Function at 0x100014eb0
Capabilities:
Copy file
Get common file path
Write file on windows

Disassembly:
push rbp
push r13
push r14
sub rsp, 0x70
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0x68], r12
mov rax, qword [0x10001f190]
xor rax, rbp
mov qword [rbp + 0x28], rax
mov rsi, rdx
mov r14, rcx
xor r12d, r12d
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_PathMakeSystemFolderW]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx + 0x18]
mov edi, eax
add rax, 0xf
cmp rax, rdi
ja 0x100014f1c
movabs rbx, 0xffffffffffffff0
mov rax, rbx
jmp 0x100014f26
movabs rbx, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.100019a70
sub rsp, rax
lea r13, [rsp + 0x40]
mov qword [rbp + 0x18], r13
mov r8, rsi
mov rdx, rdi
mov rcx, r13
call fcn.10000b75c
lea r8, [0x1000026ec]
mov rdx, rdi
mov rcx, r13
call fcn.100006714
lea r8, [0x100004180]
mov rdx, rdi
mov rcx, r13
call fcn.100006714
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx + 0x18]
mov edi, eax
add rax, 0xf
cmp rax, rdi
ja 0x100014f8e
mov rax, rbx
and rax, 0xfffffffffffffff0
call fcn.100019a70
sub rsp, rax
lea rsi, [rsp + 0x40]
mov qword [rbp + 8], rsi
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.10000b75c
lea r8, [0x1000026ec]
mov rdx, rdi
mov rcx, rsi
call fcn.100006714
lea r8, [0x100004180]
mov rdx, rdi
mov rcx, rsi
call fcn.100006714
mov r14d, 1
mov r8d, r14d
mov rdx, r13
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100014ff7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
cmp r12d, 2
jne 0x100015189
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, eax
lea rax, [rdi + 0xf]
cmp rax, rdi
ja 0x100015019
mov rax, rbx
and rax, 0xfffffffffffffff0
call fcn.100019a70
sub rsp, rax
lea rsi, [rsp + 0x40]
mov qword [rbp + 0x10], rsi
mov edx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
inc eax
cmp edi, eax
je 0x100015047
mov eax, r14d
jmp 0x10001519e
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 6
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x100015189
lea edi, [rdi + rdi + 0x176]
lea rax, [rdi + 0xf]
cmp rax, rdi
ja 0x10001508e
mov rax, rbx
and rax, 0xfffffffffffffff0
call fcn.100019a70
sub rsp, rax
lea rbx, [rsp + 0x40]
mov qword [rbp + 0x20], rbx
xor eax, eax
test rdi, rdi
je 0x1000150b3
cmp rdi, 0x7fffffff
jbe 0x1000150b8
mov eax, 0x80070057
test eax, eax
js 0x100015100
mov rdx, rdi
mov rcx, rbx
test rdi, rdi
je 0x1000150f5
mov r8d, 0x7ffffffe
sub r8, rdi
lea r9, [0x1000041a0]
sub r9, rbx
lea rax, [r8 + rdx]
test rax, rax
je 0x1000150f5
mov al, byte [r9 + rcx]
test al, al
je 0x1000150f5
mov byte [rcx], al
add rcx, r14
sub rdx, r14
jne 0x1000150da
test rdx, rdx
jne 0x1000150fd
sub rcx, r14
mov byte [rcx], 0
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.100015820
lea r8, [0x1000042c0]
mov rdx, rdi
mov rcx, rbx
call fcn.100015820
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.100015820
lea r8, [0x1000042e8]
mov rdx, rdi
mov rcx, rbx
call fcn.100015820
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, r14
and dword [rbp], eax
and qword [rsp + 0x20], rax
lea r9, [rbp]
mov r8d, ecx
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100015189
mov eax, r14d
jmp 0x10001519e
mov rcx, qword [rbp + 0x28]
xor rcx, rbp
call fcn.100019220
mov rbx, qword [rbp + 0x50]
mov rsi, qword [rbp + 0x58]
mov rdi, qword [rbp + 0x60]
mov r12, qword [rbp + 0x68]
lea rsp, [rbp + 0x30]
pop r14
pop r13
pop rbp
ret