Function at 0x1400035e0
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x420
movaps xmmword [rsp + 0x410], xmm6
mov ebx, ecx
mov ecx, 0x1d
mov edx, 0xd9
call fcn.1400027f0
mov rsi, rax
mov ecx, 0xfbaa0841
mov edx, 0x26
mov r8d, 0xf67c37
mov r9d, 0x7f
call fcn.1400027f0
lea rdx, [rsp + 0x1d0]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
lea rcx, [0x140004fe8]
mov r8, rsi
mov r9, rax
call fcn.140002800
mov rsi, rax
xorps xmm6, xmm6
movaps xmmword [rsp + 0x140], xmm6
movaps xmmword [rsp + 0x130], xmm6
movaps xmmword [rsp + 0x120], xmm6
movaps xmmword [rsp + 0x110], xmm6
movaps xmmword [rsp + 0x100], xmm6
movaps xmmword [rsp + 0xf0], xmm6
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
mov ecx, 0x100
mov edx, 0x69
mov r8, rsi
mov r9, rsi
call fcn.1400027f0
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x100
mov rdx, rsi
call fcn.1400027f0
lea rdx, [rsp + 0x210]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test bl, bl
je 0x1400038a4
mov rbx, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rbx
mov esi, eax
mov ecx, 7
mov edx, eax
mov r8d, eax
call fcn.1400027f0
mov rcx, rax
mov eax, esi
xor edx, edx
div ecx
mov edi, eax
mov ecx, 0x3e8
mov edx, esi
mov r8d, esi
call fcn.1400027f0
mov rcx, rax
mov eax, edi
xor edx, edx
div ecx
mov edi, edx
mov ecx, 1
call fcn.1400027f0
add edi, eax
call rbx
mov eax, eax
mov ebx, 0xaaaaaaab
imul rbx, rax
shr rbx, 0x21
mov ecx, 0x64
mov edx, 0x47
call fcn.1400027f0
mov rcx, rax
mov eax, ebx
xor edx, edx
div ecx
lea ecx, [rdx + 1]
mov edx, 0x23
mov r8d, esi
call fcn.1400027f0
mov rbx, rax
mov edx, 0xdb
mov rcx, rdi
mov r8d, esi
call fcn.1400027f0
mov dword [rsp + 0x20], eax
lea rdi, [rsp + 0x310]
lea rdx, [rsp + 0x1d0]
lea r8, [rsp + 0x210]
mov rcx, rdi
mov r9d, ebx
call qword [sym.imp.USER32.dll_wsprintfA]
xor ecx, ecx
mov edx, esi
mov r8d, esi
call fcn.1400027f0
lea rcx, [rsp + 0x50]
mov rdx, rdi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
movaps xmmword [rsp + 0x1a0], xmm6
movaps xmmword [rsp + 0x190], xmm6
movaps xmmword [rsp + 0x180], xmm6
movaps xmmword [rsp + 0x170], xmm6
movaps xmmword [rsp + 0x160], xmm6
movaps xmmword [rsp + 0x150], xmm6
mov qword [rsp + 0x1b0], 0
mov ecx, 0x68
mov edx, 0xf4
call fcn.1400027f0
mov dword [rsp + 0x150], eax
mov qword [rsp + 0x160], 0
mov edx, 0xec193d
xor ecx, ecx
call fcn.1400027f0
mov ecx, eax
call fcn.1400027f0
lea rcx, [rsp + 0x1b8]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x150]
mov qword [rsp + 0x40], rcx
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
lea rdx, str._c___Se
mov rcx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x140003913
movaps xmm0, xmmword [rsp + 0xc0]
movups xmmword [0x1400061bc], xmm0
movaps xmm0, xmmword [rsp + 0xb0]
movups xmmword [0x1400061ac], xmm0
movaps xmm0, xmmword [rsp + 0xa0]
movups xmmword [0x14000619c], xmm0
movaps xmm0, xmmword [rsp + 0x90]
movups xmmword [0x14000618c], xmm0
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movaps xmm2, xmmword [rsp + 0x70]
movaps xmm3, xmmword [rsp + 0x80]
movups xmmword [0x14000617c], xmm3
movups xmmword [0x14000616c], xmm2
movups xmmword [0x14000615c], xmm1
movups xmmword [0x14000614c], xmm0
movaps xmm6, xmmword [rsp + 0x410]
add rsp, 0x420
pop rbx
pop rdi
pop rsi
ret