Function at 0x140002b80
Capabilities:
Copy file
Delete file
Get common file path
Terminate process

Disassembly:
test edx, edx
je 0x140002e83
mov r11, rsp
push rbp
push rdi
push r15
lea rbp, [r11 - 0x3d8]
sub rsp, 0x4c0
mov rax, qword [0x14001c008]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov qword [r11 + 0x18], rbx
mov r15d, edx
mov rdi, rcx
mov qword [r11 - 0x20], r13
xor edx, edx
mov qword [r11 - 0x28], r14
lea rcx, [rbp + 0x190]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov r13, 0xffffffffffffffff
call fcn.1400071f0
mov r14, qword [0x14001e6d8]
mov rbx, rax
test r14, r14
jne 0x140002c17
mov rcx, qword [rax + 0x30]
lea edx, [r13 + 2]
call fcn.140004000
mov r14, rax
mov qword [0x14001e6d8], rax
cmp qword [0x14001e6c8], 0
mov qword [rsp + 0x4f8], rsi
jne 0x140002c58
mov rcx, qword [rbx + 0x50]
call fcn.140002740
test rax, rax
je 0x140002e84
xor edx, edx
mov rcx, rax
call fcn.140004000
mov rdx, qword [r14 + 0x10]
mov rcx, rax
mov qword [0x14001e6c8], rax
call fcn.140003de0
mov rdx, qword [rdi + 0x18]
xor esi, esi
mov ecx, esi
lea rax, [rdx + 0x10]
movups xmm0, xmmword [rdx]
movups xmmword [rsp + 0x30], xmm0
cmp qword [rax], rcx
je 0x140002c7c
inc ecx
lea rax, [rax + 0x18]
cmp qword [rax], rsi
jne 0x140002c71
mov rbx, qword [rsp + 0x38]
movsxd rax, ecx
lea rcx, [rax + rax*2]
movups xmm1, xmmword [rdx + rcx*8 - 0x18]
movsd xmm0, qword [rdx + rcx*8 - 8]
mov edx, r15d
movsd qword [rsp + 0x58], xmm0
mov rdi, qword [rsp + 0x58]
sub rdi, rbx
psrldq xmm1, 8
movq rax, xmm1
add rdi, rax
sub edx, 1
je 0x140002d81
sub edx, 1
je 0x140002d77
sub edx, 1
je 0x140002d77
sub edx, 1
je 0x140002cf0
cmp edx, 1
jne 0x140002e8f
call fcn.140005630
mov rsi, rax
test rax, rax
je 0x140002ea6
jmp 0x140002da1
mov edx, 0x104
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, str.ntdll.dll
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x190]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rdx, [rbp - 0x80]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, str.._ntdlol.txt
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x80]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor r8d, r8d
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
mov edx, 1
mov r13, rax
call fcn.140004000
mov r14, rax
mov rcx, rax
jmp 0x140002d84
mov ecx, r15d
call fcn.140002ec0
jmp 0x140002d9e
mov rcx, r14
lea rdx, str.NtProtectVirtualMemory
call fcn.140004140
test eax, eax
je 0x140002da1
mov edx, eax
mov rcx, r14
call fcn.140003d50
mov rsi, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rbx
mov r9d, 0x40
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x70]
mov qword [rsp + 0x70], rdi
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffffffffffff
call rsi
test eax, eax
js 0x140002e84
test rdi, rdi
je 0x140002e00
mov rdx, qword [rsp + 0x30]
sub rdx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx + rdx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x140002df0
mov r9d, dword [rsp + 0x68]
lea rax, [rsp + 0x68]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffffffffffff
call rsi
test eax, eax
js 0x140002e84
cmp r15d, 4
jne 0x140002e49
lea rax, [r13 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140002e3f
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rsi, qword [rsp + 0x4f8]
mov r13, qword [rsp + 0x4b8]
mov rbx, qword [rsp + 0x4f0]
mov r14, qword [rsp + 0x4b0]
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1400085d0
add rsp, 0x4c0
pop r15
pop rdi
pop rbp
ret
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
lea rcx, str.Unhook_method_does_not_exist__exiting..._n
call fcn.140001010
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
lea rcx, str.Something_wrong_happened_with_CreateSyscallStubWithVirtuallAlloc__aborting..._n
call fcn.140001010
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3