Function at 0x2eda36371
Capabilities:
Copy file
Delete file
Query environment variable

Disassembly:
push rbp
sub rsp, 0xad0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xa60], rcx
mov qword [rbp + 0xa68], rdx
mov qword [rbp + 0xa48], 0
mov qword [rbp + 0xa40], 0
mov qword [rbp + 0xa30], 0
mov qword [rbp + 0xa28], 0
mov qword [rbp + 0xa20], 0
mov qword [rbp + 0xa18], 0
mov qword [rbp + 0xa10], 0
mov qword [rbp + 0xa08], 0
mov qword [rbp + 0xa00], 0
mov dword [rbp + 0xa3c], 0
mov rax, qword [0x2eda440c0]
lea rdx, [rbp + 0x7f0]
mov r8d, 0x104
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call rax
lea rdx, [rbp + 0x5e0]
mov rax, qword [rbp + 0xa68]
mov r8d, 0x104
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call rax
cmp qword [rbp + 0xa48], 0
jne 0x2eda36482
lea rcx, [0x2eda406c0]
call fcn.2eda37e7e
mov qword [rbp + 0xa30], rax
mov rax, qword [rbp + 0xa30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call rax
mov qword [rbp + 0xa48], rax
mov rax, qword [rbp + 0xa30]
mov rcx, rax
call fcn.2eda37f8e
cmp qword [rbp + 0xa40], 0
jne 0x2eda364cf
lea rcx, [0x2eda406df]
call fcn.2eda37d70
mov qword [rbp + 0xa28], rax
mov rdx, qword [rbp + 0xa28]
mov rax, qword [rbp + 0xa48]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xa40], rax
mov rax, qword [rbp + 0xa28]
mov rcx, rax
call fcn.2eda37f8e
lea rax, [rbp + 0x5e0]
mov r8, qword [rbp + 0xa40]
mov rdx, rax
mov ecx, 0
call r8
mov dword [rbp + 0x9fc], eax
cmp dword [rbp + 0x9fc], 0
je 0x2eda36507
cmp dword [rbp + 0x9fc], 0xb7
jne 0x2eda36729
lea rcx, [0x2eda406f9]
call fcn.2eda37e7e
mov qword [rbp + 0xa20], rax
lea rcx, [0x2eda40716]
call fcn.2eda37e7e
mov qword [rbp + 0xa18], rax
lea rax, [rbp + 0x5e0]
lea rdx, [0x2eda40734]
mov rcx, rax
call sub.msvcrt.dll_wcscat
lea rdx, [rbp + 0x5e0]
lea rax, [rbp + 0x3d0]
mov rcx, rax
call sub.msvcrt.dll_wcscpy
mov rdx, qword [rbp + 0xa20]
lea rax, [rbp + 0x3d0]
mov rcx, rax
call sub.msvcrt.dll_wcscat
lea rdx, [rbp + 0x5e0]
lea rax, [rbp + 0x1c0]
mov rcx, rax
call sub.msvcrt.dll_wcscpy
mov rdx, qword [rbp + 0xa18]
lea rax, [rbp + 0x1c0]
mov rcx, rax
call sub.msvcrt.dll_wcscat
mov eax, dword [0x2eda440c8]
test eax, eax
je 0x2eda365ae
mov rax, qword [rbp + 0xa18]
jmp 0x2eda365b5
mov rax, qword [rbp + 0xa20]
lea rcx, [rbp + 0x5e0]
mov rdx, rax
call sub.msvcrt.dll_wcscat
mov rax, qword [rbp + 0xa18]
mov rcx, rax
call fcn.2eda37f8e
mov rax, qword [rbp + 0xa20]
mov rcx, rax
call fcn.2eda37f8e
lea rax, [rbp + 0x3d0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileW]
call rax
lea rax, [rbp + 0x1c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileW]
call rax
lea rdx, [rbp + 0x5e0]
lea rax, [rbp + 0x7f0]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileW]
call rax
test eax, eax
je 0x2eda36729
lea rcx, [0x2eda40738]
call fcn.2eda37e7e
mov qword [rbp + 0xa00], rax
mov eax, dword [0x2eda440c8]
test eax, eax
je 0x2eda366f4
lea rcx, [0x2eda40745]
call fcn.2eda37e7e
mov qword [rbp + 0xa10], rax
lea rcx, [rbp + 0x5e0]
lea rax, [rbp - 0x50]
mov rdx, qword [rbp + 0xa00]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbp + 0xa10]
mov qword [rsp + 0x20], rdx
mov r9, rcx
lea r8, [0x2eda40758]
mov edx, 0x104
mov rcx, rax
call fcn.2eda32df8
mov rax, qword [rbp + 0xa10]
mov rcx, rax
call fcn.2eda37f8e
lea rcx, [0x2eda40778]
call fcn.2eda37e7e
mov qword [rbp + 0xa08], rax
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0xa08]
mov r8, rdx
mov rdx, rax
mov rcx, qword [rbp + 0xa60]
call fcn.2eda38269
mov dword [rbp + 0xa3c], eax
mov rax, qword [rbp + 0xa08]
mov rcx, rax
call fcn.2eda37f8e
jmp 0x2eda3671a
mov rdx, qword [rbp + 0xa00]
lea rax, [rbp + 0x5e0]
mov r8, rdx
mov rdx, rax
mov rcx, qword [rbp + 0xa60]
call fcn.2eda38269
mov dword [rbp + 0xa3c], eax
mov rax, qword [rbp + 0xa00]
mov rcx, rax
call fcn.2eda37f8e
mov eax, dword [rbp + 0xa3c]
add rsp, 0xad0
pop rbp
ret