Function at 0x1400b0a80
Capabilities:
Copy file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x388
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov rsi, qword [rsp + 0x3f8]
mov r14, qword [rsp + 0x400]
mov r15, r9
mov qword [rsp + 0xa8], r9
mov rbp, r8
mov rdi, rdx
mov r13, rcx
mov qword [rsp + 0xb8], rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
or rbx, 0xffffffffffffffff
mov qword [rsp + 0x88], rax
mov rdx, rbx
inc rdx
cmp byte [rdi + rdx], 0
jne 0x1400b0ae7
lea ecx, [r15 + r13]
add ecx, eax
mov rax, rbx
sub ecx, edx
nop dword [rax + rax]
inc rax
cmp byte [rax + rbp], 0
jne 0x1400b0b00
lea r12d, [rcx - 4]
movzx ecx, byte [rsp + 0x3f0]
add r12d, eax
mov rax, rbx
mov dword [rsp + 0x64], r12d
inc rax
cmp byte [rdi + rax], 0
jne 0x1400b0b20
mov r15d, r13d
sub r15d, dword [rsp + 0xa8]
add r15d, ecx
sub r15d, eax
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rax + rbp], 0
jne 0x1400b0b40
sub r15d, eax
mov rax, rbx
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x1400b0b50
sub r15d, eax
add r15d, 4
mov dword [rsp + 0xe8], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x120]
mov qword [rsp + 0xf0], rax
movzx eax, r15b
xor edx, edx
shl al, 4
mov r8d, 0x140
sub r12b, al
mov byte [rsp + 0x60], r12b
call fcn.1400e27d0
lea rdx, [rsp + 0x120]
lea rcx, str.ocelot
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, [rsp + 0x260]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor ecx, ecx
mov edx, 0xa2
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0x120]
xor edx, edx
mov r8d, 0x140
mov qword [rsp + 0x98], rax
call fcn.1400e27d0
lea rdx, [rsp + 0x120]
lea rcx, str.ocelot
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
movzx r9d, r12b
mov r8d, 0x10
mov rdx, rsi
xor ecx, ecx
mov qword [rsp + 0xd0], rax
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov rcx, rbx
mov r12d, eax
nop dword [rax + rax]
inc rcx
cmp byte [r14 + rcx], 0
jne 0x1400b0c30
imul ecx, dword [rsp + 0x88]
movzx eax, byte [rsp + 0x3f0]
lea ecx, [rcx*4]
add ecx, r13d
add ecx, eax
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x1400b0c60
sub ecx, eax
mov edx, 0x104
add ecx, 6
mov dword [rsp + 0x78], ecx
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov edx, dword [rsp + 0x64]
movzx ecx, byte [rsp + 0x3f0]
mov r10, rax
mov qword [rsp + 0xa0], rax
cmp edx, ecx
jge 0x1400b0d27
lea rcx, [rsp + 0x120]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0x120]
lea rcx, str.c0ret
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor ecx, ecx
mov edx, 0x20f
lea r8d, [rcx + 0x1c]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
xor ecx, ecx
lea r8d, [rcx + 7]
mov edx, 0x369
call qword [sym.imp.KERNEL32.dll_FindResourceA]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov edx, 0x1d3
lea r8d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov edx, dword [rsp + 0x64]
movzx ecx, byte [rsp + 0x3f0]
mov r10, qword [rsp + 0xa0]
mov rax, rbx
nop word [rax + rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x1400b0d30
mov r8d, dword [rsp + 0xa8]
mov r9, qword [rsp + 0x88]
imul eax, r13d
add eax, r9d
imul r8d, ecx
add r8d, eax
mov rax, rbx
nop word [rax + rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x1400b0d60
sub r8d, eax
movzx r11d, r12b
mov rax, rbx
mov dword [rsp + 0x7c], r8d
mov dword [rsp + 0x70], r11d
nop dword [rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x1400b0d80
mov ecx, dword [rsp + 0xf0]
imul ecx, r9d
sub ecx, r10d
add ecx, r11d
add ecx, r13d
sub ecx, eax
mov rax, rbx
inc rax
cmp byte [rax + rbp], 0
jne 0x1400b0da2
lea r10d, [rcx + 2]
mov rcx, rbx
add r10d, eax
movzx eax, dl
add al, al
mov dword [rsp + 0x6c], r10d
add dl, al
shl dl, 5
mov byte [rsp + 0x68], dl
nop dword [rax + rax]
inc rcx
cmp byte [rdi + rcx], 0
jne 0x1400b0dd0
movzx eax, r13b
imul cl
mov rcx, rbx
movzx r12d, al
movzx eax, dl
imul r9b
sub r12b, al
sub r12b, byte [rsp + 0x98]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400b0df7
add cl, 4
lea edx, [r11 + r11*2]
mov rax, rbx
add r12b, cl
movzx ecx, byte [rsp + 0x60]
mov dword [rsp + 0xc8], edx
add r12b, byte [rsp + 0xa8]
add r12b, byte [rsp + 0x3f0]
nop dword [rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x1400b0e30
imul eax, r13d
imul ecx, r15d
add eax, edx
add ecx, eax
mov rax, rbx
add ecx, dword [rsp + 0xa0]
nop
inc rax
cmp byte [r14 + rax], 0
jne 0x1400b0e50
sub ecx, eax
mov rax, rbx
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x1400b0e60
add ecx, eax
movsx eax, r12b
mov dword [rsp + 0x104], 0x20
mov dword [rsp + 0x100], ecx
mov rcx, qword [rsp + 0x100]
mov dword [rsp + 0xc0], eax
shr rcx, 0x20
mov edx, 0x104
imul ecx, eax
mov eax, r8d
imul eax, r9d
lea r15d, [rax + rax*8]
sub r15d, ecx
lea rcx, [rsp + 0x120]
sub r15d, r10d
add r15d, 4
mov dword [rsp + 0x90], r15d
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rcx, rbx
mov qword [rsp + 0xd8], rax
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400b0ed2
mov edx, dword [rsp + 0x6c]
movzx eax, r12b
imul dl
sub r13b, al
mov rax, rbx
sub r13b, byte [rsp + 0x68]
sub r13b, cl
inc rax
cmp byte [rax + rbp], 0
jne 0x1400b0ef3
add r13b, 0xd
mov rcx, rbx
add r13b, al
inc rcx
cmp byte [r14 + rcx], 0
jne 0x1400b0f06
mov eax, dword [rsp + 0x70]
mov r10, qword [rsp + 0x88]
mov r9, qword [rsp + 0xb8]
imul edx, edx, 0xfffffff7
lea eax, [rax*4]
add ecx, eax
mov rax, rbx
shl ecx, 2
sub edx, ecx
sub edx, r10d
sub edx, dword [rsp + 0x64]
add edx, r9d
inc rax
cmp byte [rax + rbp], 0
jne 0x1400b0f42
mov r8d, dword [rsp + 0x7c]
add eax, 0xfffffffb
movsx r11, r12b
add eax, edx
mov qword [rsp + 0x98], r11
mov dword [rsp + 0x74], eax
mov rax, rbx
imul r8d, r10d
mov dword [rsp + 0x80], r8d
inc rax
cmp byte [rsi + rax], 0
jne 0x1400b0f74
mov rcx, rbx
cmp byte [rcx + rbp + 1], 0
lea rcx, [rcx + 1]
jne 0x1400b0f80
lea edx, [r9 + rcx]
mov rcx, rbx
inc rcx
cmp byte [rdi + rcx], 0
jne 0x1400b0f92
lea r15d, [r15*2 + 0xa]
add eax, edx
sub r15d, r11d
add eax, ecx
sub r15d, r10d
sub r15d, dword [rsp + 0x64]
add r15d, eax
add r15d, r8d
add r15d, dword [rsp + 0x6c]
add r15d, dword [rsp + 0xa0]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0xe0], rax
cmp r12b, byte [rsp + 0x64]
jle 0x1400b0fff
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rcx, [rsp + 0x120]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
call qword [sym.imp.USER32.dll_GetActiveWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x120]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rdx, rbx
mov r12, rax
nop dword [rax + rax]
inc rdx
cmp byte [r14 + rdx], 0
jne 0x1400b1020
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x1400b1030
mov ecx, dword [rsp + 0x88]
imul edx, eax
movzx eax, byte [rsp + 0x3f0]
imul edx, eax
mov eax, dword [rsp + 0x6c]
add eax, eax
sub ecx, eax
mov eax, dword [rsp + 0x80]
add ecx, ecx
imul eax, dword [rsp + 0x78]
sub ecx, eax
movzx eax, byte [rsp + 0x60]
add edx, ecx
sub edx, eax
mov rax, qword [rsp + 0xb8]
sub edx, r12d
add eax, 3
sub edx, dword [rsp + 0x74]
sub edx, dword [rsp + 0x98]
add eax, edx
mov dword [rsp + 0x80], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
movzx r9d, byte [rsp + 0x60]
xor ecx, ecx
movsx eax, r13b
mov r13d, dword [rsp + 0x80]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 0x10
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
lea r8, str.c0a0
lea rdx, str.inspector
mov ecx, r13d
mov dword [rsp + 0x20], 0x10
mov dword [rsp + 0xb0], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rdx, str.ocelot
mov r8d, r13d
mov rcx, rsi
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [rsp + 0x90]
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], 0x10
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x70]
mov r9d, eax
mov r8, r14
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x78]
mov rdx, rdi
mov dword [rsp + 0x20], ecx
mov ecx, dword [rsp + 0x6c]
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, [rsp + 0x120]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movsxd rcx, dword [rsp + 0x6c]
mov eax, dword [rsp + 0x74]
xor r8d, r8d
mov r9d, r13d
lea rdx, str.c0ret
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x70]
mov r8, rdi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov ecx, dword [rsp + 0x64]
call qword [sym.imp.USER32.dll_CreateWindowExA]
xor ecx, ecx
mov edx, 0x313
lea r8d, [rcx + 0x19]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, r13d
mov qword [rsp + 0xc0], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rbx
mov rdx, rax
nop dword [rax]
inc rcx
cmp byte [r14 + rcx], 0
jne 0x1400b11f0
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x1400b1200
imul ecx, eax
mov eax, dword [rsp + 0x6c]
imul eax, dword [rsp + 0x98]
add ecx, eax
mov eax, dword [rsp + 0x64]
lea eax, [rax + rax*2]
add ecx, ecx
add eax, eax
sub edx, ecx
sub r12d, eax
mov eax, dword [rsp + 0xb0]
sub r12d, dword [rsp + 0xa0]
lea eax, [rax + rax*2]
sub eax, dword [rsp + 0xc0]
sub r12d, 0x10
imul r12d, dword [rsp + 0x88]
imul eax, dword [rsp + 0xd8]
lea ecx, [r12 + rdx*2]
add ecx, eax
movzx eax, byte [rsp + 0x60]
imul eax, dword [rsp + 0xd0]
imul eax, dword [rsp + 0xc8]
sub ecx, eax
mov eax, dword [rsp + 0x74]
lea eax, [rax + rax*8]
sub ecx, eax
mov rax, rbx
inc rax
cmp byte [rax + rbp], 0
jne 0x1400b1281
nop word [rax + rax]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x1400b1290
imul eax, ebx
add ecx, eax
movzx eax, byte [rsp + 0x3f0]
sub ecx, dword [rsp + 0xa8]
sub ecx, eax
mov eax, dword [rsp + 0x7c]
sub ecx, dword [rsp + 0x80]
add eax, 0xffffffa3
sub ecx, r13d
sub ecx, dword [rsp + 0xe0]
sub ecx, r15d
add ecx, dword [rsp + 0xb8]
add ecx, r13d
add ecx, dword [rsp + 0x90]
add eax, ecx
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x388
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret