Function at 0x14005d990
Capabilities:
Copy file
Delete file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov r12, rcx
xor ebx, ebx
mov dword [rbp - 0x38], ebx
lea esi, [rbx + 5]
lea r8d, [rbx + 3]
lea rdx, [rbp - 0x20]
add rcx, 0x10
call fcn.14005e940
nop
mov rcx, qword [rax]
lea r13, [0x1400dcb98]
nop dword [rax + rax]
movzx r15d, word [rcx + rbx*2]
inc rbx
movzx eax, word [r13 + rbx*2 - 2]
sub r15d, eax
jne 0x14005d9e9
cmp rbx, 4
jne 0x14005d9d0
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005da0b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test r15d, r15d
jne 0x14005dc8f
mov byte [r12], 1
lea rcx, str.We_are_running_a_temp_version_n
call fcn.14005ccd0
nop
nop word [rax + rax]
mov rax, qword [r12 + 0x10]
mov r9d, dword [rax - 0x10]
add r9d, 0xfffffffd
mov r8d, 3
lea rdx, [rbp + 0x50]
lea rcx, [r12 + 0x10]
call fcn.14005ea90
mov ebx, dword [rbp - 0x38]
or ebx, 1
mov dword [rbp - 0x38], ebx
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r15d, eax
and ebx, 0xfffffffe
mov dword [rbp - 0x38], ebx
mov rdx, qword [rbp + 0x50]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14005da8a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test r15d, r15d
jne 0x14005dad7
sub esi, 1
jne 0x14005da30
mov rax, qword [r12 + 0x10]
mov r9d, dword [rax - 0x10]
add r9d, 0xfffffffd
lea r8d, [r15 + 3]
lea rdx, [rbp + 0x58]
lea rcx, [r12 + 0x10]
call fcn.14005ea90
mov ebx, dword [rbp - 0x38]
or ebx, 8
mov dword [rbp - 0x38], ebx
mov rdx, qword [rbp + 0x58]
lea rcx, str.original_version___s__cant_be_deleted_or_doesnt_exists_n
call fcn.14005ccd0
and ebx, 0xfffffff7
mov dword [rbp - 0x38], ebx
jmp 0x14005dd29
mov rax, qword [r12 + 0x10]
mov r9d, dword [rax - 0x10]
add r9d, 0xfffffffd
mov r8d, 3
lea rdx, [rbp + 0x60]
lea rcx, [r12 + 0x10]
call fcn.14005ea90
mov ebx, dword [rbp - 0x38]
or ebx, 2
mov dword [rbp - 0x38], ebx
mov rdx, qword [rbp + 0x60]
lea rcx, str.File__s_deleted_n
call fcn.14005ccd0
and ebx, 0xfffffffd
mov dword [rbp - 0x38], ebx
mov rdx, qword [rbp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005db35
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rax, qword [r12 + 0x10]
mov r9d, dword [rax - 0x10]
add r9d, 0xfffffffd
mov r8d, 3
lea rdx, [rbp - 0x30]
lea rcx, [r12 + 0x10]
call fcn.14005ea90
mov ebx, dword [rbp - 0x38]
or ebx, 4
mov dword [rbp - 0x38], ebx
xor r8d, r8d
mov rdx, qword [rbp - 0x30]
mov rcx, qword [r12 + 0x10]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
and ebx, 0xfffffffb
mov dword [rbp - 0x38], ebx
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14005db96
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test esi, esi
je 0x14005dd44
mov rax, qword [r12 + 0x10]
mov r9d, dword [rax - 0x10]
add r9d, 0xfffffffd
mov r8d, 3
lea rdx, [rbp - 0x28]
lea rcx, [r12 + 0x10]
call fcn.14005ea90
mov ebx, dword [rbp - 0x38]
or ebx, 0x10
mov dword [rbp - 0x38], ebx
mov r8, qword [rbp - 0x28]
mov rdx, qword [r12 + 0x10]
lea rcx, str.File__s_copied_to__s_n
call fcn.14005ccd0
and ebx, 0xffffffef
mov dword [rbp - 0x38], ebx
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005dc01
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rax, qword [r12 + 0x10]
mov r9d, dword [rax - 0x10]
add r9d, 0xfffffffd
mov r8d, 3
lea rdx, [rbp + 0x48]
lea rcx, [r12 + 0x10]
call fcn.14005ea90
mov ebx, dword [rbp - 0x38]
or ebx, 0x20
mov dword [rbp - 0x38], ebx
mov rcx, qword [rbp + 0x48]
cmp dword [rcx - 8], 1
jle 0x14005dc45
mov edx, dword [rcx - 0x10]
lea rcx, [rbp + 0x48]
call fcn.14005ed10
mov rcx, qword [rbp + 0x48]
call fcn.14005ce00
mov esi, eax
and ebx, 0xffffffdf
mov dword [rbp - 0x38], ebx
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14005dc6d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test esi, esi
je 0x14005dd44
mov rdx, qword [r12 + 0x10]
lea rcx, str.Terminated__s_n
call fcn.14005ccd0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
int3
mov byte [r12], 0
lea rcx, str.We_are_running_the_normal_version_n
call fcn.14005ccd0
lea r8, [r12 + 0x10]
mov rdx, r13
lea rcx, [rbp - 0x18]
call fcn.14005e620
nop
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14005dcda
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test ebx, ebx
jne 0x14005dd07
sub esi, 1
jne 0x14005dca0
lea r8, [r12 + 0x10]
mov rdx, r13
lea rcx, [rbp + 0x58]
call fcn.14005e620
nop
mov rdx, qword [rax]
lea rcx, str.temp_File__s_cant_be_deleted_or_doesnt_exist_n
call fcn.14005ccd0
nop
jmp 0x14005dd29
lea r8, [r12 + 0x10]
mov rdx, r13
lea rcx, [rbp + 0x58]
call fcn.14005e620
nop
mov rdx, qword [rax]
lea rcx, str.temp_File__s_deleted_n
call fcn.14005ccd0
nop
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14005dd44
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov eax, 1
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret