Function at 0x1400026e0
Capabilities:
Copy file
Delete directory
Delete file
Query environment variable

Disassembly:
push rbp
lea rbp, [rsp - 0x26b0]
mov eax, 0x27b0
call fcn.14000d140
sub rsp, rax
mov rax, qword [0x14001a0d8]
xor rax, rsp
mov qword [rbp + 0x26a0], rax
movaps xmm0, xmmword [str._ProgramFiles_NewElantechETDCtrl.exe]
movaps xmm1, xmmword [0x140016940]
mov eax, dword [0x140016978]
mov dword [rbp + 0xe8], eax
movzx eax, word [0x14001697c]
lea rdx, [rbp + 0x8a0]
movaps xmmword [rbp + 0xa0], xmm0
movaps xmm0, xmmword [0x140016950]
movaps xmmword [rbp + 0xb0], xmm1
lea rcx, [rbp + 0xa0]
mov r8d, 0x100
mov word [rbp + 0xec], ax
movaps xmm1, xmmword [0x140016960]
movaps xmmword [rbp + 0xc0], xmm0
movsd xmm0, qword [0x140016970]
movsd qword [rbp + 0xe0], xmm0
movaps xmm0, xmmword [str._ProgramFiles_ElantechETDCtrl.exe]
movaps xmmword [rbp + 0xd0], xmm1
movaps xmm1, xmmword [0x140016660]
movaps xmmword [rbp + 0x260], xmm0
movaps xmm0, xmmword [0x140016670]
movaps xmmword [rbp + 0x270], xmm1
movaps xmm1, xmmword [0x140016680]
movaps xmmword [rbp + 0x280], xmm0
movsd xmm0, qword [0x140016690]
movsd qword [rbp + 0x2a0], xmm0
movaps xmmword [rbp + 0x290], xmm1
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x1ea0]
lea rcx, [rbp + 0x260]
mov r8d, 0x100
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x1ea0]
lea rcx, [rbp + 0x8a0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000280e
lea rcx, [rbp + 0x8a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movaps xmm0, xmmword [str._ProgramFiles_NewElantechETDCtrlHelper.exe]
movaps xmm1, xmmword [0x140016990]
movzx eax, word [0x1400169d8]
mov word [rbp + 0x1f8], ax
mov eax, dword [0x140016a30]
lea rdx, [rbp + 0x10a0]
movaps xmmword [rbp + 0x1a0], xmm0
movaps xmm0, xmmword [0x1400169a0]
movaps xmmword [rbp + 0x1b0], xmm1
lea rcx, [rbp + 0x1a0]
mov r8d, 0x100
mov dword [rbp + 0x250], eax
movaps xmm1, xmmword [0x1400169b0]
movaps xmmword [rbp + 0x1c0], xmm0
movaps xmm0, xmmword [0x1400169c0]
movaps xmmword [rbp + 0x1e0], xmm0
movaps xmm0, xmmword [str._ProgramFiles_ElantechETDCtrlHelper.exe]
movaps xmmword [rbp + 0x1d0], xmm1
movsd xmm1, qword [0x1400169d0]
movsd qword [rbp + 0x1f0], xmm1
movaps xmm1, xmmword [0x1400169f0]
movaps xmmword [rbp + 0x200], xmm0
movaps xmm0, xmmword [0x140016a00]
movaps xmmword [rbp + 0x220], xmm0
movaps xmm0, xmmword [0x140016a20]
movaps xmmword [rbp + 0x210], xmm1
movaps xmm1, xmmword [0x140016a10]
movaps xmmword [rbp + 0x240], xmm0
movaps xmmword [rbp + 0x230], xmm1
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x14a0]
lea rcx, [rbp + 0x200]
mov r8d, 0x100
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x14a0]
lea rcx, [rbp + 0x10a0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140002920
lea rcx, [rbp + 0x10a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movaps xmm0, xmmword [str._ProgramFiles_NewElantechETDCmds.dll]
movaps xmm1, xmmword [0x140016a50]
mov eax, dword [0x140016a88]
mov dword [rbp - 0x58], eax
movzx eax, word [0x140016a8c]
lea rdx, [rbp + 0xca0]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x140016a60]
movaps xmmword [rsp + 0x70], xmm1
lea rcx, [rsp + 0x60]
mov r8d, 0x100
mov word [rbp - 0x54], ax
movaps xmm1, xmmword [0x140016a70]
movaps xmmword [rbp - 0x80], xmm0
movsd xmm0, qword [0x140016a80]
movsd qword [rbp - 0x60], xmm0
movaps xmm0, xmmword [str._ProgramFiles_ElantechETDCmds.dll]
movaps xmmword [rbp - 0x70], xmm1
movaps xmm1, xmmword [0x140016aa0]
movaps xmmword [rbp + 0x310], xmm0
movaps xmm0, xmmword [0x140016ab0]
movaps xmmword [rbp + 0x320], xmm1
movaps xmm1, xmmword [0x140016ac0]
movaps xmmword [rbp + 0x330], xmm0
movsd xmm0, qword [0x140016ad0]
movsd qword [rbp + 0x350], xmm0
movaps xmmword [rbp + 0x340], xmm1
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x1aa0]
lea rcx, [rbp + 0x310]
mov r8d, 0x100
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x1aa0]
lea rcx, [rbp + 0xca0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140002a11
lea rcx, [rbp + 0xca0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movaps xmm0, xmmword [str._ProgramFiles_NewElantechETDApix.dll]
movaps xmm1, xmmword [0x140016af0]
mov eax, dword [0x140016b28]
mov dword [rbp - 8], eax
movzx eax, word [0x140016b2c]
lea rdx, [rbp + 0x6a0]
movaps xmmword [rbp - 0x50], xmm0
movaps xmm0, xmmword [0x140016b00]
movaps xmmword [rbp - 0x40], xmm1
lea rcx, [rbp - 0x50]
mov r8d, 0x100
mov word [rbp - 4], ax
movaps xmm1, xmmword [0x140016b10]
movaps xmmword [rbp - 0x30], xmm0
movsd xmm0, qword [0x140016b20]
movsd qword [rbp - 0x10], xmm0
movaps xmm0, xmmword [str._ProgramFiles_ElantechETDApix.dll]
movaps xmmword [rbp - 0x20], xmm1
movaps xmm1, xmmword [0x140016b40]
movaps xmmword [rbp + 0x3b0], xmm0
movaps xmm0, xmmword [0x140016b50]
movaps xmmword [rbp + 0x3c0], xmm1
movaps xmm1, xmmword [0x140016b60]
movaps xmmword [rbp + 0x3d0], xmm0
movsd xmm0, qword [0x140016b70]
movsd qword [rbp + 0x3f0], xmm0
movaps xmmword [rbp + 0x3e0], xmm1
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x22a0]
lea rcx, [rbp + 0x3b0]
mov r8d, 0x100
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x22a0]
lea rcx, [rbp + 0x6a0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140002aff
lea rcx, [rbp + 0x6a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movaps xmm0, xmmword [str._ProgramFiles_NewElantechETDFavorite.dll]
movaps xmm1, xmmword [0x140016b90]
mov eax, dword [0x140016bd0]
mov dword [rbp + 0x190], eax
movzx eax, word [0x140016bd4]
lea rdx, [rbp + 0xaa0]
movaps xmmword [rbp + 0x140], xmm0
movaps xmm0, xmmword [0x140016ba0]
movaps xmmword [rbp + 0x150], xmm1
lea rcx, [rbp + 0x140]
mov r8d, 0x100
mov word [rbp + 0x194], ax
movaps xmm1, xmmword [0x140016bb0]
movaps xmmword [rbp + 0x160], xmm0
movaps xmm0, xmmword [0x140016bc0]
movaps xmmword [rbp + 0x180], xmm0
movaps xmm0, xmmword [str._ProgramFiles_ElantechETDFavorite.dll]
movaps xmmword [rbp + 0x170], xmm1
movaps xmm1, xmmword [0x140016bf0]
movaps xmmword [rbp + 0x400], xmm0
movaps xmm0, xmmword [0x140016c00]
movaps xmmword [rbp + 0x420], xmm0
movaps xmm0, xmmword [0x140016c20]
movaps xmmword [rbp + 0x410], xmm1
movaps xmm1, xmmword [0x140016c10]
movaps xmmword [rbp + 0x440], xmm0
movaps xmmword [rbp + 0x430], xmm1
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x16a0]
lea rcx, [rbp + 0x400]
mov r8d, 0x100
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x16a0]
lea rcx, [rbp + 0xaa0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140002c01
lea rcx, [rbp + 0xaa0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movaps xmm0, xmmword [str._ProgramFiles_NewElantechETDMcpl.dll]
movaps xmm1, xmmword [0x140016c40]
mov eax, dword [0x140016c78]
mov dword [rbp + 0x48], eax
movzx eax, word [0x140016c7c]
lea rdx, [rbp + 0xea0]
movaps xmmword [rbp], xmm0
movaps xmm0, xmmword [0x140016c50]
movaps xmmword [rbp + 0x10], xmm1
lea rcx, [rbp]
mov r8d, 0x100
mov word [rbp + 0x4c], ax
movaps xmm1, xmmword [0x140016c60]
movaps xmmword [rbp + 0x20], xmm0
movsd xmm0, qword [0x140016c70]
movsd qword [rbp + 0x40], xmm0
movaps xmm0, xmmword [str._ProgramFiles_ElantechETDMcpl.dll]
movaps xmmword [rbp + 0x30], xmm1
movaps xmm1, xmmword [0x140016c90]
movaps xmmword [rbp + 0x360], xmm0
movaps xmm0, xmmword [0x140016ca0]
movaps xmmword [rbp + 0x370], xmm1
movaps xmm1, xmmword [0x140016cb0]
movaps xmmword [rbp + 0x380], xmm0
movsd xmm0, qword [0x140016cc0]
movsd qword [rbp + 0x3a0], xmm0
movaps xmmword [rbp + 0x390], xmm1
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x18a0]
lea rcx, [rbp + 0x360]
mov r8d, 0x100
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x18a0]
lea rcx, [rbp + 0xea0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140002cef
lea rcx, [rbp + 0xea0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movaps xmm0, xmmword [str._ProgramFiles_NewElantechETDService.exe]
movaps xmm1, xmmword [0x140016ce0]
mov eax, dword [0x140016d20]
mov dword [rbp + 0x300], eax
mov eax, dword [0x140016d78]
lea rdx, [rbp + 0x4a0]
movaps xmmword [rbp + 0x2b0], xmm0
movaps xmm0, xmmword [0x140016cf0]
movaps xmmword [rbp + 0x2c0], xmm1
mov dword [rbp + 0x98], eax
movzx eax, word [0x140016d7c]
lea rcx, [rbp + 0x2b0]
movaps xmm1, xmmword [0x140016d00]
movaps xmmword [rbp + 0x2d0], xmm0
movaps xmm0, xmmword [0x140016d10]
mov r8d, 0x100
mov word [rbp + 0x9c], ax
movaps xmmword [rbp + 0x2f0], xmm0
movaps xmm0, xmmword [str._ProgramFiles_ElantechETDService.exe]
movaps xmmword [rbp + 0x2e0], xmm1
movaps xmm1, xmmword [0x140016d40]
movaps xmmword [rbp + 0x50], xmm0
movaps xmm0, xmmword [0x140016d50]
movaps xmmword [rbp + 0x60], xmm1
movaps xmm1, xmmword [0x140016d60]
movaps xmmword [rbp + 0x70], xmm0
movsd xmm0, qword [0x140016d70]
movsd qword [rbp + 0x90], xmm0
movaps xmmword [rbp + 0x80], xmm1
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x1ca0]
lea rcx, [rbp + 0x50]
mov r8d, 0x100
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x1ca0]
lea rcx, [rbp + 0x4a0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movzx eax, word [0x140016e18]
lea rdx, [rbp + 0x12a0]
movaps xmm0, xmmword [str._ProgramFiles_NewElantechETDTouch.exe]
movaps xmm1, xmmword [0x140016d90]
lea rcx, [rbp + 0x450]
mov r8d, 0x100
mov word [rbp + 0x138], ax
movaps xmmword [rbp + 0x450], xmm0
movaps xmm0, xmmword [0x140016da0]
movaps xmmword [rbp + 0x460], xmm1
movaps xmm1, xmmword [0x140016db0]
movaps xmmword [rbp + 0x470], xmm0
movaps xmm0, xmmword [0x140016dc0]
movaps xmmword [rbp + 0x480], xmm1
movaps xmm1, xmmword [str._ProgramFiles_ElantechETDTouch.exe]
movaps xmmword [rbp + 0x490], xmm0
movaps xmm0, xmmword [0x140016de0]
movaps xmmword [rbp + 0xf0], xmm1
movaps xmm1, xmmword [0x140016df0]
movaps xmmword [rbp + 0x100], xmm0
movaps xmm0, xmmword [0x140016e00]
movaps xmmword [rbp + 0x110], xmm1
movsd xmm1, qword [0x140016e10]
movsd qword [rbp + 0x130], xmm1
movaps xmmword [rbp + 0x120], xmm0
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x20a0]
lea rcx, [rbp + 0xf0]
mov r8d, 0x100
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x20a0]
lea rcx, [rbp + 0x12a0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140002ee7
lea rcx, [rbp + 0x12a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rax, qword [str._ProgramFiles_NewElantech]
lea rdx, [rbp + 0x24a0]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rax, qword [0x140016618]
mov r8d, 0x100
mov qword [rsp + 0x28], rax
mov rax, qword [0x140016620]
mov qword [rsp + 0x30], rax
mov rax, qword [0x140016628]
mov qword [rsp + 0x38], rax
mov rax, qword [0x140016630]
mov qword [rsp + 0x40], rax
mov rax, qword [0x140016638]
mov qword [rsp + 0x48], rax
mov eax, dword [0x140016640]
mov dword [rsp + 0x50], eax
movzx eax, word [0x140016644]
mov word [rsp + 0x54], ax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rbp + 0x24a0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x140002f82
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.RemoveDirectory_failed_w_err_0x_08lx_n
mov edx, eax
call fcn.14000424c
mov rcx, qword [rbp + 0x26a0]
xor rcx, rsp
call fcn.140004010
add rsp, 0x27b0
pop rbp
ret