Function at 0x14001ad00
Capabilities:
Copy file
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov ebx, edx
mov rdi, rcx
lea rcx, [rax + 0x20]
mov edx, 0x528
and ebx, 0x30000
call fcn.14004bedc
lea rcx, [rsp + 0x2e8]
mov edx, 0x19c8
call fcn.14004bf70
mov r8, qword [rsp + 0x2e8]
lea r9, [rsp + 0x20]
xor esi, esi
mov edx, 0x527
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call fcn.14004cbc0
mov r11, qword [rsp + 0x20]
cmp r11, rsi
je 0x14001aff3
mov rbp, qword [rsp + 0x2e8]
sub r11, rbp
mov rdx, rbp
lea rcx, [rbp + 0xa50]
sar r11, 1
movsxd rax, r11d
mov qword [rsp + 0x30], rcx
lea r10, [rax + rax]
mov r8, r10
call fcn.1400177f8
lea rax, [r10 + rcx]
mov r15d, 0x104
mov word [rax], si
lea rsi, [rcx + 0xa50]
lea rcx, str._SystemRoot_INF_
mov r8d, r15d
mov rdx, rsi
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsi + 0xa50]
lea rcx, str._SystemRoot_SYSTEM32DRIVERS_
mov r8d, r15d
movsxd r14, eax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rsi + 0xa50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsi + 0x14a0]
lea rcx, str._SystemRoot_SYSTEM32_
mov r8d, 0x104
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rsi + 0x14a0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rsp + 0x20]
lea rcx, [rsi + r14*2]
mov dword [rsp + 0x2d8], eax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
xor r12d, r12d
cmp ebx, r12d
je 0x14001ae5c
mov edx, ebx
mov rcx, rsi
call fcn.14001a6f4
mov rcx, qword [rsp + 0x20]
lea rdx, [0x1400d90c0]
mov r8d, 8
call fcn.1400177f8
lea rcx, [rsp + 0x44]
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0x40], r12d
call fcn.1400b93b0
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x2e0]
mov rdx, rbp
mov qword [rsp + 0x2e0], r12
call fcn.1400b8aa4
cmp qword [rsp + 0x2e0], r12
je 0x14001afeb
mov ecx, 0x2e
lea edi, [rcx - 0x2a]
test byte [rsp + 0x40], 0x10
jne 0x14001afb1
cmp cx, word [rsp + 0x6c]
jne 0x14001aeef
movzx eax, word [rsp + 0x6e]
cmp ax, r12w
je 0x14001afb1
cmp cx, ax
jne 0x14001aeef
cmp word [rsp + 0x70], r12w
je 0x14001afb1
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x6c]
inc eax
movsxd r8, eax
add r8, r8
call fcn.1400177f8
lea rcx, [rsp + 0x6c]
call fcn.1400b9a24
mov ebp, dword [rsp + 0x2d8]
lea rdx, [0x1400d90b0]
cmp eax, edi
cmovl eax, edi
lea rdi, [rsi + 0x14a0]
cdqe
lea r12, [rsp + rax*2 + 0x64]
mov rcx, r12
call fcn.1400b9c48
test eax, eax
jne 0x14001af4e
mov rdi, rsi
mov ebp, r14d
lea rdx, str..SYS
mov rcx, r12
call fcn.1400b9c48
xor r12d, r12d
cmp eax, r12d
jne 0x14001af6f
lea rdi, [rsi + 0xa50]
mov ebp, r15d
movsxd rax, ebp
lea rdx, [rsp + 0x6c]
lea rcx, [rdi + rax*2]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp rsi, rdi
jne 0x14001afa6
cmp ebx, r12d
je 0x14001afa6
mov edx, ebx
mov rcx, rsi
call fcn.14001a6f4
mov word [rsp + 0x70], r12w
mov edi, 4
mov rcx, qword [rsp + 0x2e0]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, 0x2e
cmp eax, r12d
jne 0x14001aebd
mov rcx, qword [rsp + 0x2e0]
cmp rcx, r12
je 0x14001afeb
cmp rcx, 0xffffffffffffffff
je 0x14001afeb
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x2e0], r12
lea rcx, [rsp + 0x2e8]
call fcn.140044f24
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret