Function at 0x140002eb0
Capabilities:
Check if file exists
Copy file
Get common file path
Get file attributes
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r12
push r13
lea rbp, [rsp - 0x870]
sub rsp, 0x970
mov rax, qword [0x1401f0b90]
xor rax, rsp
mov qword [rbp + 0x860], rax
lea r8, [0x1401b82a0]
lea rcx, [0x1401fdd60]
mov edx, 0x104
call fcn.14013fcd4
lea rdx, [0x1401fdd60]
lea rcx, str.FixBTW_with_BTW_drvs_in__S
call fcn.1400052e0
call fcn.140001ac0
lea r8, [0x1401fdd60]
lea rcx, [rbp + 0x440]
mov edx, 0x104
call fcn.14013fd5c
lea r8, str._btwpanfl.inf
lea rcx, [rbp + 0x440]
mov edx, 0x104
call fcn.14013fcd4
lea rcx, [rbp + 0x440]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor r13d, r13d
cmp eax, 0xffffffff
je 0x1400030c1
mov qword [rsp + 0x38], r13
lea rax, [rbp + 0x650]
mov qword [rsp + 0x30], r13
lea r9d, [r13 + 8]
lea r8d, [r13 + 1]
lea rcx, [rbp + 0x440]
xor edx, edx
mov dword [rsp + 0x28], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupCopyOEMInfW]
test eax, eax
je 0x140002fa1
lea rdx, [rbp + 0x650]
lea rcx, str.btwpanfl.inf_installed_into__S
call fcn.1400052e0
jmp 0x140002fbc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x1400030b1
lea rcx, str.btwpanfl.inf_installed_already...
call fcn.1400052e0
lea rcx, [rbp + 0x230]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, str.drivers_btwpanfl.sys
lea rcx, [rbp + 0x230]
mov edx, 0x104
call fcn.14013fcd4
lea r8, [0x1401fdd60]
lea rcx, [rbp + 0x20]
mov edx, 0x104
call fcn.14013fd5c
lea r8, str._btwpanfl.sys
lea rcx, [rbp + 0x20]
mov edx, 0x104
call fcn.14013fcd4
lea r8, [rbp + 0x230]
lea rdx, [rbp + 0x20]
lea rcx, str.Copying__S_to__S
call fcn.1400052e0
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x20]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140003053
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.btwpanfl.sys_copy_failed:_error__u
mov edx, eax
call fcn.1400052e0
lea rcx, [rbp + 0x230]
call fcn.140002050
mov ebx, r13d
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140002190
test eax, eax
jne 0x1400030a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x103
jne 0x140003098
lea rcx, str.btwpanfl_filter_not_installed_as_the_BTHPAN_device_is_not_found...
call fcn.1400052e0
inc ebx
cmp ebx, 0x14
jl 0x140003062
jmp 0x1400030cd
lea rcx, str.btwpanfl_filter_not_configured:_error__u
mov edx, eax
call fcn.1400052e0
jmp 0x1400030cd
lea rcx, str.btwpanfl_filter_configured
jmp 0x1400030c8
lea rcx, str.btwpanfl.inf_not_installed:_error__u
mov edx, eax
call fcn.1400052e0
jmp 0x1400030cd
lea rcx, str.Not_dealing_with_the_btwpanfl_as_it_does_not_seem_to_exist...
call fcn.1400052e0
lea rax, [rsp + 0x78]
lea rdx, str.SystemCurrentControlSetServicesBTWAMPFL
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x70], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000314f
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
lea rdx, str.PassThruMode
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
test eax, eax
mov ebx, r13d
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x14000314f
lea rcx, str.btwampfl_passthrumode_disabled
call fcn.1400052e0
jmp 0x140003163
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.btwampfl_passthrumode_disable_failed:_error__u
mov edx, eax
call fcn.1400052e0
mov ebx, r13d
call fcn.1400025e0
test eax, eax
jne 0x1400031ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x103
jne 0x14000319c
lea rcx, str.btwampfl_filter_not_installed_as_the_BT_device_is_not_found...
call fcn.1400052e0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x14
jl 0x140003166
jmp 0x1400031b8
lea rcx, str.btwampfl_filter_not_configured:_error__u
mov edx, eax
call fcn.1400052e0
jmp 0x1400031b8
lea rcx, str.btwampfl_filter_configured
call fcn.1400052e0
mov ebx, r13d
nop dword [rax + rax]
mov dword [rsp + 0x60], 0xf4
mov dword [rsp + 0x58], 0xf8
mov dword [rsp + 0x50], reloc.WS2_32.dll_sendto
mov dword [rsp + 0x48], 0xab
mov dword [rsp + 0x40], 0xa8
mov dword [rsp + 0x38], 0x5a
mov dword [rsp + 0x30], 0x66
lea rdx, str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
lea rcx, [rbp - 0x60]
mov r9d, 0x3e4f
mov r8d, 0x24df01a9
mov dword [rsp + 0x28], 0x9f
mov dword [rsp + 0x20], 0x4c9f
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [0x1401b6510]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
cmp rax, 0xffffffffffffffff
je 0x140003253
lea rcx, [rbp - 0x60]
mov rdx, rax
call fcn.140002a70
test eax, eax
jne 0x140003269
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jl 0x1400031c0
mov dword [rsp + 0x60], 0xf4
mov dword [rsp + 0x58], 0xf8
mov dword [rsp + 0x50], reloc.WS2_32.dll_sendto
mov dword [rsp + 0x48], 0xab
mov dword [rsp + 0x40], 0xa8
mov dword [rsp + 0x38], 0x5a
mov dword [rsp + 0x30], 0x66
lea rdx, str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
lea rcx, [rbp - 0x60]
mov r9d, 0x3e4f
mov r8d, 0x24df01a9
mov dword [rsp + 0x28], 0x9f
mov dword [rsp + 0x20], 0x4c9f
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [0x1401b6510]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
cmp rax, 0xffffffffffffffff
je 0x14000330d
lea rcx, [rbp - 0x60]
mov rdx, rax
call fcn.140002a70
test eax, eax
je 0x14000330d
lea rcx, str.btwaudio_is_running_already
call fcn.1400052e0
jmp 0x1400033b5
lea r8, [0x1401fdd60]
lea rcx, [rbp + 0x20]
mov edx, 0x104
call fcn.14013fd5c
lea r8, str._btwaudio.inf
lea rcx, [rbp + 0x20]
mov edx, 0x104
call fcn.14013fcd4
xor edx, edx
mov qword [rsp + 0x38], r13
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], r13
lea rcx, [rbp + 0x20]
lea r9d, [rdx + 8]
lea r8d, [rdx + 1]
mov dword [rsp + 0x28], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupCopyOEMInfW]
test eax, eax
je 0x140003382
lea rdx, [rbp + 0x230]
lea rcx, str.btwaudio.inf_installed_into__S
call fcn.1400052e0
jmp 0x1400033a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x14000339b
lea rcx, str.btwaudio.inf_installed_already...
call fcn.1400052e0
jmp 0x1400033a9
lea rcx, str.btwaudio.inf_not_installed:_error__u
mov edx, eax
call fcn.1400052e0
lea rcx, [0x1401b6d18]
call fcn.140003760
mov dword [rsp + 0x60], 0x49
mov dword [rsp + 0x58], 0xd1
mov dword [rsp + 0x50], 0xe0
mov dword [rsp + 0x48], 0x84
mov dword [rsp + 0x40], 0x37
mov dword [rsp + 0x38], 0xa4
mov dword [rsp + 0x30], 0xb0
lea rdx, str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
lea rcx, [rbp - 0x60]
mov r9d, 0x12ba
mov r8d, 0x84a1e9b8
mov dword [rsp + 0x28], 0x8a
mov dword [rsp + 0x20], 0x4a9c
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [0x1401b6500]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
cmp rax, 0xffffffffffffffff
je 0x140003459
lea rcx, [rbp - 0x60]
mov rdx, rax
call fcn.140002a70
test eax, eax
je 0x140003459
lea rcx, str.btwrchid_is_running_already
call fcn.1400052e0
jmp 0x140003501
lea r8, [0x1401fdd60]
lea rcx, [rbp + 0x20]
mov edx, 0x104
call fcn.14013fd5c
lea r8, str._btwrchid.inf
lea rcx, [rbp + 0x20]
mov edx, 0x104
call fcn.14013fcd4
xor edx, edx
mov qword [rsp + 0x38], r13
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], r13
lea rcx, [rbp + 0x20]
lea r9d, [rdx + 8]
lea r8d, [rdx + 1]
mov dword [rsp + 0x28], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupCopyOEMInfW]
test eax, eax
je 0x1400034ce
lea rdx, [rbp + 0x230]
lea rcx, str.btwrchid.inf_installed_into__S
call fcn.1400052e0
jmp 0x1400034f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x1400034e7
lea rcx, str.btwrchid.inf_installed_already...
call fcn.1400052e0
jmp 0x1400034f5
lea rcx, str.btwrchid.inf_not_installed:_error__u
mov edx, eax
call fcn.1400052e0
lea rcx, [0x1401b6d28]
call fcn.140003760
mov dword [rsp + 0x60], 0xfa
mov dword [rsp + 0x58], 0x26
mov dword [rsp + 0x50], 0xd1
mov dword [rsp + 0x48], 0xe0
mov dword [rsp + 0x40], 0xf0
mov dword [rsp + 0x38], 0xf0
mov dword [rsp + 0x30], VariantTimeToSystemTime
lea rdx, str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
lea rcx, [rbp - 0x60]
mov r9d, 0xd928
mov r8d, 0x6e0c8f4c
mov dword [rsp + 0x28], VariantTimeToSystemTime
mov dword [rsp + 0x20], 0x4852
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [0x1401b6d48]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14000367b
mov qword [rsp + 0x990], rsi
mov qword [rsp + 0x998], rdi
mov esi, r13d
nop
lea r8, [rbp - 0x80]
mov edx, esi
mov rcx, r12
mov dword [rbp - 0x80], 0x20
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
mov edi, eax
test eax, eax
je 0x14000361c
lea rax, [rsp + 0x70]
xor r9d, r9d
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x20]
lea r8d, [r9 + 1]
mov rcx, r12
mov dword [rsp + 0x28], 0x208
mov dword [rsp + 0x70], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x14000361c
lea rcx, [rbp - 0x60]
call fcn.140140708
lea rcx, [rbp + 0x20]
mov rbx, rax
call fcn.140140708
mov rdx, rbx
mov rcx, rax
call fcn.140140a90
test rax, rax
jne 0x140003628
inc esi
test edi, edi
jne 0x1400035a0
jmp 0x14000363d
lea rdx, [rbp + 0x20]
lea rcx, str.IsDevicePresent:__S_found
call fcn.1400052e0
mov edi, 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r12
mov ebx, eax
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [rsp + 0x990]
test edi, edi
mov rdi, qword [rsp + 0x998]
je 0x14000367b
lea rcx, str.btwl2cap_is_running_already
call fcn.1400052e0
jmp 0x140003723
lea r8, [0x1401fdd60]
lea rcx, [rbp + 0x20]
mov edx, 0x104
call fcn.14013fd5c
lea r8, str._btwl2cap.inf
lea rcx, [rbp + 0x20]
mov edx, 0x104
call fcn.14013fcd4
xor edx, edx
mov qword [rsp + 0x38], r13
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], r13
lea rcx, [rbp + 0x20]
lea r9d, [rdx + 8]
lea r8d, [rdx + 1]
mov dword [rsp + 0x28], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupCopyOEMInfW]
test eax, eax
je 0x1400036f0
lea rdx, [rbp + 0x230]
lea rcx, str.btwl2cap.inf_installed_into__S
call fcn.1400052e0
jmp 0x140003717
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140003709
lea rcx, str.btwl2cap.inf_installed_already...
call fcn.1400052e0
jmp 0x140003717
lea rcx, str.btwl2cap.inf_not_installed:_error__u
mov edx, eax
call fcn.1400052e0
lea rcx, [0x1401b6d38]
call fcn.140003760
call fcn.140003950
call fcn.140001960
mov rcx, qword [rbp + 0x860]
xor rcx, rsp
call fcn.14013f9a0
mov rbx, qword [rsp + 0x9a0]
add rsp, 0x970
pop r13
pop r12
pop rbp
ret