Function at 0x14002dc74
Capabilities:
Copy file
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
mov rdi, rcx
mov esi, r8d
mov r13, rdx
lea rcx, [rsp + 0x50]
mov edx, 0x19c8
and esi, 0x30000
call fcn.140058200
mov r8, qword [rsp + 0x50]
lea r9, [rsp + 0x40]
xor r14d, r14d
mov edx, 0x527
mov rcx, r13
mov qword [rsp + 0x40], r14
call fcn.140058fbc
mov r11, qword [rsp + 0x40]
cmp r11, r14
jne 0x14002dcea
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r12d, [r14 + 1]
mov ebx, eax
cmp eax, r14d
cmove ebx, r12d
jmp 0x14002e247
mov rbp, qword [rsp + 0x50]
sub r11, rbp
mov rdx, rbp
sar r11, 1
lea r15, [rbp + 0xa50]
movsxd rax, r11d
mov rcx, r15
lea r10, [rax + rax]
mov r8, r10
call fcn.14001aac4
lea rax, [r10 + r15]
lea rbx, [r15 + 0xa50]
mov word [rax], r14w
mov rcx, qword [rdi + 0x70]
mov qword [rsp + 0x68], rax
xor eax, eax
lea r12d, [rax + 1]
cmp rcx, rax
je 0x14002dde0
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rdi + 0x70]
lea r8d, [r12 + 0x5b]
movsxd rcx, eax
cmp r8w, word [rdx + rcx*2 - 2]
je 0x14002dd5f
lea r8d, [r12 + 0x2e]
cmp r8w, word [rdx + rcx*2 - 2]
jne 0x14002dd62
sub eax, r12d
cdqe
mov rcx, rbx
lea r10, [rax + rax]
mov r8, r10
call fcn.14001aac4
lea rcx, [r10 + rbx]
lea rdx, [0x1400f4cc8]
mov r8d, 0xc
call fcn.14001aac4
mov rdx, qword [rdi + 0x70]
lea rcx, [rbx + 0xa50]
mov r8, r10
call fcn.14001aac4
lea rcx, [r10 + rbx + 0xa50]
lea rdx, str.SYSTEM32DRIVERS_
mov r8d, 0x26
call fcn.14001aac4
mov rdx, qword [rdi + 0x70]
lea rcx, [rbx + 0x14a0]
mov r8, r10
call fcn.14001aac4
lea rdx, str.SYSTEM32_
add rcx, r10
mov r8d, 0x16
call fcn.14001aac4
jmp 0x14002de2a
lea rcx, str._SystemRoot_INF_
mov r8d, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbx + 0xa50]
lea rcx, str._SystemRoot_SYSTEM32DRIVERS_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbx + 0x14a0]
lea rcx, str._SystemRoot_SYSTEM32_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbx + 0xa50]
mov dword [rsp + 0x320], eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbx + 0x14a0]
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, dword [rsp + 0x320]
mov rdx, qword [rsp + 0x40]
lea rcx, [rbx + rcx*2]
mov dword [rsp + 0x328], eax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x30]
mov edx, 0x2800
call fcn.140058200
mov rcx, qword [rsp + 0x30]
lea r8, str.ToSys:Copy___s_
mov r9, r13
mov edx, 0x27ff
call fcn.1400d54a8
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x11]
mov qword [rsp + 0x20], rax
call fcn.140026b88
lea rcx, [rsp + 0x30]
call fcn.14005041c
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CopyFileW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
cmp esi, eax
je 0x14002df41
lea rcx, [rsp + 0x30]
mov edx, 0x2800
call fcn.140058200
mov rcx, qword [rsp + 0x30]
lea r8, str.ToSys:TreatINF___s_
mov r9, rbx
mov edx, 0x27ff
call fcn.1400d54a8
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x11]
mov qword [rsp + 0x20], rax
call fcn.140026b88
lea rcx, [rsp + 0x30]
call fcn.14005041c
mov edx, esi
mov rcx, rbx
call fcn.14001d818
lea rcx, [rsp + 0x30]
mov edx, 0x2800
call fcn.140058200
mov rcx, qword [rsp + 0x30]
lea r8, str.ToSys:END___s_
mov r9, r13
mov edx, 0x27ff
call fcn.1400d54a8
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
xor r13d, r13d
xor r8d, r8d
lea r9d, [r13 + 0x11]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140026b88
lea rcx, [rsp + 0x30]
call fcn.14005041c
mov rcx, qword [rsp + 0x40]
lea r8d, [r13 + 8]
lea rdx, [0x1400f4ba8]
call fcn.14001aac4
lea rcx, [rsp + 0x84]
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0x80], r13d
call fcn.1400d4180
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0x38]
mov rdx, rbp
mov qword [rsp + 0x38], r13
call fcn.1400d3748
cmp qword [rsp + 0x38], r13
je 0x14002e23f
lea ecx, [r13 + 0x2e]
lea ebp, [rcx - 0x2a]
test byte [rsp + 0x80], 0x10
jne 0x14002e208
cmp cx, word [rsp + 0xac]
jne 0x14002e031
movzx eax, word [rsp + 0xae]
cmp ax, r13w
je 0x14002e208
cmp cx, ax
jne 0x14002e031
cmp word [rsp + 0xb0], r13w
je 0x14002e208
lea rcx, [rsp + 0xac]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0xac]
add eax, r12d
movsxd r8, eax
add r8, r8
call fcn.14001aac4
lea rcx, [rsp + 0xac]
call fcn.1400d4710
mov r13d, dword [rsp + 0x328]
lea rdx, [0x1400f4b98]
cmp eax, ebp
cmovl eax, ebp
lea rbp, [rbx + 0x14a0]
cdqe
lea rax, [rsp + rax*2 + 0xa4]
mov rcx, rax
mov qword [rsp + 0x70], rax
call fcn.1400d4934
test eax, eax
jne 0x14002e0a8
mov r13d, dword [rsp + 0x320]
mov rbp, rbx
mov rcx, qword [rsp + 0x70]
lea rdx, str..SYS
call fcn.1400d4934
test eax, eax
jne 0x14002e0c9
mov r13d, dword [rsp + 0x60]
lea rbp, [rbx + 0xa50]
movsxd rax, r13d
lea rdx, [rsp + 0xac]
lea rcx, [rbp + rax*2]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x30]
mov edx, 0x2800
call fcn.140058200
mov rcx, qword [rsp + 0x30]
lea r8, str.ToSys:Copy___s_
mov r9, r15
mov edx, 0x27ff
call fcn.1400d54a8
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
xor r13d, r13d
xor r8d, r8d
lea r9d, [r13 + 0x11]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140026b88
lea rcx, [rsp + 0x30]
call fcn.14005041c
xor r8d, r8d
mov rdx, rbp
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp rbx, rbp
jne 0x14002e1a7
cmp esi, r13d
je 0x14002e1a7
lea rcx, [rsp + 0x48]
mov edx, 0x2800
call fcn.140058200
mov rcx, qword [rsp + 0x48]
lea r8, str.ToSys:TreatINF___s_
mov r9, rbx
mov edx, 0x27ff
call fcn.1400d54a8
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rdi + 8]
lea r9d, [r13 + 0x11]
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140026b88
lea rcx, [rsp + 0x48]
call fcn.14005041c
mov edx, esi
mov rcx, rbx
call fcn.14001d818
lea rcx, [rsp + 0x58]
mov edx, 0x2800
call fcn.140058200
mov rcx, qword [rsp + 0x58]
lea r8, str.ToSys:End___s_
mov r9, r15
mov edx, 0x27ff
call fcn.1400d54a8
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdi + 8]
mov r9d, 0x11
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140026b88
lea rcx, [rsp + 0x58]
call fcn.14005041c
mov word [rsp + 0xb0], r13w
mov ebp, 4
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, 0x2e
cmp eax, r13d
jne 0x14002dff3
mov rcx, qword [rsp + 0x38]
cmp rcx, r13
je 0x14002e23f
cmp rcx, 0xffffffffffffffff
je 0x14002e23f
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x38], r13
mov ebx, r13d
lea rcx, [rsp + 0x50]
call fcn.14005041c
mov eax, ebx
mov rbx, qword [rsp + 0x310]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret