906
inc r8
mov rdx, qword [rbx]
mov rcx, rbx
call fcn.140008270
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r13
cmp qword [rbx + 0x18], 8
jb 0x14001b91c
mov rbx, qword [rbx]
mov word [rbx], r13w
mov rcx, rdi
call fcn.1402150bc
mov dword [rsp + 0x38], 0x17d00e1
mov dword [rsp + 0x3c], 0x6b0066
xor eax, eax
mov word [rsp + 0x40], ax
xor ebx, ebx
mov r10d, ebx
mov ecx, ebx
lea r11, [0x140000000]
movabs rbx, 0x2492492492492493
movabs rsi, 0xcccccccccccccccd
lea r9, [rsp + 0x38]
lea r9, [r9 + rcx*2]
mov rax, rbx
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 2
imul rax, rax, 7
mov rdx, rcx
sub rdx, rax
movzx r8d, byte [rdx + r11 + 0x290048]
mov rax, rsi
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*4]
sub rcx, rax
movzx eax, byte [rcx + r11 + 0x290040]
add r8w, ax
add r8w, r10w
xor word [r9], r8w
inc r10d
movsxd rcx, r10d
cmp rcx, 4
jb 0x14001b961
mov rsi, qword [rsp + 0x48]
xor ebx, ebx
lea r8, [rsp + 0x38]
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x60]
call fcn.1400107c0
nop
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
lea rdx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x14001bfca
nop word [rax + rax]
lea r8, [rbp + 0x16c]
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x120]
call fcn.1400107c0
nop
or r9, 0xffffffffffffffff
mov r8, qword [rsi + 0x10]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0xe0]
call fcn.14000d730
nop
mov r8, rax
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp + 0xc0]
call fcn.1400108a0
nop
mov r8, qword [rsp + 0x70]
cmp r8, 8
jb 0x14001ba77
inc r8
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.140008270
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rbx
mov word [rsp + 0x58], bx
or r9, 0xffffffffffffffff
mov r8, qword [rsi + 0x10]
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0xe0]
call fcn.14000d730
nop
mov r8, rax
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0xa0]
call fcn.1400108a0
nop
mov r8, qword [rbp - 0x70]
cmp r8, 8
jb 0x14001bad7
inc r8
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x78]
call fcn.140008270
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], rbx
mov word [rsp + 0x78], bx
lea r8, [rbp + 0x16c]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x40]
call fcn.1400107c0
nop
lea r8, [rbp + 0x16c]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x80]
call fcn.1400107c0
nop
test byte [rbp + 0x140], 0x10
je 0x14001bbf3
movzx ecx, word [rbp + 0x16c]
movzx eax, word [rbp + 0x16e]
cmp cx, word [reloc.WLDAP32.dll_Ordinal_46]
jne 0x14001bb4c
cmp ax, word [0x14029756e]
je 0x14001bd19
cmp cx, word [reloc.WLDAP32.dll_Ordinal_46]
jne 0x14001bb72
cmp ax, word [reloc.WLDAP32.dll_Ordinal_46]
jne 0x14001bb72
movzx eax, word [rbp + 0x170]
cmp ax, word [0x140297574]
je 0x14001bd19
lea rcx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rcx, qword [rbp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rcx, qword [rbp + 0x80]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r9, [rbp + 0x120]
mov r8, qword [r15 + 8]
mov rdx, r15
call fcn.140011240
mov rcx, rax
movabs rax, 0x555555555555554
mov r14, qword [rbp + 0x38]
sub rax, r14
cmp rax, 1
jb 0x14001bfb0
inc r14
mov qword [rbp + 0x38], r14
mov qword [r15 + 8], rcx
mov rax, qword [rcx + 8]
mov qword [rax], rcx
mov r15, qword [rbp + 0x30]
jmp 0x14001bd19
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rdx, qword [rbp + 0x80]
lea rcx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne sil
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rdx, qword [rbp + 0x40]
lea rcx, [rbp + 0x120]
cmp qword [rbp + 0x138], 8
cmovae rcx, qword [rbp + 0x120]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne byte [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rdx, qword [rbp + 0x40]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x60], rax
mov r8d, 0xfde9
lea rcx, [rbp - 0x60]
call fcn.1400078f0
nop
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
movzx edi, byte [rsp + 0x30]
movzx r9d, dil
movzx r8d, sil
mov rdx, qword [rbp - 0x60]
call fcn.14001cdf0
nop
lea rax, [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
cmp rcx, rax
je 0x14001bcc0
call fcn.140222478
test dil, dil
je 0x14001be3c
mov rbx, qword [r12]
lea r9, [rbp + 0x40]
mov r8, qword [rbx + 8]
mov rdx, rbx
call fcn.140011240
mov rcx, rax
mov rdx, qword [r12 + 8]
movabs rax, 0x555555555555554
sub rax, rdx
cmp rax, 1
jb 0x14001bfbd
lea rax, [rdx + 1]
mov qword [r12 + 8], rax
mov qword [rbx + 8], rcx
mov rax, qword [rcx + 8]
mov qword [rax], rcx
mov rsi, qword [rsp + 0x48]
xor ebx, ebx
jmp 0x14001bd1e
movzx edi, byte [rsp + 0x30]
mov r8, qword [rbp + 0x98]
cmp r8, 8
jb 0x14001bd41
inc r8
mov rdx, qword [rbp + 0x80]
lea rcx, [rbp + 0x80]
call fcn.140008270
mov qword [rbp + 0x98], 7
mov qword [rbp + 0x90], rbx
mov word [rbp + 0x80], bx
mov r8, qword [rbp + 0x58]
cmp r8, 8
jb 0x14001bd74
inc r8
mov rdx, qword [rbp + 0x40]
lea rcx, [rbp + 0x40]
call fcn.140008270
mov qword [rbp + 0x58], 7
mov qword [rbp + 0x50], rbx
mov word [rbp + 0x40], bx
mov r8, qword [rbp + 0xb8]
cmp r8, 8
jb 0x14001bda7
inc r8
mov rdx, qword [rbp + 0xa0]
lea rcx, [rbp + 0xa0]
call fcn.140008270
mov qword [rbp + 0xb8], 7
mov qword [rbp + 0xb0], rbx
mov word [rbp + 0xa0], bx
mov r8, qword [rbp + 0xd8]
cmp r8, 8
jb 0x14001bde3
inc r8
mov rdx, qword [rbp + 0xc0]
lea rcx, [rbp + 0xc0]
call fcn.140008270
mov qword [rbp + 0xd8], 7
mov qword [rbp + 0xd0], rbx
mov word [rbp + 0xc0], bx
mov r8, qword [rbp + 0x138]
cmp r8, 8
jb 0x14001be1f
inc r8
mov rdx, qword [rbp + 0x120]
lea rcx, [rbp + 0x120]
call fcn.140008270
lea rdx, [rbp + 0x140]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14001bf3f
jmp 0x14001ba10
mov r8, qword [rbp + 0x98]
cmp r8, 8
jb 0x14001be5f
inc r8
mov rdx, qword [rbp + 0x80]
lea rcx, [rbp + 0x80]
call fcn.140008270
mov qword [rbp + 0x98], 7
xor ebx, ebx
mov qword [rbp + 0x90], rbx
mov word [rbp + 0x80], bx
mov r8, qword [rbp + 0x58]
cmp r8, 8
jb 0x14001be94
inc r8
mov rdx, qword [rbp + 0x40]
lea rcx, [rbp + 0x40]
call fcn.140008270
mov qword [rbp + 0x58], 7
mov qword [rbp + 0x50], rbx
mov word [rbp + 0x40], bx
mov r8, qword [rbp + 0xb8]
cmp r8, 8
jb 0x14001bec7
inc r8
mov rdx, qword [rbp + 0xa0]
lea rcx, [rbp + 0xa0]
call fcn.140008270
mov qword [rbp + 0xb8], 7
mov qword [rbp + 0xb0], rbx
mov word [rbp + 0xa0], bx
mov r8, qword [rbp + 0xd8]
cmp r8, 8
jb 0x14001bf03
inc r8
mov rdx, qword [rbp + 0xc0]
lea rcx, [rbp + 0xc0]
call fcn.140008270
mov qword [rbp + 0xd8], 7
mov qword [rbp + 0xd0], rbx
mov word [rbp + 0xc0], bx
mov r8, qword [rbp + 0x138]
cmp r8, 8
jb 0x14001bf3f
inc r8
mov rdx, qword [rbp + 0x120]
lea rcx, [rbp + 0x120]
call fcn.140008270
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov r8, qword [rbp + 0x78]
test dil, dil
je 0x14001c021
cmp r8, 8
jb 0x14001bf6c
inc r8
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x60]
call fcn.140008270
mov qword [rbp + 0x78], 7
mov qword [rbp + 0x70], rbx
mov word [rbp + 0x60], bx
mov r8, qword [rbp + 0xf8]
cmp r8, 8
jb 0x14001bf9f
inc r8
mov rdx, qword [rbp + 0xe0]
lea rcx, [rbp + 0xe0]
call fcn.140008270
test r14, r14
je 0x14001c06b
xor r13d, r13d
jmp 0x14001b8b0
lea rcx, str.list_T__too_long
call fcn.140216538
int3
lea rcx, str.list_T__too_long
call fcn.140216538
nop
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rdx, qword [rbp + 0x60]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x60], rax
mov r8d, 0xfde9
lea rcx, [rbp - 0x60]
call fcn.1400078f0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rbp - 0x60]
mov ecx, 0x106c
call fcn.140004d70
nop
lea rax, [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
cmp rcx, rax
je 0x14001c01a
call fcn.140222478
xor dil, dil
mov r8, qword [rbp + 0x78]
cmp r8, 8
jb 0x14001c037
inc r8
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x60]
call fcn.140008270
mov word [rbp + 0x60], bx
mov qword [rbp + 0x70], rbx
mov qword [rbp + 0x78], 7
mov r8, qword [rbp + 0xf8]
cmp r8, 8
jb 0x14001c06b
inc r8
mov rdx, qword [rbp + 0xe0]
lea rcx, [rbp + 0xe0]
call fcn.140008270
nop
lea rcx, [rbp + 0x30]
call fcn.14000f2f0
mov rcx, qword [rbp + 0x30]
call fcn.1402150bc
nop
mov r8, qword [rbp + 0x118]
cmp r8, 8
jb 0x14001c0a1
inc r8
mov rdx, qword [rbp + 0x100]
lea rcx, [rbp + 0x100]
call fcn.140008270
movzx eax, dil
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.140215090
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x4a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret