Function at 0x14001bf08
Capabilities:
Copy file
Delete file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6a8
mov rax, qword [0x14009e140]
xor rax, rsp
mov qword [rsp + 0x690], rax
xor ebx, ebx
mov qword [rsp + 0x58], r9
mov r14, r8
mov r15, rdx
mov r13, rcx
mov r12, rbx
mov ebp, ebx
mov rcx, qword [str.P5_n_]
lea rax, str.P5_n_
cmp rcx, rax
je 0x14001bf75
test byte [rcx + 0x1c], 4
je 0x14001bf75
cmp byte [rcx + 0x19], 5
jb 0x14001bf75
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x7d]
lea r8, [0x140009858]
call fcn.14000ffa8
cmp dword [rsp + 0x710], ebx
jne 0x14001bf88
mov eax, 0x57
jmp 0x14001c6cb
mov esi, 2
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rbx
lea r8d, [rsi - 1]
mov rcx, r13
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
call fcn.140079cec
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x14001c013
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
lea rdi, str.P5_n_
cmp rcx, rdi
je 0x14001c6c9
test byte [rcx + 0x1c], 4
je 0x14001c6c9
cmp byte [rcx + 0x19], sil
jb 0x14001c6c9
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x7c]
lea r8, [0x140009858]
mov r9, r13
mov dword [rsp + 0x20], eax
call fcn.140011a18
jmp 0x14001c6c9
mov rcx, qword [0x1400a3c58]
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x480]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x104
call fcn.140018e60
xor r8d, r8d
mov ebx, eax
cmp eax, r8d
je 0x14001c08e
mov rcx, qword [str.P5_n_]
lea rdi, str.P5_n_
cmp rcx, rdi
je 0x14001c37d
test byte [rcx + 0x1c], 4
je 0x14001c37d
cmp byte [rcx + 0x19], sil
jb 0x14001c37d
mov rcx, qword [rcx + 0x10]
lea edx, [r8 + 0x7f]
lea r8, [0x140009858]
mov r9d, eax
call fcn.1400100e0
jmp 0x14001c37d
mov ecx, dword [rsp + 0x710]
mov eax, 8
mul rcx
mov rdi, rax
cmp rdx, r8
jne 0x14001c0aa
mov ebx, r8d
jmp 0x14001c0b3
or rdi, 0xffffffffffffffff
mov ebx, 0x80070216
cmp ebx, r8d
jge 0x14001c108
mov rcx, qword [str.P5_n_]
lea rdi, str.P5_n_
cmp rcx, rdi
je 0x14001c0ef
test byte [rcx + 0x1c], 4
je 0x14001c0ef
cmp byte [rcx + 0x19], sil
jb 0x14001c0ef
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009858]
mov edx, 0x80
mov r9d, ebx
call fcn.1400100e0
mov ecx, ebx
movzx eax, bx
and ecx, 0x1fff0000
cmp ecx, 0x70000
cmove ebx, eax
jmp 0x14001c37d
mov rcx, rdi
call fcn.140076a54
xor ebx, ebx
mov r12, rax
mov qword [rsp + 0x50], rax
cmp rax, rbx
jne 0x14001c163
mov ebx, 8
mov rcx, qword [str.P5_n_]
lea r13, str.P5_n_
cmp rcx, r13
je 0x14001c159
test byte [rcx + 0x1c], 4
je 0x14001c159
cmp byte [rcx + 0x19], sil
jb 0x14001c159
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x79]
lea r8, [0x140009858]
mov r9d, edi
call fcn.1400100e0
mov r14, qword [rsp + 0x48]
jmp 0x14001c391
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov rcx, qword [r14]
call fcn.140077860
mov rsi, rax
cmp rax, rbx
jne 0x14001c1bc
mov ebx, 8
mov rcx, qword [str.P5_n_]
lea r13, str.P5_n_
cmp rcx, r13
je 0x14001c159
test byte [rcx + 0x1c], 4
je 0x14001c159
cmp byte [rcx + 0x19], 2
jb 0x14001c159
mov r9, qword [r14]
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x7a]
lea r8, [0x140009858]
call fcn.14001011c
jmp 0x14001c159
mov dword [rsp + 0x40], ebx
cmp dword [rsp + 0x710], ebx
jbe 0x14001c2d5
mov rax, qword [rsp + 0x58]
mov rbp, rax
sub r12, rax
mov edx, 0x3b
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcschr]
mov rdi, rax
cmp rax, rbx
je 0x14001c1f1
mov word [rax], bx
call fcn.14005e6cc
mov qword [r12 + rbp], rax
cmp rax, rbx
je 0x14001c4f5
mov rdx, qword [rbp]
mov rcx, qword [0x1400a3c58]
lea r9, [rsp + 0x270]
mov r8, rax
mov dword [rsp + 0x20], 0x104
call fcn.14001778c
mov ebx, eax
test eax, eax
jne 0x14001c4c0
lea rax, [rsp + 0x270]
lea r9, [rsp + 0x480]
lea r8, [0x140009d80]
lea rcx, [rsp + 0x60]
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.1400118ac
mov r9d, eax
test eax, eax
js 0x14001c464
lea r8d, [rbx + 1]
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14001c427
lea rcx, [rsp + 0x60]
mov r8, rsi
mov rdx, r14
call fcn.140014880
mov ebx, eax
test eax, eax
jne 0x14001c33d
xor ebx, ebx
lea rsi, [rdi + 2]
cmp rdi, rbx
jne 0x14001c2a8
mov rsi, rbx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x40]
add rbp, 8
inc eax
mov dword [rsp + 0x40], eax
cmp eax, dword [rsp + 0x710]
jb 0x14001c1d8
mov r12, qword [rsp + 0x50]
mov ebp, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
jne 0x14001c532
mov rax, qword [str.P5_n_]
lea rdi, str.P5_n_
cmp rax, rdi
je 0x14001c539
test byte [rax + 0x1c], 4
je 0x14001c539
cmp byte [rax + 0x19], 3
jb 0x14001c539
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
lea r8, [0x140009858]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x88
call fcn.1400100e0
jmp 0x14001c539
mov rcx, qword [str.P5_n_]
lea rdi, str.P5_n_
cmp rcx, rdi
je 0x14001c374
test byte [rcx + 0x1c], 4
je 0x14001c374
cmp byte [rcx + 0x19], 2
jb 0x14001c374
mov edx, 0x87
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009858]
mov r9d, eax
call fcn.1400100e0
mov r12, qword [rsp + 0x50]
mov ebp, dword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
test ebx, ebx
je 0x14001c6b2
lea r13, str.P5_n_
test r12, r12
je 0x14001c6b2
cmp ebp, dword [rsp + 0x710]
jne 0x14001c3a5
dec ebp
mov r14, qword [rsp + 0x58]
mov rdi, r12
lea esi, [rbp + 1]
sub r14, r12
mov r8, qword [rdi]
test r8, r8
je 0x14001c69f
mov rdx, qword [r14 + rdi]
mov rcx, qword [0x1400a3c58]
lea r9, [rsp + 0x270]
mov ebp, 0x104
mov dword [rsp + 0x20], ebp
call fcn.14001778c
test eax, eax
je 0x14001c5f5
mov rcx, qword [str.P5_n_]
cmp rcx, r13
je 0x14001c69f
test byte [rcx + 0x1c], 4
je 0x14001c69f
cmp byte [rcx + 0x19], 3
jb 0x14001c69f
mov rcx, qword [rcx + 0x10]
lea edx, [rbp - 0x79]
lea r8, [0x140009858]
mov r9d, eax
call fcn.1400100e0
jmp 0x14001c69f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
lea rdi, str.P5_n_
cmp rcx, rdi
je 0x14001c374
test byte [rcx + 0x1c], 4
je 0x14001c374
cmp byte [rcx + 0x19], 2
jb 0x14001c374
mov edx, 0x86
jmp 0x14001c361
mov ecx, eax
mov ebx, r9d
movzx eax, ax
and ecx, 0x1fff0000
cmp ecx, 0x70000
cmove ebx, eax
mov rcx, qword [str.P5_n_]
lea rdi, str.P5_n_
cmp rcx, rdi
je 0x14001c374
test byte [rcx + 0x1c], 4
je 0x14001c374
cmp byte [rcx + 0x19], 2
jb 0x14001c374
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009858]
mov edx, 0x85
call fcn.1400100e0
jmp 0x14001c374
mov rcx, qword [str.P5_n_]
lea rdi, str.P5_n_
cmp rcx, rdi
je 0x14001c374
test byte [rcx + 0x1c], 4
je 0x14001c374
cmp byte [rcx + 0x19], 2
jb 0x14001c374
mov edx, 0x84
jmp 0x14001c361
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
lea rdi, str.P5_n_
cmp rcx, rdi
je 0x14001c374
test byte [rcx + 0x1c], 4
je 0x14001c374
cmp byte [rcx + 0x19], 2
jb 0x14001c374
mov edx, 0x83
jmp 0x14001c361
lea rdi, str.P5_n_
or r14, 0xffffffffffffffff
mov rcx, r13
mov qword [rsp + 0x48], r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, ebx
jne 0x14001c59c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, rdi
je 0x14001c382
test byte [rcx + 0x1c], 4
je 0x14001c382
cmp byte [rcx + 0x19], 2
jb 0x14001c382
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009858]
mov edx, 0x89
mov r9, r13
mov dword [rsp + 0x20], eax
call fcn.140011a18
jmp 0x14001c382
mov r9d, dword [rsp + 0x710]
mov r8, qword [rsp + 0x58]
mov rdx, r12
mov rcx, r15
call fcn.140066564
mov ebx, eax
test eax, eax
je 0x14001c6c1
mov rcx, qword [str.P5_n_]
cmp rcx, rdi
je 0x14001c5ee
test byte [rcx + 0x1c], 4
je 0x14001c5ee
cmp byte [rcx + 0x19], 3
jb 0x14001c5ee
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009858]
mov edx, 0x8a
mov r9d, eax
call fcn.1400100e0
xor ebx, ebx
jmp 0x14001c382
lea rax, [rsp + 0x270]
lea r9, [rsp + 0x480]
lea r8, [0x140009d80]
lea rcx, [rsp + 0x60]
mov rdx, rbp
mov qword [rsp + 0x20], rax
call fcn.1400118ac
test eax, eax
jns 0x14001c654
mov rcx, qword [str.P5_n_]
cmp rcx, r13
je 0x14001c69f
test byte [rcx + 0x1c], 4
je 0x14001c69f
cmp byte [rcx + 0x19], 3
jb 0x14001c69f
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009858]
mov edx, 0x8c
mov r9d, eax
call fcn.1400100e0
jmp 0x14001c69f
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14001c69f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
cmp rcx, r13
je 0x14001c69f
test byte [rcx + 0x1c], 4
je 0x14001c69f
cmp byte [rcx + 0x19], 3
jb 0x14001c69f
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x60]
lea r8, [0x140009858]
mov edx, 0x8d
mov dword [rsp + 0x20], eax
call fcn.140011a18
add rdi, 8
sub rsi, 1
jne 0x14001c3b3
mov r14, qword [rsp + 0x48]
cmp r14, 0xffffffffffffffff
je 0x14001c6c1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call fcn.140076afc
mov eax, ebx
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.14008c5b0
add rsp, 0x6a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret