Function at 0x1400016e0
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4a8
movaps xmmword [rsp + 0x490], xmm6
mov ecx, 0x104
lea rbx, [rsp + 0x180]
lea r12, [rsp + 0x100]
movq xmm6, rbx
lea rdi, [rsp + 0x270]
movq xmm1, r12
punpcklqdq xmm6, xmm1
lea rsi, [rsp + 0x380]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9, rdi
mov edx, 0x104
mov rcx, rsi
lea r8, str._swatchdog__d.exe
mov dword [rsp + 0x20], eax
call sym.snprintf
xor r8d, r8d
mov rdx, rsi
lea rcx, str.watchdog_template.exe
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x140001ae8
lea rax, str.LocalLutrisExitStatus
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], 0x100
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x28], rax
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test rax, rax
mov rcx, rax
mov qword [0x140010048], rax
je 0x1400017ea
xor r9d, r9d
xor r8d, r8d
mov edx, 2
mov qword [rsp + 0x20], 0x100
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
mov rdx, rax
je 0x140001b9f
mov ecx, 0x20
xor eax, eax
mov rdi, rdx
rep stosq qword [rdi], rax
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov rbp, qword [sym.imp.KERNEL32.dll_CreateThread]
lea r8, [sym.keyboardWatchdog]
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
lea r14, [0x140010060]
call rbp
lea r15, [r14 + 0x20]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call sym.srand
mov r13, qword [sym.imp.KERNEL32.dll_GetTickCount]
nop dword [rax + rax]
call sym.rand
add r14, 1
mov edi, eax
call r13
xor edi, eax
mov byte [r14 - 1], dil
cmp r14, r15
jne 0x140001838
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r13, [0x140010080]
mov rdi, rbx
lea r15, [rsp + 0x174]
lea r14, sym.spawnBrowserChaos
mov qword [rsp + 0x58], rax
call rax
mov edx, pe_nt_image_headers64
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov qword [rsp + 0x60], rax
call rax
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov ecx, 0x80000003
mov qword [rsp + 0x68], rax
call rax
movdqa xmm0, xmmword [0x14000c130]
lea rdx, [0x140010060]
mov rcx, r13
mov dword [0x1400100b0], 0x1e
movaps xmmword [0x140010080], xmm0
movdqa xmm0, xmmword [0x14000c140]
movaps xmmword [0x140010090], xmm0
movdqa xmm0, xmmword [0x14000c150]
movaps xmmword [0x1400100a0], xmm0
call sym.encryptConfig
xor eax, eax
mov ecx, 0x1d
mov r9, rsi
rep stosq qword [rdi], rax
mov ecx, 0xe
mov rdi, r12
xor edx, edx
rep stosq qword [rdi], rax
movaps xmmword [rsp + 0x380], xmm6
lea r8, [sym.threadWatchdog]
xor esi, esi
mov dword [rdi], 0
lea rdi, [rsp + 0x100]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rbp
mov qword [rsp + 0x50], rax
nop dword [rax + rax]
mov ecx, 0x4c
call sym.malloc
test rax, rax
mov r12, rax
je 0x140001a14
mov rax, qword [r13]
lea rdx, [0x140010060]
mov rcx, r12
mov qword [r12], rax
mov rax, qword [0x140010088]
mov qword [r12 + 8], rax
mov rax, qword [0x140010090]
mov qword [r12 + 0x10], rax
mov rax, qword [0x140010098]
mov qword [r12 + 0x18], rax
mov rax, qword [0x1400100a0]
mov qword [r12 + 0x20], rax
mov rax, qword [0x1400100a8]
mov qword [r12 + 0x28], rax
mov rax, qword [0x1400100b0]
mov qword [r12 + 0x30], rax
mov rax, qword [0x1400100b8]
mov qword [r12 + 0x38], rax
mov rax, qword [0x1400100c0]
mov qword [r12 + 0x40], rax
mov eax, dword [0x1400100c8]
mov dword [r12 + 0x48], eax
call sym.decryptConfig
xor edx, edx
xor ecx, ecx
mov r8, qword [r14 + rsi]
mov qword [rsp + 0x28], rdi
mov r9, r12
mov dword [rsp + 0x20], 0
call rbp
test rax, rax
mov qword [rsi + rbx], rax
je 0x140001a14
mov rcx, rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
add rdi, 4
add rsi, 8
cmp r15, rdi
jne 0x140001940
lea rsi, [rsp + 0x268]
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbp, qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word cs:[rax + rax]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140001a61
xor edx, edx
call rbp
mov rcx, qword [rbx]
call rdi
add rbx, 8
cmp rbx, rsi
jne 0x140001a50
mov rsi, qword [rsp + 0x50]
test rsi, rsi
je 0x140001a88
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x80000000
mov rax, qword [rsp + 0x68]
call rax
mov rax, qword [rsp + 0x58]
call rax
mov edx, 0x20
mov rcx, rax
mov rax, qword [rsp + 0x60]
call rax
call sym.performBasicCleanup
call sym.setNormalExit
mov rcx, qword [0x140010048]
test rcx, rcx
je 0x140001ac7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
movaps xmm6, xmmword [rsp + 0x490]
xor eax, eax
add rsp, 0x4a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
mov ecx, 0xc
xor r9d, r9d
mov qword [rsp + 0x70], 0
lea rdi, [rsp + 0x94]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x78], 0
rep stosq qword [rdi], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x80], 0
mov rcx, rsi
mov dword [rsp + 0x90], 0x68
mov dword [rdi], 0
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140001b91
mov rcx, qword [rsp + 0x78]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0x70]
call rdi
jmp 0x140001773
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x140001773
mov rcx, qword [0x140010048]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400017ea