Function at 0x14002bab0
Capabilities:
Copy file
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x360
mov rdi, rcx
mov esi, r8d
mov r13, rdx
lea rcx, [rsp + 0x68]
mov edx, 0x19c8
and esi, 0x30000
call fcn.140063314
mov r8, qword [rsp + 0x68]
lea r9, [rsp + 0x40]
xor r15d, r15d
mov edx, 0x527
mov rcx, r13
mov qword [rsp + 0x40], r15
call fcn.14006426c
mov r11, qword [rsp + 0x40]
cmp r11, r15
jne 0x14002bb26
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r12d, [r15 + 1]
mov ebx, eax
cmp eax, r15d
cmove ebx, r12d
jmp 0x14002c0e2
mov rbp, qword [rsp + 0x68]
sub r11, rbp
mov rdx, rbp
sar r11, 1
lea r14, [rbp + 0xa50]
movsxd rax, r11d
mov rcx, r14
lea r10, [rax + rax]
mov r8, r10
call fcn.14001d7d8
lea rax, [r10 + r14]
xor edx, edx
mov word [rax], r15w
mov rcx, qword [rdi + 0x168]
mov qword [rsp + 0x70], rax
lea rbx, [r14 + 0xa50]
lea r12d, [rdx + 1]
cmp rcx, rdx
je 0x14002bc2b
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rdi + 0x168]
lea r8d, [r12 + 0x5b]
movsxd rcx, eax
cmp r8w, word [rdx + rcx*2 - 2]
je 0x14002bba1
lea r8d, [r12 + 0x2e]
cmp r8w, word [rdx + rcx*2 - 2]
jne 0x14002bba4
sub eax, r12d
cdqe
mov rcx, rbx
lea r10, [rax + rax]
mov r8, r10
call fcn.14001d7d8
lea rcx, [r10 + rbx]
lea rdx, [0x140120ed8]
mov r8d, 0xc
call fcn.14001d7d8
mov rdx, qword [rdi + 0x168]
lea rcx, [rbx + 0xa50]
mov r8, r10
call fcn.14001d7d8
lea rcx, [r10 + rbx + 0xa50]
lea rdx, str.SYSTEM32DRIVERS_
mov r8d, 0x26
call fcn.14001d7d8
mov rdx, qword [rdi + 0x168]
lea rcx, [rbx + 0x14a0]
mov r8, r10
call fcn.14001d7d8
lea rdx, str.SYSTEM32_
add rcx, r10
mov r8d, 0x16
call fcn.14001d7d8
jmp 0x14002bcc0
lea rcx, [rsp + 0x78]
lea rdx, str._SystemRoot_INF_
mov r8d, 0x24
call fcn.140102b50
lea rcx, [rsp + 0x78]
mov r8d, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rsp + 0xd0]
lea rdx, str._SystemRoot_SYSTEM32DRIVERS_
mov r8d, 0x3e
call fcn.140102b50
lea rdx, [rbx + 0xa50]
lea rcx, [rsp + 0xd0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rsp + 0xa0]
lea rdx, str._SystemRoot_SYSTEM32_
mov r8d, 0x2e
call fcn.140102b50
lea rdx, [rbx + 0x14a0]
lea rcx, [rsp + 0xa0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbx + 0xa50]
mov dword [rsp + 0x3b0], eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbx + 0x14a0]
mov dword [rsp + 0x58], eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, dword [rsp + 0x3b0]
mov rdx, qword [rsp + 0x40]
lea rcx, [rbx + rcx*2]
mov dword [rsp + 0x3b8], eax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x30]
mov edx, 0x2800
call fcn.140063314
mov rcx, qword [rsp + 0x30]
lea r8, str.ToSys:Copy___s_
mov r9, r13
mov edx, 0x27ff
call fcn.140103198
mov rdx, qword [rsp + 0x30]
xor eax, eax
add rdi, 8
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x11]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rdi
call fcn.140025f80
lea rcx, [rsp + 0x30]
call fcn.14005aef8
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CopyFileW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
cmp esi, edx
je 0x14002bdde
lea rcx, [rsp + 0x30]
mov edx, 0x2800
call fcn.140063314
mov rcx, qword [rsp + 0x30]
lea r8, str.ToSys:TreatINF___s_
mov r9, rbx
mov edx, 0x27ff
call fcn.140103198
mov rdx, qword [rsp + 0x30]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x11]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140025f80
lea rcx, [rsp + 0x30]
call fcn.14005aef8
mov edx, esi
mov rcx, rbx
call fcn.1400211b4
lea rcx, [rsp + 0x30]
mov edx, 0x2800
call fcn.140063314
mov rcx, qword [rsp + 0x30]
lea r8, str.ToSys:END___s_
mov r9, r13
mov edx, 0x27ff
call fcn.140103198
mov rdx, qword [rsp + 0x30]
xor r13d, r13d
lea r9d, [r13 + 0x11]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140025f80
lea rcx, [rsp + 0x30]
call fcn.14005aef8
mov rcx, qword [rsp + 0x40]
lea r8d, [r13 + 8]
lea rdx, [0x140120db8]
call fcn.14001d7d8
lea rcx, [rsp + 0x114]
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0x110], r13d
call fcn.140101f00
lea r8, [rsp + 0x110]
lea rcx, [rsp + 0x38]
mov rdx, rbp
mov qword [rsp + 0x38], r13
call fcn.140101224
cmp qword [rsp + 0x38], r13
je 0x14002c0da
lea edi, [r13 + 4]
test byte [rsp + 0x110], 0x10
jne 0x14002c0a8
mov ecx, 0x2e
cmp cx, word [rsp + 0x13c]
jne 0x14002becf
movzx eax, word [rsp + 0x13e]
cmp ax, r13w
je 0x14002c0a8
cmp cx, ax
jne 0x14002becf
cmp word [rsp + 0x140], r13w
je 0x14002c0a8
lea rcx, [rsp + 0x13c]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x13c]
add eax, r12d
movsxd r8, eax
add r8, r8
call fcn.14001d7d8
lea rcx, [rsp + 0x13c]
call fcn.140102490
mov ebp, dword [rsp + 0x3b8]
lea rdx, [0x140120da8]
cmp eax, edi
cmovl eax, edi
lea rdi, [rbx + 0x14a0]
cdqe
lea r13, [rsp + rax*2 + 0x134]
mov rcx, r13
call fcn.1401026b4
xor edx, edx
cmp eax, edx
jne 0x14002bf41
mov ebp, dword [rsp + 0x3b0]
mov rdi, rbx
lea rdx, str..SYS
mov rcx, r13
call fcn.1401026b4
xor r13d, r13d
cmp eax, r13d
jne 0x14002bf63
mov ebp, dword [rsp + 0x58]
lea rdi, [rbx + 0xa50]
movsxd rax, ebp
lea rdx, [rsp + 0x13c]
lea rcx, [rdi + rax*2]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebp, 0x2800
lea rcx, [rsp + 0x30]
mov rdx, rbp
call fcn.140063314
mov rcx, qword [rsp + 0x30]
lea r8, str.ToSys:Copy___s_
lea edx, [rbp - 1]
mov r9, r14
call fcn.140103198
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
mov r9d, 0x11
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140025f80
lea rcx, [rsp + 0x30]
call fcn.14005aef8
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp rbx, rdi
jne 0x14002c045
cmp esi, r13d
je 0x14002c045
lea rcx, [rsp + 0x60]
mov rdx, rbp
call fcn.140063314
mov rcx, qword [rsp + 0x60]
lea r8, str.ToSys:TreatINF___s_
lea edx, [rbp - 1]
mov r9, rbx
call fcn.140103198
mov rdi, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
mov r9d, 0x11
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140025f80
lea rcx, [rsp + 0x60]
call fcn.14005aef8
mov edx, esi
mov rcx, rbx
call fcn.1400211b4
jmp 0x14002c04a
mov rdi, qword [rsp + 0x48]
lea rcx, [rsp + 0x50]
mov rdx, rbp
call fcn.140063314
mov rcx, qword [rsp + 0x50]
lea r8, str.ToSys:End___s_
mov r9, r14
mov edx, 0x27ff
call fcn.140103198
mov rdx, qword [rsp + 0x50]
mov r9d, 0x11
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140025f80
lea rcx, [rsp + 0x50]
call fcn.14005aef8
mov word [rsp + 0x140], r13w
mov edi, 4
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r13d
jne 0x14002be8c
mov rcx, qword [rsp + 0x38]
cmp rcx, r13
je 0x14002c0da
cmp rcx, 0xffffffffffffffff
je 0x14002c0da
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x38], r13
mov ebx, r13d
lea rcx, [rsp + 0x68]
call fcn.14005aef8
mov eax, ebx
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x360
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret