Function at 0x140007ca0
Capabilities:
Copy file
Create directory
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov rbx, qword [0x14000d488]
mov r13, rdx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call rbx
mov rbx, qword [0x14000d488]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call rbx
mov rbx, qword [0x14000d488]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call rbx
mov rbx, qword [0x14000d488]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x30c
mov rcx, rax
call rbx
mov rbx, qword [0x14000d488]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x30c
mov rcx, rax
call rbx
mov rbx, qword [0x14000d488]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x30c
mov rcx, rax
call rbx
mov rbx, qword [0x14000d488]
mov rsi, rax
mov qword [rsp + 0x2d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x30c
mov rcx, rax
call rbx
mov rbx, qword [0x14000d488]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x30c
mov rcx, rax
call rbx
mov rbx, qword [rsp + 0x2c0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400018c0
xor r8d, r8d
lea ecx, [r8 + 0x5c]
test rdi, rdi
je 0x140007e1e
test rax, rax
je 0x140007e1e
cmp rdi, rax
je 0x140007e1e
movzx edx, word [rax]
mov rcx, rdi
test dx, dx
je 0x140007e10
sub rax, rdi
nop word [rax + rax]
mov word [rcx], dx
add rcx, 2
movzx edx, word [rcx + rax]
test dx, dx
jne 0x140007e00
mov word [rcx], r8w
mov rax, rdi
mov ecx, 0x5c
jmp 0x140007e26
mov rax, rdi
test rdi, rdi
je 0x140007e64
cmp word [rdi], r8w
je 0x140007e3a
nop dword [rax]
add rax, 2
cmp word [rax], r8w
jne 0x140007e30
lea rdx, [0x14000b718]
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x140007e50
mov word [rax], r8w
mov rax, qword [0x14000d460]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call rax
mov qword [rsp + 0x2d8], rax
cmp rax, 0xffffffffffffffff
je 0x14000842b
nop word [rax + rax]
test byte [rsp + 0x30], 0x10
je 0x140008014
lea rdx, [0x14000b724]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x14000829b
lea rdx, [0x14000b728]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x14000829b
mov rcx, rbx
call fcn.1400018c0
test r14, r14
je 0x140007f1c
test rax, rax
je 0x140007f1c
cmp r14, rax
je 0x140007f1c
movzx edx, word [rax]
mov rcx, r14
test dx, dx
je 0x140007f10
sub rax, r14
nop dword [rax]
nop dword [rax + rax]
mov word [rcx], dx
add rcx, 2
movzx edx, word [rcx + rax]
test dx, dx
jne 0x140007f00
xor r8d, r8d
mov rax, r14
mov word [rcx], r8w
jmp 0x140007f2b
mov rax, r14
test r14, r14
je 0x140007fa4
xor r8d, r8d
cmp word [r14], 0
je 0x140007f3c
add rax, 2
cmp word [rax], 0
jne 0x140007f32
lea rdx, [0x14000b730]
mov ecx, 0x5c
sub rdx, rax
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x140007f50
mov word [rax], r8w
mov rax, r14
cmp word [r14], cx
je 0x140007f7a
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x140007f70
movzx ecx, word [rsp + 0x5c]
test cx, cx
je 0x140007fa0
lea rdx, [rsp + 0x5c]
sub rdx, rax
nop dword [rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x140007f90
mov word [rax], r8w
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x140007fb0
mov rdi, qword [0x14000d488]
lea rbx, [rsi*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call rdi
xor edi, edi
mov edx, edi
test rsi, rsi
je 0x140008000
nop word [rax + rax]
movzx ecx, byte [r14 + rdx*2]
mov byte [rdx + rax], cl
inc rdx
cmp rdx, rsi
jb 0x140007ff0
mov rdx, r13
mov byte [rax + rsi], dil
mov rcx, rax
call fcn.140007ca0
jmp 0x1400081fa
mov r8d, 0x104
lea rcx, str.temp
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x14000842b
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x14000b7f8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r13
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rcx, rbx
call fcn.1400018c0
test rbp, rbp
je 0x1400080ac
test rax, rax
je 0x1400080ac
cmp rbp, rax
je 0x1400080ac
movzx edx, word [rax]
mov rcx, rbp
test dx, dx
je 0x1400080a0
sub rax, rbp
nop word [rax + rax]
mov word [rcx], dx
add rcx, 2
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140008090
xor r8d, r8d
mov rax, rbp
mov word [rcx], r8w
jmp 0x1400080bb
mov rax, rbp
test rbp, rbp
je 0x140008134
xor r8d, r8d
cmp word [rbp], 0
je 0x1400080cc
add rax, 2
cmp word [rax], 0
jne 0x1400080c2
lea rdx, [0x14000b730]
mov ecx, 0x5c
sub rdx, rax
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400080e0
mov word [rax], r8w
mov rax, rbp
cmp word [rbp], cx
je 0x14000810a
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x140008100
movzx ecx, word [rsp + 0x5c]
test cx, cx
je 0x140008130
lea rdx, [rsp + 0x5c]
sub rdx, rax
nop dword [rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140008120
mov word [rax], r8w
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x14000b7f8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r13
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [0x14000b7f8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rax, [rsp + 0x5c]
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140008180
mov rdi, qword [0x14000d488]
lea rbx, [rsi*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call rdi
xor edi, edi
mov edx, edi
test rsi, rsi
je 0x1400081d0
nop word [rax + rax]
movzx ecx, byte [rsp + rdx*2 + 0x5c]
mov byte [rdx + rax], cl
inc rdx
cmp rdx, rsi
jb 0x1400081c0
mov rdx, rax
mov byte [rax + rsi], dil
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, r15
call fcn.1400018c0
mov rdx, rax
mov r8d, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rbx, qword [rsp + 0x2c0]
mov rcx, rbx
call fcn.1400018c0
test r12, r12
je 0x140008248
test rax, rax
je 0x140008248
cmp r12, rax
je 0x140008248
movzx edx, word [rax]
mov rcx, r12
test dx, dx
je 0x140008240
sub rax, r12
nop word [rax + rax]
mov word [rcx], dx
add rcx, 2
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140008230
mov word [rcx], di
mov rax, r12
jmp 0x140008250
mov rax, r12
test r12, r12
je 0x140008293
cmp word [r12], 0
je 0x14000826a
nop dword [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x140008260
lea rdx, [0x14000b730]
mov ecx, 0x5c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140008280
mov word [rax], di
mov rsi, qword [rsp + 0x2d0]
mov rax, qword [0x14000d448]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x2d8]
call rax
test eax, eax
jne 0x140007e90
mov r8, qword [rsp + 0x20]
movups xmm0, xmmword [str.cmd.exe__c__cd]
movups xmmword [r8], xmm0
lea rcx, [r8 - 1]
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400082d0
xor edx, edx
nop dword [rax]
movzx eax, byte [rsi + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400082e0
lea rcx, [r8 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400082f3
movups xmm0, xmmword [str.__c:__tar__cf]
movups xmmword [rcx], xmm0
movzx eax, word [0x14000b888]
mov word [rcx + 0x10], ax
movzx eax, byte [0x14000b88a]
mov byte [rcx + 0x12], al
lea rcx, [r8 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140008320
xor edx, edx
nop dword [rax]
movzx eax, byte [rdx + r13]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140008330
lea rcx, [r8 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140008344
mov eax, dword [str..tar]
mov dword [rcx], eax
movzx eax, word [0x14000b890]
mov word [rcx + 4], ax
lea rcx, [r8 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140008365
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + r13]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140008380
lea rcx, [r8 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140008394
movzx eax, word [0x14000b894]
mov word [rcx], ax
mov rcx, r8
call fcn.1400049d0
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x14000b7f8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r13
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, r15
call fcn.140004b30
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x14000b7f8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r13
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str..tar
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rax, r15
jmp 0x14000842d
xor eax, eax
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret