Function at 0x140014b30
Capabilities:
Copy file
Create directory

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xab0
lea rbp, [rsp + 0x80]
and rbp, 0xffffffffffffffc0
mov rax, qword [0x140106438]
xor rax, rsp
mov qword [rbp + 0xa20], rax
mov qword [rbp + 0x38], rcx
xor edi, edi
mov ecx, 0x10000
mov qword [rbp], rdi
mov r14, r8
mov qword [rbp + 0x28], r8
mov rbx, rdx
xor r15d, r15d
call fcn.14009b5b4
mov qword [rbp + 0x10], rax
mov rsi, rax
test rbx, rbx
je 0x140015648
test r14, r14
je 0x140015648
test rax, rax
je 0x140015648
lea r13, [rdi - 1]
cmp byte [r14], dil
jne 0x140014bc5
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea edx, [rdi + 1]
mov ecx, r13d
call fcn.1400527d0
mov rcx, rbx
call fcn.14005fb50
mov qword [rbp + 8], rax
mov r12, rax
test rax, rax
je 0x14001563c
lea rsi, [0x140000000]
nop dword [rax]
nop dword [rax + rax]
cmp dword [0x140111620], 0
jne 0x140015630
test r12, r12
jne 0x140014c06
xor edi, edi
jmp 0x140014c18
mov rax, qword [r12]
lea rdi, [0x1400dc9a8]
test rax, rax
cmovne rdi, rax
mov qword [rbp + 0x30], rdi
mov rax, r13
nop
inc rax
cmp byte [rdi + rax], 0
jne 0x140014c20
test rax, rax
je 0x14001552f
mov rax, r13
inc rax
cmp byte [r14 + rax], 0
jne 0x140014c35
mov rdx, qword [0x1401432d8]
mov rcx, r13
nop dword [rax]
inc rcx
cmp byte [rdx + rcx], 0
jne 0x140014c50
add eax, ecx
mov rcx, r13
nop
inc rcx
cmp byte [rdi + rcx], 0
jne 0x140014c60
add ecx, 0x1b
add eax, ecx
mov ecx, 1
movsxd rbx, eax
mov rdx, rbx
call fcn.1400966e0
mov qword [rbp + 0x20], rax
mov r15, rax
test rax, rax
je 0x14001561c
mov rax, qword [0x1401432d8]
lea r9, [0x1400dc7c8]
mov qword [rsp + 0x30], rdi
mov r8, r13
mov qword [rsp + 0x28], r14
mov rdx, rbx
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.1400034e0
test eax, eax
js 0x140015628
test r12, r12
je case.0x140014cf9.4
lea rcx, [rbp + 0x40]
mov r8d, 0x800
lea rdx, [r12 + 0x40]
call fcn.140093550
mov rax, qword [rbp + 0x58]
shr rax, 0x18
movzx eax, al
add eax, 0xfffffffc
cmp eax, 8
ja case.0x140014cf9.4
cdqe
mov ecx, dword [rsi + rax*4 + 0x15680]
add rcx, rsi
jmp rcx
mov byte [0x14015b418], 2
cmp byte [r12 + 8], 0
je 0x140014f41
cmp dword [0x1401431a4], 0
jne 0x140014e8d
mov rcx, r15
call fcn.1400a1b50
mov r14, rax
test rax, rax
jne 0x140014eed
lea rcx, str.Could_not_allocate_string_for_sanitized_path
call fcn.140041aa0
mov rcx, r14
call fcn.140003550
mov rcx, rax
mov rbx, rax
call fcn.1400a4a40
test rbx, rbx
je 0x140014d5b
mov rcx, rbx
call fcn.14009b5a0
cmp dword [0x140112908], 0
je 0x140014e85
mov rcx, r12
call fcn.14005eb30
movsxd rdx, dword [0x1401431a0]
movabs rdi, 0x2b6109100
add rax, rdi
imul rcx, rax, 0x989680
lea eax, [rdx + 1]
movsxd rbx, eax
lea rsi, [rsi + rdx*8]
mov dword [rsi + 0x1432f8], ecx
lea rsi, [rsi + 0x1432f8]
sar rcx, 0x20
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
mov dword [rsi + 4], ecx
mov rcx, r12
shr rdx, 1
lea rax, [rdx + rdx*2]
sub rbx, rax
call fcn.14005ec70
add rax, rdi
lea rdx, [0x140000000]
imul rcx, rax, 0x989680
movsxd rax, ebx
lea rdi, [rdx + 0x1432f8]
lea rdi, [rdi + rax*8]
lea eax, [rbx + 1]
mov dword [rdi], ecx
movsxd rbx, eax
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
sar rcx, 0x20
shr rdx, 1
mov dword [rdi + 4], ecx
mov rcx, r12
lea rax, [rdx + rdx*2]
sub rbx, rax
call fcn.14005edb0
movabs rcx, 0x2b6109100
lea rdx, [0x140000000]
add rax, rcx
lea r11, [rdx + 0x1432f8]
imul rcx, rax, 0x989680
movsxd rax, ebx
mov r9, rsi
lea r11, [r11 + rax*8]
mov r8, rdi
mov dword [r11], ecx
lea eax, [rbx + 1]
movsxd r10, eax
movabs rax, 0xaaaaaaaaaaaaaaab
mul r10
sar rcx, 0x20
shr rdx, 1
mov dword [r11 + 4], ecx
mov rcx, r14
mov qword [0x1401432e0], r11
lea rax, [rdx + rdx*2]
mov rdx, r11
sub r10, rax
mov dword [0x1401431a0], r10d
call fcn.140014a40
mov rcx, r14
call fcn.14009b5a0
mov rcx, r12
call fcn.14005fa30
mov rdx, rax
test rax, rax
je 0x140014ece
mov rax, qword [0x1401432d8]
mov r8, r13
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140014eb0
mov rcx, qword [rbp + 0x38]
add r8, r15
call fcn.140014b30
test eax, eax
jne 0x140015628
mov r12, qword [rbp + 8]
mov rcx, r15
call fcn.14009b5a0
mov r14, qword [rbp + 0x28]
lea rsi, [0x140000000]
xor r15d, r15d
jmp 0x140015533
lea rdx, [rax + 2]
mov rax, r13
inc rax
cmp byte [r14 + rax], 0
jne 0x140014ef4
mov rcx, rdx
sub rcx, r14
cmp rcx, rax
jae 0x140014d3b
movzx eax, byte [rdx]
cmp al, 0x2a
jne 0x140014f24
mov byte [rdx], 0x5f
mov al, 0x5f
cmp al, 0x3c
jne 0x140014f2d
mov byte [rdx], 0x5f
mov al, 0x5f
jmp 0x140014f31
cmp al, 0x3f
jne 0x140014f19
mov byte [rdx], 0x5f
mov al, 0x5f
cmp al, 0x3e
je 0x140014f39
cmp al, 0x3a
je 0x140014f39
cmp al, 0x7c
jne 0x140014f3c
mov byte [rdx], 0x5f
inc rdx
jmp 0x140014ef1
mov rsi, qword [r12 + 0x78]
lea rax, [rbp + 0x840]
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov r9, r15
mov r8, rdi
mov rcx, r14
call fcn.140013190
mov rcx, r15
test eax, eax
je 0x140014f77
call fcn.14009b5a0
xor r15d, r15d
jmp 0x140015528
mov rdx, rsi
call fcn.1400146c0
xor ebx, ebx
cmp byte [rbp + rbx + 0x845], 0
je 0x140015060
lea rax, [0x140000000]
cmp dword [rax + rbx*4 + 0x112910], 0
je 0x140015060
mov rax, qword [rax + rbx*8 + 0xd1770]
lea r9, str._s_syslinux__s__s
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x9a0]
lea rax, [0x140109ee8]
mov r8, r13
mov qword [rsp + 0x28], rax
mov edx, 0x80
lea rax, [0x1400d97a4]
mov qword [rsp + 0x20], rax
call fcn.1400034e0
lea rcx, [rbp + 0x9a0]
mov byte [rbp + 0xa1f], 0
call fcn.140003550
mov rcx, r15
mov r14, rax
call fcn.140003550
xor r8d, r8d
mov rdx, rax
mov rcx, r14
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
test r14, r14
je 0x14001502d
mov rcx, r14
call fcn.14009b5a0
test rdi, rdi
je 0x14001503a
mov rcx, rdi
call fcn.14009b5a0
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r15d, r15d
jne 0x140015072
call fcn.140041e50
mov rdx, rax
lea rcx, str.__Could_not_replace_file:__s
call fcn.140041aa0
mov r15, qword [rbp + 0x20]
inc rbx
cmp rbx, 2
jae 0x1400150f5
jmp 0x140014f81
lea r8, [rbp + 0x980]
mov ecx, 2
lea rdx, [rbp + 0x9a0]
call fcn.14003c000
test eax, eax
je 0x1400150c7
xor edi, edi
lea rax, [0x14010a780]
movsxd rdx, edi
add rdx, rax
lea rcx, [rbp + 0x980]
mov r8d, 0x20
call fcn.140093ed0
test eax, eax
je 0x1400150c2
add edi, 0x20
cmp edi, 0xbe0
jb 0x140015090
xor eax, eax
jmp 0x1400150c7
mov eax, 1
test eax, eax
lea rdx, [0x1400d984c]
lea rax, [0x1400d9848]
cmovne rdx, rax
lea rcx, str.__Replaced_with_local_version__s
call fcn.140041aa0
mov r15, qword [rbp + 0x20]
cmp rbx, 2
jb 0x140015524
mov rcx, r15
mov ebx, 1
call fcn.1400a1b50
mov r14, rax
test rax, rax
jne 0x140015118
lea rcx, str.Could_not_allocate_string_for_sanitized_path
call fcn.140041aa0
jmp 0x140015187
lea rdx, [rax + 2]
nop dword [rax]
mov rcx, r13
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140015123
mov rax, rdx
sub rax, r14
cmp rax, rcx
jae 0x140015174
movzx eax, byte [rdx]
cmp al, 0x2a
jne 0x140015153
mov byte [rdx], 0x5f
xor ebx, ebx
mov al, 0x5f
cmp al, 0x3c
jne 0x14001515e
mov byte [rdx], 0x5f
xor ebx, ebx
mov al, 0x5f
jmp 0x140015162
cmp al, 0x3f
jne 0x140015146
mov byte [rdx], 0x5f
xor ebx, ebx
mov al, 0x5f
cmp al, 0x3e
je 0x14001516a
cmp al, 0x3a
je 0x14001516a
cmp al, 0x7c
jne 0x14001516f
mov byte [rdx], 0x5f
xor ebx, ebx
inc rdx
jmp 0x140015120
test ebx, ebx
jne 0x140015187
mov rdx, r14
lea rcx, str.__File_name_sanitized_to__s
call fcn.140041aa0
mov rcx, r14
mov qword [rsp + 0x30], rsi
call fcn.140042c90
mov qword [rbp], rax
mov rdi, rax
cmp rax, r13
jne 0x1400151ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140041e50
mov rdx, rax
lea rcx, str.__Unable_to_create_file:__s
call fcn.140041aa0
lea ecx, [rbx - 5]
cmp ecx, 1
ja 0x140015554
lea rdx, [r14 + 3]
test rdx, rdx
lea rcx, str._NULL_
cmovne rcx, rdx
lea rdx, str.autorun.inf
call fcn.1400abbf0
test eax, eax
jne 0x140015554
lea rcx, str.__NOTE:_This_is_usually_caused_by_a_poorly_designed_security_solution._See_https:__bit.ly_40qDtyF._r_n__This_file_will_be_skipped_for_now__but_you_should_really_look_into_using_a_SMARTER_antivirus_solution.
call fcn.140041aa0
jmp 0x14001537c
cmp qword [0x140143330], 0
je 0x140015215
lea rcx, [rbp + 0x880]
call fcn.140038070
test rsi, rsi
jle 0x140015320
mov r12, qword [rbp + 8]
cmp dword [0x140111620], 0
jne 0x140015577
lea rax, [rsi + 0x7ff]
mov rcx, r12
cqo
and edx, 0x7ff
add rax, rdx
mov rdx, qword [rbp + 0x10]
sar rax, 0xb
mov rdi, rax
cmp rax, 0x20
mov eax, 0x20
cmovg rdi, rax
mov r8, rdi
call fcn.14005f0a0
mov rbx, rax
test rax, rax
js 0x1400155ef
cmp rsi, rax
cmovl ebx, esi
cmp qword [0x140143330], 0
je 0x140015293
mov rdx, qword [rbp + 0x10]
lea rcx, [rbp + 0x880]
mov r8d, ebx
call fcn.14003ba40
mov rdx, qword [rbp + 0x10]
lea r9, [rbp + 0x18]
mov rcx, qword [rbp]
mov r8d, ebx
call fcn.140042b10
inc qword [0x1401072c8]
test eax, eax
je 0x140015563
mov eax, dword [rbp + 0x18]
cmp eax, ebx
jne 0x14001555a
mov r8, qword [0x140143318]
sub rsi, rax
add r8, rdi
mov rax, r8
mov qword [0x140143318], r8
sub rax, qword [0x1401431a8]
cmp rax, 0x80
jb 0x140015313
mov r9, qword [0x140143310]
mov edx, 0xc9f
mov ecx, 7
mov dword [rsp + 0x20], 0
call fcn.1400527d0
mov rax, qword [0x140143318]
mov qword [0x1401431a8], rax
test rsi, rsi
jg 0x140015222
mov rdi, qword [rbp]
cmp qword [0x140143330], 0
je 0x14001537c
lea rcx, [rbp + 0x880]
call fcn.14003bf10
xor ebx, ebx
nop dword [rax + rax]
movzx r8d, byte [rbp + rbx + 0x880]
lea rdx, str._02x
mov rcx, qword [0x140143330]
call fcn.140001010
inc rbx
cmp rbx, 0x10
jb 0x140015340
mov rcx, qword [0x140143330]
lea r8, [r15 + 3]
lea rdx, str.__.__s_n
call fcn.140001010
cmp dword [0x140112908], 0
mov r12, qword [rbp + 8]
je 0x1400154d0
mov rcx, r12
call fcn.14005eb30
movsxd rdx, dword [0x1401431a0]
lea rdi, [0x140000000]
movabs rcx, 0x2b6109100
lea rsi, [rdi + 0x1432f8]
add rax, rcx
lea rsi, [rsi + rdx*8]
imul rcx, rax, 0x989680
lea eax, [rdx + 1]
movsxd rbx, eax
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
mov dword [rsi], ecx
sar rcx, 0x20
shr rdx, 1
mov dword [rsi + 4], ecx
mov rcx, r12
lea rax, [rdx + rdx*2]
sub rbx, rax
call fcn.14005ec70
movabs rcx, 0x2b6109100
add rax, rcx
imul rcx, rax, 0x989680
movsxd rax, ebx
lea rdi, [rdi + rax*8]
lea eax, [rbx + 1]
mov dword [rdi + 0x1432f8], ecx
movsxd rbx, eax
lea rdi, [rdi + 0x1432f8]
sar rcx, 0x20
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
mov dword [rdi + 4], ecx
mov rcx, r12
shr rdx, 1
lea rax, [rdx + rdx*2]
sub rbx, rax
call fcn.14005edb0
movabs rcx, 0x2b6109100
lea rdx, [0x140000000]
add rax, rcx
lea r10, [rdx + 0x1432f8]
imul rcx, rax, 0x989680
movsxd rax, ebx
mov r8, rdi
mov rdi, qword [rbp]
lea r10, [r10 + rax*8]
mov dword [r10], ecx
lea eax, [rbx + 1]
sar rcx, 0x20
mov r9, rsi
mov dword [r10 + 4], ecx
movsxd rcx, eax
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
mov qword [0x1401432e0], r10
shr rdx, 1
lea rax, [rdx + rdx*2]
mov rdx, r10
sub rcx, rax
mov dword [0x1401431a0], ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x1400154d0
call fcn.140041e50
mov rdx, rax
lea rcx, str.__Could_not_set_timestamp:__s
call fcn.140041aa0
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400154e7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp], r13
inc qword [0x1401072c8]
cmp byte [rbp + 0x840], 0
jne 0x140015500
cmp byte [rbp + 0x841], 0
je 0x140015517
mov r8, qword [rbp + 0x30]
lea r9, [rbp + 0x840]
mov rdx, qword [rbp + 0x28]
mov rcx, r14
call fcn.140013cf0
mov rcx, r14
call fcn.14009b5a0
jmp 0x140014ed2
mov r14, qword [rbp + 0x28]
lea rsi, [0x140000000]
mov r12, qword [rbp + 8]
mov rcx, r12
call fcn.14005fb50
mov qword [rbp + 8], rax
mov r12, rax
test rax, rax
je 0x140015638
mov rdi, qword [rbp]
jmp 0x140014bf0
mov r12, qword [rbp + 8]
jmp 0x14001557b
lea rax, str.Short_write_detected
jmp 0x140015568
call fcn.140041e50
mov rdx, rax
lea rcx, str.__Error_writing_file:__s
call fcn.140041aa0
mov rdi, qword [rbp]
test r12, r12
je 0x1400155bf
mov rcx, qword [r12]
mov qword [r12 + 0x38], 0
test rcx, rcx
je 0x140015597
call fcn.14009b5a0
mov rcx, qword [r12 + 0x30]
mov qword [r12], 0
test rcx, rcx
je 0x1400155ae
call fcn.14009b5a0
mov rcx, r12
mov qword [r12 + 0x30], 0
call fcn.14009b5a0
lea rcx, [rdi - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400155d2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc qword [0x1401072c8]
mov rcx, r14
call fcn.14009b5a0
mov rcx, r15
call fcn.14009b5a0
mov rcx, qword [rbp + 0x10]
jmp 0x14001564b
mov rax, qword [0x1401432d8]
nop word [rax + rax]
cmp byte [rax + r13 + 1], 0
lea r13, [r13 + 1]
jne 0x140015600
lea rdx, [r15 + r13]
lea rcx, str.__Error_reading_UDF_file__s
jmp 0x140015572
lea rcx, str.Error_allocating_file_name
call fcn.140041aa0
xor r14d, r14d
jmp 0x140015577
xor r14d, r14d
jmp 0x14001557b
mov rsi, qword [rbp + 0x10]
mov rcx, rsi
call fcn.14009b5a0
xor eax, eax
jmp 0x140015655
mov rcx, rax
call fcn.14009b5a0
mov eax, 1
mov rcx, qword [rbp + 0xa20]
xor rcx, rsp
call fcn.140092060
mov rbx, qword [rsp + 0xb08]
add rsp, 0xab0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret