Function at 0x1400669f0
Capabilities:
Copy file
Get common file path
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov r13, rcx
call fcn.140051da8
lea rcx, [rsp + 0x108]
mov qword [rsp + 0x68], rax
call fcn.14004ea3c
mov rax, qword [rsp + 0x108]
xor esi, esi
add rax, 0xfffffffffffffffe
mov rcx, rax
mov qword [rsp + 0x78], rax
mov byte [rsp + 0x40], sil
mov byte [rsp + 0x42], sil
mov byte [rsp + 0x118], sil
mov r15b, sil
mov byte [rsp + 0x41], sil
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [rax + rax + 0x410]
mov dword [rsp + 0x60], eax
movsxd rdx, ecx
lea rcx, [rsp + 0x88]
call fcn.140056040
mov rdi, qword [rsp + 0x88]
lea rcx, [rsp + 0x80]
lea rbp, [rdi + 0x21c]
mov qword [rsp + 0x90], rbp
mov word [rbp], si
call fcn.140055fcc
lea rcx, [rsp + 0x70]
call fcn.140055fcc
lea rcx, [rsp + 0x58]
call fcn.140055fcc
lea rcx, [rsp + 0x50]
call fcn.140055fcc
mov rax, qword [rsp + 0x108]
lea ecx, [rsi + 0x2d]
lea rbx, [0x1400f3178]
mov qword [rsp + 0x98], rsi
lea r14d, [rsi + 1]
lea r12d, [rsi + 2]
mov qword [rsp + 0xa8], rbx
cmp cx, word [rax]
jne 0x140066c33
lea edi, [rsi + 9]
mov ebx, ecx
lea rdx, [rsp + 0x108]
lea rcx, str._dir
mov r8d, 4
call fcn.140055af4
cmp al, sil
je 0x140066b23
mov byte [rsp + 0x42], r14b
jmp 0x140066c0e
lea rdx, [rsp + 0x108]
lea rcx, str._TaskBand
mov r8d, edi
call fcn.140055af4
cmp al, sil
je 0x140066b47
mov r15b, r12b
jmp 0x140066c0e
lea rdx, [rsp + 0x108]
lea rcx, str._StartMenu
mov r8d, 0xa
call fcn.140055af4
cmp al, sil
je 0x140066b73
mov byte [rsp + 0x118], r12b
jmp 0x140066c0e
lea rdx, [rsp + 0x108]
lea rcx, str._base:
mov r8d, 6
call fcn.140055af4
cmp al, sil
je 0x140066bcf
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x108]
mov r9d, 0x2c
mov rcx, r13
mov word [rsp + 0x20], si
call fcn.140048704
mov rdx, qword [rsp + 0x58]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [rsp + 0x58]
mov byte [rsp + 0x40], r14b
mov word [rax], si
jmp 0x140066c0e
mov rcx, qword [rsp + 0x108]
jmp 0x140066bf9
cmp di, ax
ja 0x140066be4
cmp ax, 0xd
jbe 0x140066c01
mov edx, 0x20
cmp dx, ax
je 0x140066c01
add rcx, r12
mov qword [rsp + 0x108], rcx
movzx eax, word [rcx]
cmp ax, si
jne 0x140066bd9
lea rcx, [rsp + 0x108]
call fcn.14004ea3c
mov rax, qword [rsp + 0x108]
cmp bx, word [rax]
je 0x140066afa
mov rdi, qword [rsp + 0x88]
mov byte [rsp + 0x41], r15b
lea rbx, [0x1400f3178]
mov ecx, 0x2a
cmp cx, word [rax]
jne 0x140066c80
lea r9d, [rcx + 2]
add rax, r12
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x108]
mov rcx, r13
mov word [rsp + 0x20], si
mov qword [rsp + 0x108], rax
call fcn.140048704
mov rax, qword [rsp + 0x58]
lea rcx, [rsp + 0x108]
mov qword [rsp + 0xa8], rax
call fcn.14004ea3c
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x108]
mov r9d, 0x2c
mov rcx, r13
mov word [rsp + 0x20], si
call fcn.140048704
mov r14, qword [rsp + 0x80]
lea rcx, [rsp + 0x108]
call fcn.14004ea3c
mov r9, qword [rsp + 0x108]
lea rcx, [0x1400f3120]
mov rdx, r9
call fcn.14004fe38
cmp al, sil
je 0x140066e68
cmp qword [0x140106d50], rsi
jne 0x140066d20
lea rcx, [rsp + 0x50]
call fcn.14004ea6c
lea rcx, [rsp + 0x58]
call fcn.14004ea6c
lea rcx, [rsp + 0x70]
call fcn.14004ea6c
lea rcx, [rsp + 0x80]
call fcn.14004ea6c
lea rcx, [rsp + 0x88]
call fcn.14004ea6c
xor eax, eax
jmp 0x140067677
cmp word [r14], si
cmovne rbx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbp, rax
cmp rax, rsi
jne 0x140066d8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x50]
mov r13d, 1
mov ebx, eax
cmp eax, esi
cmove ebx, r13d
call fcn.14004ea6c
lea rcx, [rsp + 0x58]
call fcn.14004ea6c
lea rcx, [rsp + 0x70]
call fcn.14004ea6c
lea rcx, [rsp + 0x80]
call fcn.14004ea6c
lea rcx, [rsp + 0x88]
call fcn.14004ea6c
mov eax, ebx
jmp 0x140067677
lea rcx, [rsp + 0x118]
mov edx, 0x1032
call fcn.140055ddc
mov rcx, qword [0x140106d50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x44], esi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rbx, qword [rsp + 0x118]
mov r14d, 1
mov edi, r14d
lea r8, [rbx + 0x19]
mov r9d, 0x1000
mov edx, edi
mov rcx, rbp
mov byte [rbx + 0x19], sil
call qword [sym.imp.USER32.dll_LoadStringA]
cmp eax, esi
je 0x140066e2e
lea rdx, str._r_n__12d_0x__7X
mov r9d, edi
mov r8d, edi
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, rbx
mov byte [rbx + 0x18], 0x3a
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [0x140106d50]
movsxd rdx, r12d
movsxd r8, eax
lea r9, [rsp + 0x44]
add rdx, rbx
sub r8d, r12d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r12d, esi
add edi, r14d
cmp edi, 0xffff
jle 0x140066dc8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [0x140106d50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x118]
mov qword [0x140106d50], rsi
call fcn.14004ea6c
jmp 0x14006763c
cmp word [r14], si
jne 0x140066e7a
mov rsi, 0xffffffff80070057
jmp 0x14006763c
mov eax, 0x2d
mov r13d, esi
lea r10d, [rax - 0x2c]
cmp ax, word [r9]
jne 0x140066e9a
add r9, r12
mov r13d, r10d
mov qword [rsp + 0x108], r9
cmp word [r9], si
je 0x140066eb4
lea rcx, str.StartMenu
mov rdx, r9
call fcn.14004fe38
cmp al, sil
je 0x140066ebc
or byte [rsp + 0x118], r10b
lea rcx, str.TaskBand
mov rdx, r9
call fcn.14004fe38
cmp al, sil
je 0x140066ed8
or r15b, r10b
mov byte [rsp + 0x41], r15b
mov eax, dword [0x140107e38]
test r10b, al
jne 0x140066f05
or eax, r10d
lea rcx, [0x1400e78a8]
mov qword [0x140107e30], rsi
mov dword [0x140107e38], eax
call fcn.1400ccd90
mov eax, dword [0x140107e38]
test r12b, al
jne 0x140066f26
or eax, r12d
lea rcx, [0x1400e789c]
mov qword [0x140107e28], rsi
mov dword [0x140107e38], eax
call fcn.1400ccd90
cmp r13d, esi
lea rax, [0x140107e28]
lea r15, [0x140107e30]
cmovne r15, rax
cmp byte [rsp + 0x40], sil
jne 0x140066f53
mov r8d, 0x104
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, rbp
lea ecx, [rax + 1]
mov ebx, eax
mov dword [rsp + 0x44], eax
movsxd r8, ecx
mov rcx, rdi
add r8, r8
call fcn.14001a4c0
movabs r11, 0xa00000000
cmp qword [rsp + 0x68], r11
jb 0x14006736d
cmp byte [rsp + 0x41], sil
je 0x1400670c4
cmp byte [rsp + 0x42], sil
jne 0x1400670c4
cmp byte [rsp + 0x40], sil
jne 0x1400671c5
lea rcx, str.NODELAYEXPLORER
call fcn.140018340
cmp eax, esi
jg 0x1400670cf
lea rcx, [rsp + 0x48]
mov edx, 0x1208
call fcn.140056040
mov rbx, qword [rsp + 0x48]
xor r9d, r9d
lea r8d, [r9 + 0x24]
mov rdx, rbx
xor ecx, ecx
mov word [rbx], si
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, str.Explorer.exe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
jne 0x1400670b6
mov word [rbx], si
mov rcx, qword [0x140106d38]
mov r9d, 0x1207
mov r8, rbx
mov edx, 0x2728
call fcn.14004ee94
cmp word [rbx], si
je 0x1400670b6
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
lea edx, [r9 + 0x30]
mov dword [rsp + 0x20], esi
call fcn.14001f090
cmp rax, rsi
jne 0x1400670b6
lea rdx, [0x1400f30a0]
lea rcx, [rsp + 0x48]
call fcn.140056108
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x48]
add rdx, r12
call fcn.140056108
mov rcx, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x118]
mov r8, rcx
mov qword [rsp + 0x28], rsi
mov word [rsp + 0x118], si
mov dword [rsp + 0x20], esi
call fcn.14000c478
lea rcx, [rsp + 0x48]
mov rsi, rax
call fcn.14004ea6c
jmp 0x14006763c
lea rcx, [rsp + 0x48]
call fcn.14004ea6c
mov ebx, dword [rsp + 0x44]
cmp byte [rsp + 0x40], sil
jne 0x1400671c5
xor edx, edx
mov rcx, rbp
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp rax, rsi
je 0x1400671c5
add rax, r12
je 0x1400671c5
lea rdx, [0x1400f3080]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400671c5
lea rdx, str.__hide__
lea rcx, [rdi + 0x20a]
mov r8d, 0x12
call fcn.14001a4c0
movsxd r11, ebx
lea rdx, str..DirExplorer.exe
lea rax, [r11 + r11]
mov r8d, 0x24
lea rcx, [rax + rbp]
mov qword [rsp + 0x68], rax
call fcn.14001a4c0
mov rcx, qword [rsp + 0x90]
lea ebp, [rbx + 0x11]
call fcn.1400cbf54
lea rcx, [0x140107de8]
mov ebx, esi
cmp eax, esi
sete bl
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, ebx
neg r11d
lea rax, str.GlobalPECMD:main:lock:PINT:FILE
lea rcx, [rsp + 0xa0]
sbb rdx, rdx
and rdx, rax
call fcn.140014bf0
cmp ebx, esi
je 0x140067429
lea rcx, str.NOTMPEXPLORER
call fcn.140018340
cmp eax, esi
jle 0x1400673a9
lea rcx, [rsp + 0xa0]
call fcn.140014c14
lea rcx, [0x140107de8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbp, qword [rsp + 0x90]
cmp byte [rsp + 0x118], sil
je 0x1400674cb
cmp qword [r15], rsi
jne 0x14006736d
lea rax, str..FromStartMenu
lea rdx, str..ToStartMenu
cmp r13d, esi
cmovne rdx, rax
movsxd rax, dword [rsp + 0x44]
lea rcx, [rbp + rax*2]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x68]
mov edx, 0x400
mov qword [rsp + 0x78], rsi
call fcn.140056040
mov rbp, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 0x80
lea rdi, [rbp + 2]
lea rcx, [rsp + 0x78]
mov r9d, 7
mov word [rdi], si
mov r8d, 0x80000000
mov dword [rsp + 0x28], 3
mov word [rbp], si
mov qword [rsp + 0x20], rsi
call fcn.140003590
mov rbx, qword [rsp + 0x78]
lea r9, [rsp + 0x44]
mov r8d, 0x7fe
mov rdx, rbp
mov rcx, rbx
mov dword [rsp + 0x44], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11d, dword [rsp + 0x44]
shr r11d, 1
mov eax, 0x3ff
cmp r11d, eax
cmova r11d, eax
mov dword [rsp + 0x44], r11d
movsxd rax, r11d
mov word [rbp + rax*2], si
mov eax, 0xfeff
cmp ax, word [rbp]
cmove rbp, rdi
cmp word [rbp], si
jne 0x140067344
mov eax, 1
lea r8, str.WIN10ToStartMenu
cmp r13d, esi
mov dword [rsp + 0x48], eax
lea rax, str.WIN10FromStartMenu
lea r9, [rsp + 0x48]
cmovne r8, rax
lea rax, [rsp + 0x60]
lea rdx, str.SOFTWAREPELOGONUSRCFG
mov qword [rsp + 0x28], rax
mov rcx, 0xffffffff80000002
mov word [rbp], si
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x60], 0x7fc
call fcn.14004fbd8
cmp eax, esi
je 0x140067313
mov word [rbp], si
mov word [rbp + 0x7fc], si
cmp word [rbp], si
jne 0x140067344
mov rcx, qword [0x140106d38]
mov eax, r13d
mov r9d, 0x3fe
neg eax
mov r8, rbp
sbb edx, edx
neg edx
add edx, 0x1505
call fcn.14004ee94
mov rdx, rbp
mov rcx, r15
call fcn.1400601ec
lea rcx, [rsp + 0x68]
call fcn.14004ea6c
cmp rbx, rsi
je 0x14006736d
cmp rbx, 0xffffffffffffffff
je 0x14006736d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rsp + 0x118], sil
je 0x1400674cb
mov rdx, qword [r15]
lea ebx, [r13 + 0x1505]
cmp rdx, rsi
je 0x140067535
cmp word [rdx], si
je 0x140067535
lea rcx, [rsp + 0x50]
call fcn.140060284
mov rbx, qword [rax]
jmp 0x140067598
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rsi
call fcn.140004534
movsxd rbx, eax
cmp ebx, esi
jle 0x140067417
mov rcx, qword [rsp + 0x48]
cmp word [rcx], si
je 0x140067417
lea rcx, [rcx + rbx*2]
lea rdx, [0x1400f3080]
mov r8d, 0x1a
call fcn.14001a4c0
mov rdx, qword [rsp + 0x48]
mov r13d, 1
mov r8d, r13d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x90]
lea r11d, [rbx + 0xd]
movsxd r8, r11d
add r8, r8
call fcn.14001a4c0
lea ebp, [rbx + 0xc]
jmp 0x14006741d
mov r13d, 1
lea rcx, [rsp + 0x48]
call fcn.14004ea6c
jmp 0x14006742f
mov r13d, 1
movsxd rax, ebp
lea rdx, str.__PINT__dir__base:__
mov r8d, 0x2a
lea rbx, [rdi + rax*2 + 0x21c]
mov rcx, rbx
call fcn.14001a4c0
mov rbp, qword [rsp + 0x68]
lea rcx, [rbx + 0x28]
mov r8, rbp
mov rdx, rdi
call fcn.14001a478
mov rdx, qword [rsp + 0x78]
mov eax, 0x22
mov word [rbx + rbp + 0x28], ax
mov eax, dword [rsp + 0x60]
lea rcx, [rbx + rbp + 0x2a]
inc eax
movsxd r8, eax
add r8, r8
call fcn.14001a4c0
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x118]
lea rdx, [rdi + 0x20a]
mov r8, rcx
mov qword [rsp + 0x28], rsi
mov word [rsp + 0x118], si
mov dword [rsp + 0x20], r13d
call fcn.14000c478
lea rcx, [rsp + 0xa0]
jmp 0x140067627
mov r9, qword [rsp + 0x108]
mov eax, 0x23
cmp ax, word [r9]
jne 0x14006751a
or dword [rsp + 0x118], 0xffffffff
add r9, r12
lea r8d, [rax + 9]
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x108]
mov qword [rsp + 0x108], r9
call fcn.140059ba8
mov ebx, dword [rsp + 0x118]
cmp ebx, esi
jge 0x140067535
jmp 0x140066e6e
lea rcx, str.TaskBand
mov rdx, r9
call fcn.14004fe38
cmp al, sil
je 0x140067586
lea ebx, [r13 + 0x150a]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
cmp rax, rsi
jne 0x140067555
mov esi, 1
jmp 0x14006763c
lea rcx, [rsp + 0x50]
mov edx, 0x1001
call fcn.1400560cc
mov r8, qword [rsp + 0x50]
mov r9d, 0x1000
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov rbx, qword [rsp + 0x50]
cmp word [rbx], si
jne 0x140067598
jmp 0x14006754b
lea rcx, [rsp + 0x50]
mov rdx, r9
call fcn.140060284
mov rbx, qword [rsp + 0x50]
cmp word [r14], si
je 0x140066e6e
mov rcx, r14
call fcn.1400188a8
mov rcx, rax
mov rdi, rax
call fcn.1400cbf54
cmp eax, esi
jne 0x1400675be
mov rsi, r12
jmp 0x14006763c
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.1400b9c48
mov r11, qword [rsp + 0x98]
cmp r11, rsi
je 0x14006754b
lea rcx, [0x140107de8]
mov word [r11 - 2], si
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, str.GlobalPECMD:main:lock:PINT
lea rcx, [rsp + 0xb0]
call fcn.140014bf0
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x70]
mov r8, rbx
call fcn.140007ac0
lea rcx, [rsp + 0xb0]
mov rsi, rax
call fcn.140014c14
lea rcx, [0x140107de8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x50]
call fcn.14004ea6c
lea rcx, [rsp + 0x58]
call fcn.14004ea6c
lea rcx, [rsp + 0x70]
call fcn.14004ea6c
lea rcx, [rsp + 0x80]
call fcn.14004ea6c
lea rcx, [rsp + 0x88]
call fcn.14004ea6c
mov rax, rsi
mov rbx, qword [rsp + 0x110]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret