Function at 0x140004840
Capabilities:
Copy file
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xe48
mov rax, qword [0x140016008]
xor rax, rsp
mov qword [rsp + 0xe30], rax
mov dword [rsp + 0x8b0], 1
mov byte [rsp + 0x50], 0
lea rdi, [rsp + 0x51]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov byte [rsp + 0x8c0], 0
lea rdi, [rsp + 0x8c1]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov byte [rsp + 0x480], 0
lea rdi, [rsp + 0x481]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov dword [rsp + 0x478], 0
mov rax, qword [rsp + 0xe60]
mov qword [rsp + 0xe10], rax
lea rax, [rsp + 0x480]
mov qword [rsp + 0xe18], rax
mov rax, qword [rsp + 0xe18]
mov qword [rsp + 0xe20], rax
mov rax, qword [rsp + 0xe10]
movzx eax, byte [rax]
mov byte [rsp + 0xe28], al
mov rcx, qword [rsp + 0xe18]
movzx eax, byte [rsp + 0xe28]
mov byte [rcx], al
mov rax, qword [rsp + 0xe10]
add rax, 1
mov qword [rsp + 0xe10], rax
mov rax, qword [rsp + 0xe18]
add rax, 1
mov qword [rsp + 0xe18], rax
cmp byte [rsp + 0xe28], 0
jne 0x1400048f0
lea rdi, [rsp + 0x480]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
sub rdi, 1
lea rsi, [0x1400146c0]
mov ecx, 5
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0xcc0]
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x8a8], rax
cmp qword [rsp + 0x8a8], 0xffffffffffffffff
jne 0x14000499b
xor al, al
jmp 0x140004c60
mov dword [rsp + 0x880], 0
lea rdi, [rsp + 0x884]
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
mov dword [rsp + 0x450], 0
lea rdi, [rsp + 0x454]
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
mov dword [rsp + 0xe00], 0
jmp 0x1400049f1
mov eax, dword [rsp + 0xe00]
add eax, 1
mov dword [rsp + 0xe00], eax
cmp dword [rsp + 0xe00], 0x64
jge 0x140004c50
cmp dword [rsp + 0x8b0], 0
je 0x140004c50
lea r9, [rsp + 0xcec]
mov r8, qword [rsp + 0xe60]
lea rdx, [0x1400146c8]
lea rcx, [rsp + 0x50]
call fcn.1400059f0
lea r9, [rsp + 0xcec]
mov r8, qword [rsp + 0xe68]
lea rdx, [0x1400146d0]
lea rcx, [rsp + 0x8c0]
call fcn.1400059f0
mov eax, dword [rsp + 0xcc0]
and eax, 0x10
test eax, eax
jne 0x140004a76
lea rdx, str.New_Ver
lea rcx, [rsp + 0x50]
call fcn.140004040
test rax, rax
je 0x140004a7b
jmp 0x140004c2e
lea r8, [rsp + 0x880]
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
lea r8, [rsp + 0x450]
xor edx, edx
lea rcx, [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
mov dword [rsp + 0xe04], 0
mov dword [rsp + 0xe08], 0
mov eax, dword [rsp + 0x470]
cmp dword [rsp + 0x8a0], eax
jne 0x140004af3
lea rcx, [rsp + 0x50]
call fcn.140004470
mov dword [rsp + 0xe04], eax
lea rcx, [rsp + 0x8c0]
call fcn.140004470
mov dword [rsp + 0xe08], eax
mov eax, dword [rsp + 0x470]
cmp dword [rsp + 0x8a0], eax
jne 0x140004b17
mov eax, dword [rsp + 0xe08]
cmp dword [rsp + 0xe04], eax
je 0x140004c2e
mov eax, dword [rsp + 0xe08]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x470]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x8c0]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xe04]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x8a0]
lea r8, [rsp + 0x50]
lea rdx, str.TC_Patch_CopyFile__s__d___d____s__d___d_
mov ecx, 1
call fcn.1400040b0
mov dword [rsp + 0xe0c], 0
jmp 0x140004b81
mov eax, dword [rsp + 0xe0c]
add eax, 1
mov dword [rsp + 0xe0c], eax
cmp dword [rsp + 0xe0c], 5
jge 0x140004c2e
lea rdx, [0x140014710]
lea rcx, [rsp + 0x50]
call fcn.1400047c0
lea rdx, str.af_sign.exe
lea rcx, [rsp + 0x50]
call fcn.1400047c0
lea rdx, str.af_io32.exe
lea rcx, [rsp + 0x50]
call fcn.1400047c0
lea rdx, str.af_kb32.exe
lea rcx, [rsp + 0x50]
call fcn.1400047c0
xor r8d, r8d
lea rdx, [rsp + 0x8c0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x140004bef
jmp 0x140004c2e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, dword [rsp + 0xe0c]
add r8d, 1
lea rax, [rsp + 0x8c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea rdx, str.TC_Patch_CopyFile_err__d___s___s_
mov ecx, 1
call fcn.1400040b0
jmp 0x140004b70
lea rdx, [rsp + 0xcc0]
mov rcx, qword [rsp + 0x8a8]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [rsp + 0x8b0], eax
jmp 0x1400049e0
mov rcx, qword [rsp + 0x8a8]
call qword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
mov rcx, qword [rsp + 0xe30]
xor rcx, rsp
call fcn.1400059d0
add rsp, 0xe48
pop rdi
pop rsi
ret