Function at 0x140001790
Capabilities:
Copy file
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov r14, rcx
mov r8d, 0x104
lea rdx, [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [r14 + rbx], 0
jne 0x1400017f0
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x140001aae
cmp rbx, 0xf
ja 0x14000183b
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov r8, rbx
mov rdx, r14
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x30], 0
jmp 0x1400018d1
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x140001874
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002540
test rax, rax
je 0x140001a04
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400018b0
mov rsi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
test rcx, rcx
jne 0x140001890
xor edi, edi
jmp 0x1400018b0
cmp rcx, 0x1000
jb 0x1400018a8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001ab4
jmp 0x140001855
call fcn.140002540
mov rdi, rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14000190c
lea rax, [rcx + 1]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x30]
mov word [rax + rcx], 0x5c
lea rax, [rsp + 0x30]
jmp 0x14000192b
mov qword [rsp + 0x20], 1
lea r9, [0x140004540]
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.1400022a0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp - 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov r8, rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x78]
call fcn.140002030
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400019bd
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000257c
movdqa xmm0, xmmword [0x1400045b0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001a10
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a0b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000257c
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova rdx, qword [rsp + 0x78]
xor r8d, r8d
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova rcx, qword [rsp + 0x78]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140001a87
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a82
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000257c
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.140002520
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1400011a0
int3
call fcn.140001100
int3