Function at 0x140006ea0
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x12a0
call fcn.14002e9a0
sub rsp, rax
mov r14, rcx
xor esi, esi
lea rcx, [rsp + 0x6a1]
xor edx, edx
mov r8d, 0x3ff
mov ebp, esi
mov byte [rsp + 0x6a0], sil
call fcn.14001d490
mov ebx, 0x105
lea rcx, [rsp + 0x381]
mov r8, rbx
xor edx, edx
mov byte [rsp + 0x380], sil
call fcn.14001d490
lea rcx, [rsp + 0x161]
mov r8, rbx
xor edx, edx
mov byte [rsp + 0x160], sil
call fcn.14001d490
lea r12d, [rbx - 1]
lea rcx, [rsp + 0x271]
mov r8, r12
xor edx, edx
mov byte [rsp + 0x270], sil
call fcn.14001d490
lea r8d, [rbx - 6]
lea rcx, [rsp + 0x5a1]
xor edx, edx
mov byte [rsp + 0x5a0], sil
call fcn.14001d490
lea rdx, [rsp + 0x5a0]
lea rcx, [0x1400388c8]
call fcn.140009d4c
lea rdx, [rsp + 0x380]
mov r8d, r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [0x140031c78]
xor edx, edx
call fcn.140009dc4
lea r9, [r14 + 0x148]
lea r8, [rsp + 0x380]
lea rcx, [rsp + 0x6a0]
mov rdx, rax
call fcn.14001cad0
lea rcx, [rsp + 0x270]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [0x140031c90]
xor edx, edx
call fcn.140009dc4
mov rcx, rax
mov rdi, rax
call fcn.14001d780
lea rcx, [rsp + 0x270]
mov rbx, rax
call fcn.14001d780
lea rcx, [rbx + rax + 1]
cmp rcx, r12
jae 0x140007007
lea r8, [rsp + 0x160]
lea rcx, [rsp + 0x270]
mov rdx, rdi
call fcn.1400094c0
jmp 0x14000700f
mov byte [rsp + 0x160], sil
mov eax, 0x20
lea rcx, [rsp + 0x70]
mov qword [rsp + 0xa0], rsi
mov dword [rsp + 0xb0], esi
mov dword [rsp + 0xa8], esi
mov qword [rsp + 0xb8], rsi
mov dword [rsp + 0xac], eax
mov dword [rsp + 0xc4], eax
mov dword [rsp + 0xc8], esi
mov dword [rsp + 0xc0], esi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rsi
call fcn.140015dcc
mov r12d, dword [rsp + 0xc8]
test r12d, r12d
jle 0x140007102
test esi, esi
js 0x1400070ac
cmp esi, r12d
jge 0x1400070ac
movsxd rbx, esi
imul rbx, rbx, 0x130
add rbx, qword [rsp + 0xb8]
jmp 0x1400070ae
xor ebx, ebx
lea rdi, [rbx + 4]
lea rdx, [rsp + 0x160]
mov rcx, rdi
call fcn.14001ef30
test eax, eax
je 0x14000717f
mov rcx, rdi
jmp 0x1400070df
cmp al, 0x5c
je 0x1400070d7
cmp al, 0x2f
jne 0x1400070db
lea rcx, [rdi + 1]
add rdi, 1
mov al, byte [rdi]
test al, al
jne 0x1400070cf
lea rdx, [rsp + 0x160]
call fcn.14001ef30
test eax, eax
je 0x14000717f
add esi, 1
cmp esi, r12d
jl 0x14000708f
xor esi, esi
mov rbx, rsi
cmp rbx, rsi
je 0x140007468
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x2000000
mov rdi, rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x12d0], rsi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, rsi
mov rbx, rax
je 0x1400071ed
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x12d8], rsi
call fcn.1400027c8
mov rax, qword [rsp + 0x58]
mov r12d, 2
cmp rax, rsi
je 0x140007183
lea r8, [rsp + 0x12d8]
mov edx, r12d
mov rcx, rbx
call rax
jmp 0x140007185
xor esi, esi
jmp 0x140007107
mov eax, esi
cmp eax, esi
je 0x1400071d9
mov rdi, qword [rsp + 0x12d8]
lea rcx, [rsp + 0x50]
call fcn.1400027c8
mov r11, qword [rsp + 0x60]
cmp r11, rsi
je 0x1400071cb
lea rax, [rsp + 0x12d0]
mov r9d, r12d
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov edx, 0x2000000
mov rcx, rdi
mov dword [rsp + 0x20], 1
call r11
mov rcx, qword [rsp + 0x12d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x68]
cmp qword [rsp + 0x12d0], rsi
je 0x14000745a
xor edx, edx
lea rcx, [rsp + 0xf8]
lea r8d, [rdx + 0x60]
call fcn.14001d490
xor eax, eax
lea rcx, [rsp + 0xaa2]
xor edx, edx
mov r8d, 0x7fe
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0xf0], 0x68
mov word [rsp + 0xaa0], si
call fcn.14001d490
lea rax, [rsp + 0xaa0]
or r12d, 0xffffffff
lea r8, [rsp + 0x6a0]
xor edx, edx
xor ecx, ecx
mov r9d, r12d
mov dword [rsp + 0x28], 0x3ff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rbx, qword [rsp + 0x12d0]
lea rcx, [rsp + 0x50]
call fcn.1400027c8
mov r11, qword [rsp + 0x50]
cmp r11, rsi
je 0x1400072d9
lea rax, [rsp + 0xd0]
lea r9, [rsp + 0xaa0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xf0]
xor edx, edx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call r11
mov ebp, eax
jmp 0x1400072db
mov ebp, esi
cmp ebp, esi
jne 0x140007441
mov ebp, 0x104
lea rcx, [rsp + 0x491]
xor edx, edx
mov r8, rbp
mov byte [rsp + 0x490], sil
call fcn.14001d490
lea rdx, [rsp + 0x490]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, [rsp + 0x490]
call fcn.14001d780
lea rcx, [rsp + 0x5a0]
mov rbx, rax
call fcn.14001d780
lea rcx, [rbx + rax + 1]
cmp rcx, rbp
jae 0x140007357
lea r8, [r14 + 0x24d]
lea rdx, [rsp + 0x5a0]
lea rcx, [rsp + 0x490]
call fcn.1400094c0
jmp 0x14000735e
mov byte [r14 + 0x24d], sil
lea rdx, [r14 + 0x24d]
lea rcx, [rsp + 0x380]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [0x140031c78]
xor edx, edx
call fcn.140009dc4
lea r9, [r14 + 0x148]
lea r8, [r14 + 0x24d]
lea rcx, [rsp + 0x6a0]
mov rdx, rax
call fcn.14001cad0
lea rax, [rsp + 0xaa0]
lea r8, [rsp + 0x6a0]
mov r9d, r12d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x3ff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rbx, qword [rsp + 0x12d0]
lea rcx, [rsp + 0x50]
call fcn.1400027c8
mov r11, qword [rsp + 0x50]
cmp r11, rsi
je 0x140007427
lea rax, [rsp + 0xd0]
lea r9, [rsp + 0xaa0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xf0]
xor edx, edx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call r11
mov ebp, eax
jmp 0x140007429
mov ebp, esi
cmp ebp, esi
jne 0x140007441
lea rcx, [r14 + 0x24d]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [r14 + 0x24d], sil
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x12d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x68]
cmp rdi, rsi
je 0x140007468
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x70]
cmp rcx, rsi
je 0x140007478
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp qword [rsp + 0xb8], rsi
je 0x14000748f
mov rcx, qword [rsp + 0xb8]
call fcn.14001db00
mov rcx, qword [rsp + 0xa0]
cmp rcx, rsi
je 0x1400074a1
call fcn.14001db00
lea r11, [rsp + 0x12a0]
mov eax, ebp
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret