Function at 0x75b89814c
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r15, rcx
lea rdi, [0x75b91a090]
mov rcx, qword [0x75b91a090]
cmp rcx, rdi
je 0x75b89819b
test byte [rcx + 0x1c], 4
je 0x75b89819b
movzx r9d, dl
mov edx, 0x1c
lea r8, [0x75b8f5218]
mov rcx, qword [rcx + 0x10]
call fcn.75b803acc
mov r13, qword [r15 + 0x30]
mov rax, qword [r15 + 0x38]
mov r12, qword [rax + 0x18]
mov rax, qword [r15 + 8]
mov qword [rbp - 0x50], rax
xor r14d, r14d
mov qword [rbp - 0x30], r14
lea rdx, str.wer.dll
lea rcx, [rbp - 0x30]
call fcn.75b89a15c
test eax, eax
js 0x75b8986e3
mov qword [rbp + 0x50], r14
lea r8, str.WerReportCreate
mov rsi, qword [rbp - 0x30]
mov rdx, rsi
lea rcx, [rbp + 0x50]
call fcn.75b89bf9c
test eax, eax
js 0x75b8986eb
mov qword [rbp - 0x38], r14
lea r8, str.WerReportCloseHandle
mov rdx, rsi
lea rcx, [rbp - 0x38]
call fcn.75b89bf9c
test eax, eax
js 0x75b8986f3
mov qword [rbp - 0x48], r14
lea r8, str.WerReportSetParameter
mov rdx, rsi
lea rcx, [rbp - 0x48]
call fcn.75b89bf9c
test eax, eax
js 0x75b8986fb
mov qword [rbp - 0x40], r14
lea r8, str.WerReportAddFile
mov rdx, rsi
lea rcx, [rbp - 0x40]
call fcn.75b89bf9c
test eax, eax
js 0x75b898703
mov qword [rbp - 0x28], r14
lea r8, str.WerReportSubmit
mov rdx, rsi
lea rcx, [rbp - 0x28]
call fcn.75b89bf9c
test eax, eax
js 0x75b89870b
mov qword [rbp + 0x58], r14
movabs r10, 0xe1d8aeb93cd43970
lea r9, [rbp + 0x58]
xor r8d, r8d
xor edx, edx
mov rcx, qword [r12]
mov rax, qword [rbp + 0x50]
call qword [0x75b8df5b0]
mov ebx, eax
test eax, eax
js 0x75b898713
mov byte [rbp - 0x20], r14b
lea rax, [rbp + 0x58]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x10], rax
mov ebx, r14d
cmp dword [r12 + 0x20], r14d
jbe 0x75b89830d
mov eax, ebx
mov rdi, qword [r13 + rax*8]
test rdi, rdi
je 0x75b8982cc
cmp word [rdi], r14w
jne 0x75b8982d3
lea rdi, str.unspecified
movabs r10, 0xed3c2fcb7e534170
mov r9, rdi
xor r8d, r8d
mov edx, ebx
mov rcx, qword [rbp + 0x58]
mov rax, qword [rbp - 0x48]
call qword [0x75b8df5b0]
mov r14d, eax
test eax, eax
js 0x75b898745
inc ebx
cmp ebx, dword [r12 + 0x20]
mov r14d, 0
jb 0x75b8982ba
mov eax, dword [r15 + 0x20]
mov r13d, 5
test eax, eax
je 0x75b89835e
mov r12, qword [r15 + 0x28]
mov ebx, r14d
mov eax, ebx
mov r14, qword [r12 + rax*8]
movabs r10, 0xee0d26df3a556970
xor r9d, r9d
mov r8d, r13d
mov rdx, r14
mov rcx, qword [rbp + 0x58]
mov rax, qword [rbp - 0x40]
call qword [0x75b8df5b0]
mov edi, eax
test eax, eax
js 0x75b89877d
inc ebx
cmp ebx, dword [r15 + 0x20]
jb 0x75b898322
xor r14d, r14d
mov dword [rbp + 0x50], r14d
lea r8, [rbp + 0x50]
xor edx, edx
lea rcx, str.MpClient_CopyClientManifestForTesting
call fcn.75b856a10
nop
cmp dword [rbp + 0x50], r14d
je 0x75b898501
mov qword [rbp + 0x50], r14
lea rdx, str._windir_Temp
lea rcx, [rbp + 0x50]
call fcn.75b89ccf4
test eax, eax
jns 0x75b8983df
mov rcx, qword [0x75b91a090]
lea r12, [0x75b91a090]
cmp rcx, r12
je 0x75b8983c8
test byte [rcx + 0x1c], 1
je 0x75b8983c8
mov edx, 0x18
mov r9d, eax
lea r8, [0x75b8f5218]
mov rcx, qword [rcx + 0x10]
call fcn.75b803acc
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x75b898508
call fcn.75b8bc9f0
jmp 0x75b898508
mov qword [rbp - 0x48], r14
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r9d, eax
mov rbx, qword [rbp + 0x50]
mov r8, rbx
lea rdx, str._lsClient_Manifest__ld.xml
lea rcx, [rbp - 0x48]
call fcn.75b89de04
test eax, eax
jns 0x75b898454
mov rcx, qword [0x75b91a090]
lea r12, [0x75b91a090]
cmp rcx, r12
je 0x75b898438
test byte [rcx + 0x1c], 1
je 0x75b898438
mov edx, 0x19
mov r9d, eax
lea r8, [0x75b8f5218]
mov rcx, qword [rcx + 0x10]
call fcn.75b803acc
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x75b898446
call fcn.75b8bc9f0
test rbx, rbx
je 0x75b898508
mov rcx, rbx
jmp 0x75b8983d5
xor r8d, r8d
mov rdi, qword [rbp - 0x48]
mov rdx, rdi
mov r14, qword [rbp - 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x75b898473
xor eax, eax
jmp 0x75b898478
call fcn.75b8998c4
mov ecx, eax
shr ecx, 0x1f
test cl, cl
je 0x75b8984ce
mov rcx, qword [0x75b91a090]
lea r12, [0x75b91a090]
cmp rcx, r12
je 0x75b8984b2
test byte [rcx + 0x1c], 1
je 0x75b8984b2
mov edx, 0x1a
mov r9d, eax
lea r8, [0x75b8f5218]
mov rcx, qword [rcx + 0x10]
call fcn.75b803acc
test rdi, rdi
je 0x75b8984bf
mov rcx, rdi
call fcn.75b8bc9f0
test rbx, rbx
je 0x75b89850c
mov rcx, rbx
call fcn.75b8bc9f0
jmp 0x75b89850c
mov rcx, qword [0x75b91a090]
lea r12, [0x75b91a090]
cmp rcx, r12
je 0x75b8984b2
test byte [rcx + 0x1c], 4
je 0x75b8984b2
mov edx, 0x1b
mov r9, rdi
lea r8, [0x75b8f5218]
mov rcx, qword [rcx + 0x10]
call fcn.75b805034
jmp 0x75b8984b2
lea r12, [0x75b91a090]
mov r14, qword [rbp - 0x50]
movabs r10, 0xee0d26df3a556970
xor r9d, r9d
mov r8d, r13d
mov rdx, r14
mov rcx, qword [rbp + 0x58]
mov rax, qword [rbp - 0x40]
call qword [0x75b8df5b0]
mov ebx, eax
test eax, eax
js 0x75b8987ba
mov ebx, dword [r15 + 0x40]
mov r14d, 2
and ebx, r14d
add ebx, ebx
mov rax, qword [r15 + 0x38]
mov edi, ebx
test rax, rax
je 0x75b898577
mov rax, qword [rax + 0x18]
test rax, rax
je 0x75b898577
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x75b898577
lea rdx, str.AntiMalware_SFC_Instrumentation
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x75b898577
bts edi, 8
and dword [rbp + 0x40], 0
movabs r10, 0xe38cbf985a546870
lea r9, [rbp + 0x40]
mov r8d, edi
mov edx, r14d
mov rcx, qword [rbp + 0x58]
mov rax, qword [rbp - 0x28]
call qword [0x75b8df5b0]
mov ebx, eax
test eax, eax
js 0x75b8986b1
mov r9d, dword [rbp + 0x40]
cmp r9d, r14d
jne 0x75b8985fb
mov rcx, qword [0x75b91a090]
cmp rcx, r12
je 0x75b89866b
test byte [rcx + 0x1c], 4
je 0x75b8985e9
mov edx, 0x22
mov r9d, r14d
lea r8, [0x75b8f5218]
mov rcx, qword [rcx + 0x10]
call fcn.75b803acc
mov r9d, dword [rbp + 0x40]
mov rcx, qword [0x75b91a090]
cmp rcx, r12
je 0x75b89866b
test byte [rcx + 0x1c], 4
je 0x75b89866b
mov edx, 0x23
jmp 0x75b89865b
cmp r9d, 0xb
jne 0x75b898619
mov rcx, qword [0x75b91a090]
cmp rcx, r12
je 0x75b89866b
test byte [rcx + 0x1c], 4
je 0x75b89866b
lea edx, [r9 + 0x19]
jmp 0x75b89865b
mov rcx, qword [0x75b91a090]
cmp rcx, r12
je 0x75b89866b
test byte [rcx + 0x1c], 4
je 0x75b89864b
mov edx, 0x25
lea r8, [0x75b8f5218]
mov rcx, qword [rcx + 0x10]
call fcn.75b803acc
mov r9d, dword [rbp + 0x40]
mov rcx, qword [0x75b91a090]
cmp rcx, r12
je 0x75b89866b
test byte [rcx + 0x1c], r14b
je 0x75b89866b
mov edx, 0x26
lea r8, [0x75b8f5218]
mov rcx, qword [rcx + 0x10]
call fcn.75b803acc
mov byte [rbp - 0x20], 1
movabs r10, 0x945d9f4218525370
mov rcx, qword [rbp + 0x58]
mov rax, qword [rbp - 0x38]
call qword [0x75b8df5b0]
nop
test rsi, rsi
je 0x75b898696
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [0x75b91a090]
cmp rcx, r12
je 0x75b8986db
test byte [rcx + 0x1c], 1
je 0x75b8986db
mov edx, 0x21
mov r9d, ebx
lea r8, [0x75b8f5218]
mov rcx, qword [rcx + 0x10]
call fcn.75b803acc
mov ecx, ebx
call fcn.75b89b774
nop
mov ecx, eax
call fcn.75b89b774
int3
mov ecx, eax
call fcn.75b89b774
int3
mov ecx, eax
call fcn.75b89b774
int3
mov ecx, eax
call fcn.75b89b774
int3
mov ecx, eax
call fcn.75b89b774
int3
mov ecx, eax
call fcn.75b89b774
int3
mov rcx, qword [0x75b91a090]
cmp rcx, rdi
je 0x75b89873d
test byte [rcx + 0x1c], 1
je 0x75b89873d
mov edx, 0x1d
mov r9d, ebx
lea r8, [0x75b8f5218]
mov rcx, qword [rcx + 0x10]
call fcn.75b803acc
mov ecx, ebx
call fcn.75b89b774
nop
mov rcx, qword [0x75b91a090]
lea rax, [0x75b91a090]
cmp rcx, rax
je 0x75b898774
test byte [rcx + 0x1c], 1
je 0x75b898774
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rdi
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
call fcn.75b896b5c
mov ecx, r14d
call fcn.75b89b774
int3
mov rcx, qword [0x75b91a090]
lea rax, [0x75b91a090]
cmp rcx, rax
je 0x75b8987b2
test byte [rcx + 0x1c], 1
je 0x75b8987b2
mov edx, 0x1f
mov dword [rsp + 0x20], edi
mov r9, r14
lea r8, [0x75b8f5218]
mov rcx, qword [rcx + 0x10]
call fcn.75b81bf90
mov ecx, edi
call fcn.75b89b774
int3
mov rcx, qword [0x75b91a090]
cmp rcx, r12
je 0x75b8987e8
test byte [rcx + 0x1c], 1
je 0x75b8987e8
mov edx, 0x20
mov dword [rsp + 0x20], ebx
mov r9, r14
lea r8, [0x75b8f5218]
mov rcx, qword [rcx + 0x10]
call fcn.75b81bf90
mov ecx, ebx
call fcn.75b89b774
int3