Function at 0x180040428
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x330
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x1800824d0]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
mov edx, 0x40b3c
lea rcx, [r11 - 0x278]
call fcn.180040240
nop
cmp qword [rsp + 0xf8], r12
jne 0x1800404a7
cmp qword [rsp + 0x100], 8
jb 0x18004049d
mov rcx, qword [rsp + 0xe8]
call fcn.180043070
mov eax, 1
jmp 0x1800408f0
mov word [rsp + 0x110], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x112]
call fcn.180045560
mov ebx, r12d
mov edx, 0x104
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, str.drivers
lea rcx, [rsp + 0x110]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x110]
call fcn.180040344
mov rdx, rbp
lea rcx, [rsp + 0x110]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor r8d, r8d
lea rdx, [rsp + 0x110]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, r12d
jne 0x180040531
mov edi, 8
jmp 0x1800408d6
mov r9d, 2
lea r8d, [r9 + 1]
mov rdx, rsi
lea rcx, [rsp + 0x110]
call fcn.180021bd4
cmp eax, r12d
jne 0x18004055a
mov edi, 0xa
jmp 0x1800408ba
mov ebx, 1
mov rdx, rsi
lea rcx, [rsp + 0x90]
call fcn.1800402dc
nop
lea r9, [rsp + 0xe8]
cmp qword [rsp + 0x100], 8
cmovae r9, qword [rsp + 0xe8]
lea rdx, [rsp + 0x98]
cmp qword [rsp + 0xb0], 8
cmovae rdx, qword [rsp + 0x98]
mov dword [rsp + 0x20], r12d
lea r8, str.Group
mov r13, 0xffffffff80000002
mov rcx, r13
call fcn.1800217ac
cmp eax, r12d
je 0x18004089d
lea rdx, [rsp + 0x98]
cmp qword [rsp + 0xb0], 8
cmovae rdx, qword [rsp + 0x98]
mov dword [rsp + 0x20], r12d
lea r9, str.poflt_minifilter_driver
lea r8, str.Description
mov rcx, r13
call fcn.1800217ac
cmp eax, r12d
je 0x18004089d
lea ebp, [rbx + 6]
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], r12
mov word [rsp + 0x40], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
mov r8, rcx
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.18000297c
nop
lea r8, str._Instance
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0xb8]
call fcn.180024514
nop
cmp qword [rsp + 0x58], 8
jb 0x180040668
mov rcx, qword [rsp + 0x40]
call fcn.180043070
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], r12
mov word [rsp + 0x40], r12w
lea rdx, str.Instances_
lea rcx, [rsp + 0x90]
call fcn.180021fc0
lea r9, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 8
cmovae r9, qword [rsp + 0xc0]
lea rdx, [rsp + 0x98]
cmp qword [rsp + 0xb0], 8
cmovae rdx, qword [rsp + 0x98]
mov dword [rsp + 0x20], r12d
lea r8, str.DefaultInstance
mov rcx, r13
call fcn.1800217ac
cmp eax, r12d
jne 0x180040730
mov edi, 0xb
cmp qword [rsp + 0xd8], 8
jb 0x1800406f6
mov rcx, qword [rsp + 0xc0]
call fcn.180043070
mov qword [rsp + 0xd8], rbp
mov qword [rsp + 0xd0], r12
mov word [rsp + 0xc0], r12w
cmp qword [rsp + 0xb0], 8
jb 0x1800408ba
mov rcx, qword [rsp + 0x98]
call fcn.180043070
jmp 0x1800408ba
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x90]
call fcn.180022fc8
mov r8d, 0x40b3c
lea rdx, [0x180069c3c]
lea rcx, [rsp + 0x68]
call fcn.18002132c
cmp qword [rax + 0x20], 8
jb 0x180040770
mov r9, qword [rax + 8]
jmp 0x180040774
lea r9, [rax + 8]
lea rdx, [rsp + 0x98]
cmp qword [rsp + 0xb0], 8
cmovae rdx, qword [rsp + 0x98]
mov dword [rsp + 0x20], r12d
lea r8, str.Altitude
mov rcx, r13
call fcn.1800217ac
cmp eax, r12d
je 0x1800407e2
lea rdx, [rsp + 0x98]
cmp qword [rsp + 0xb0], 8
cmovae rdx, qword [rsp + 0x98]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, str.Flags
mov rcx, r13
call fcn.180021774
cmp eax, r12d
je 0x1800407e2
mov dil, r12b
jmp 0x1800407e5
mov dil, bl
cmp qword [rsp + 0x88], 8
jb 0x1800407fa
mov rcx, qword [rsp + 0x70]
call fcn.180043070
cmp dil, r12b
je 0x18004084f
mov edi, 0xb
cmp qword [rsp + 0xd8], 8
jb 0x18004081c
mov rcx, qword [rsp + 0xc0]
call fcn.180043070
mov qword [rsp + 0xd8], rbp
mov qword [rsp + 0xd0], r12
mov word [rsp + 0xc0], r12w
cmp qword [rsp + 0xb0], 8
jb 0x1800408ba
mov rcx, qword [rsp + 0x98]
call fcn.180043070
jmp 0x1800408ba
mov edi, r12d
cmp qword [rsp + 0xd8], 8
jb 0x18004086a
mov rcx, qword [rsp + 0xc0]
call fcn.180043070
mov qword [rsp + 0xd8], rbp
mov qword [rsp + 0xd0], r12
mov word [rsp + 0xc0], r12w
cmp qword [rsp + 0xb0], 8
jb 0x1800408d6
mov rcx, qword [rsp + 0x98]
call fcn.180043070
jmp 0x1800408d6
mov edi, 0xb
cmp qword [rsp + 0xb0], 8
jb 0x1800408ba
mov rcx, qword [rsp + 0x98]
call fcn.180043070
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp ebx, r12d
je 0x1800408d6
mov rcx, rsi
call fcn.180021e70
nop
cmp qword [rsp + 0x100], 8
jb 0x1800408ee
mov rcx, qword [rsp + 0xe8]
call fcn.180043070
mov eax, edi
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.180042bb0
mov rbx, qword [rsp + 0x378]
add rsp, 0x330
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret