Function at 0x14002bf20
Capabilities:
Copy file
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
mov rdi, rcx
mov esi, r8d
mov r13, rdx
lea rcx, [rsp + 0x58]
mov edx, 0x19c8
and esi, 0x30000
call fcn.14005bf78
mov r8, qword [rsp + 0x58]
lea r9, [rsp + 0x40]
xor r14d, r14d
mov edx, 0x527
mov rcx, r13
mov qword [rsp + 0x40], r14
call fcn.14005cd64
mov r11, qword [rsp + 0x40]
cmp r11, r14
jne 0x14002bf96
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r12d, [r14 + 1]
mov ebx, eax
cmp eax, r14d
cmove ebx, r12d
jmp 0x14002c507
mov rbp, qword [rsp + 0x58]
sub r11, rbp
mov rdx, rbp
sar r11, 1
lea r15, [rbp + 0xa50]
movsxd rax, r11d
mov rcx, r15
lea r10, [rax + rax]
mov r8, r10
call fcn.14001b870
lea rax, [r10 + r15]
xor edx, edx
mov word [rax], r14w
mov rcx, qword [rdi + 0x168]
mov qword [rsp + 0x70], rax
lea rbx, [r15 + 0xa50]
lea r12d, [rdx + 1]
cmp rcx, rdx
je 0x14002c098
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rdi + 0x168]
lea r8d, [r12 + 0x5b]
movsxd rcx, eax
cmp r8w, word [rdx + rcx*2 - 2]
je 0x14002c011
lea r8d, [r12 + 0x2e]
cmp r8w, word [rdx + rcx*2 - 2]
jne 0x14002c014
sub eax, r12d
cdqe
mov rcx, rbx
lea r10, [rax + rax]
mov r8, r10
call fcn.14001b870
lea rcx, [r10 + rbx]
lea rdx, [0x140100978]
mov r8d, 0xc
call fcn.14001b870
mov rdx, qword [rdi + 0x168]
lea rcx, [rbx + 0xa50]
mov r8, r10
call fcn.14001b870
lea rcx, [r10 + rbx + 0xa50]
lea rdx, str.SYSTEM32DRIVERS_
mov r8d, 0x26
call fcn.14001b870
mov rdx, qword [rdi + 0x168]
lea rcx, [rbx + 0x14a0]
mov r8, r10
call fcn.14001b870
lea rdx, str.SYSTEM32_
add rcx, r10
mov r8d, 0x16
call fcn.14001b870
jmp 0x14002c0e2
lea rcx, str._SystemRoot_INF_
mov r8d, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbx + 0xa50]
lea rcx, str._SystemRoot_SYSTEM32DRIVERS_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbx + 0x14a0]
lea rcx, str._SystemRoot_SYSTEM32_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbx + 0xa50]
mov dword [rsp + 0x320], eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbx + 0x14a0]
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, dword [rsp + 0x320]
mov rdx, qword [rsp + 0x40]
lea rcx, [rbx + rcx*2]
mov dword [rsp + 0x328], eax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x30]
mov edx, 0x2800
call fcn.14005bf78
mov rcx, qword [rsp + 0x30]
lea r8, str.ToSys:Copy___s_
mov r9, r13
mov edx, 0x27ff
call fcn.1400e1208
mov rdx, qword [rsp + 0x30]
xor eax, eax
add rdi, 8
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x11]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rdi
call fcn.140026310
lea rcx, [rsp + 0x30]
call fcn.140054110
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CopyFileW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
cmp esi, edx
je 0x14002c200
lea rcx, [rsp + 0x30]
mov edx, 0x2800
call fcn.14005bf78
mov rcx, qword [rsp + 0x30]
lea r8, str.ToSys:TreatINF___s_
mov r9, rbx
mov edx, 0x27ff
call fcn.1400e1208
mov rdx, qword [rsp + 0x30]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x11]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140026310
lea rcx, [rsp + 0x30]
call fcn.140054110
mov edx, esi
mov rcx, rbx
call fcn.14001efa8
lea rcx, [rsp + 0x30]
mov edx, 0x2800
call fcn.14005bf78
mov rcx, qword [rsp + 0x30]
lea r8, str.ToSys:END___s_
mov r9, r13
mov edx, 0x27ff
call fcn.1400e1208
mov rdx, qword [rsp + 0x30]
xor r13d, r13d
lea r9d, [r13 + 0x11]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140026310
lea rcx, [rsp + 0x30]
call fcn.140054110
mov rcx, qword [rsp + 0x40]
lea r8d, [r13 + 8]
lea rdx, [0x140100858]
call fcn.14001b870
lea rcx, [rsp + 0x84]
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0x80], r13d
call fcn.1400dfee0
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0x38]
mov rdx, rbp
mov qword [rsp + 0x38], r13
call fcn.1400df3ac
cmp qword [rsp + 0x38], r13
je 0x14002c4ff
lea ecx, [r13 + 0x2e]
lea edi, [rcx - 0x2a]
test byte [rsp + 0x80], 0x10
jne 0x14002c4c8
cmp cx, word [rsp + 0xac]
jne 0x14002c2ef
movzx eax, word [rsp + 0xae]
cmp ax, r13w
je 0x14002c4c8
cmp cx, ax
jne 0x14002c2ef
cmp word [rsp + 0xb0], r13w
je 0x14002c4c8
lea rcx, [rsp + 0xac]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0xac]
add eax, r12d
movsxd r8, eax
add r8, r8
call fcn.14001b870
lea rcx, [rsp + 0xac]
call fcn.1400e0470
mov ebp, dword [rsp + 0x328]
lea rdx, [0x140100848]
cmp eax, edi
cmovl eax, edi
lea rdi, [rbx + 0x14a0]
cdqe
lea r13, [rsp + rax*2 + 0xa4]
mov rcx, r13
call fcn.1400e0694
xor edx, edx
cmp eax, edx
jne 0x14002c361
mov ebp, dword [rsp + 0x320]
mov rdi, rbx
lea rdx, str..SYS
mov rcx, r13
call fcn.1400e0694
xor r13d, r13d
cmp eax, r13d
jne 0x14002c383
mov ebp, dword [rsp + 0x60]
lea rdi, [rbx + 0xa50]
movsxd rax, ebp
lea rdx, [rsp + 0xac]
lea rcx, [rdi + rax*2]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebp, 0x2800
lea rcx, [rsp + 0x30]
mov rdx, rbp
call fcn.14005bf78
mov rcx, qword [rsp + 0x30]
lea r8, str.ToSys:Copy___s_
lea edx, [rbp - 1]
mov r9, r15
call fcn.1400e1208
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
mov r9d, 0x11
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140026310
lea rcx, [rsp + 0x30]
call fcn.140054110
xor r8d, r8d
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp rbx, rdi
jne 0x14002c465
cmp esi, r13d
je 0x14002c465
lea rcx, [rsp + 0x50]
mov rdx, rbp
call fcn.14005bf78
mov rcx, qword [rsp + 0x50]
lea r8, str.ToSys:TreatINF___s_
lea edx, [rbp - 1]
mov r9, rbx
call fcn.1400e1208
mov rdi, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
mov r9d, 0x11
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140026310
lea rcx, [rsp + 0x50]
call fcn.140054110
mov edx, esi
mov rcx, rbx
call fcn.14001efa8
jmp 0x14002c46a
mov rdi, qword [rsp + 0x48]
lea rcx, [rsp + 0x68]
mov rdx, rbp
call fcn.14005bf78
mov rcx, qword [rsp + 0x68]
lea r8, str.ToSys:End___s_
mov r9, r15
mov edx, 0x27ff
call fcn.1400e1208
mov rdx, qword [rsp + 0x68]
mov r9d, 0x11
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140026310
lea rcx, [rsp + 0x68]
call fcn.140054110
mov word [rsp + 0xb0], r13w
mov edi, 4
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, 0x2e
cmp eax, r13d
jne 0x14002c2b1
mov rcx, qword [rsp + 0x38]
cmp rcx, r13
je 0x14002c4ff
cmp rcx, 0xffffffffffffffff
je 0x14002c4ff
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x38], r13
mov ebx, r13d
lea rcx, [rsp + 0x58]
call fcn.140054110
mov eax, ebx
mov rbx, qword [rsp + 0x310]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret