Function at 0x140002e10
Capabilities:
Copy file
Delete file
Get common file path
Terminate process

Disassembly:
test edx, edx
je 0x140003113
mov r11, rsp
push rbp
push rdi
push r15
lea rbp, [r11 - 0x3d8]
sub rsp, 0x4c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov qword [r11 + 0x18], rbx
mov r15d, edx
mov rdi, rcx
mov qword [r11 - 0x20], r13
xor edx, edx
mov qword [r11 - 0x28], r14
lea rcx, [rbp + 0x190]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov r13, 0xffffffffffffffff
call fcn.1400070e0
mov r14, qword [0x14001e6d8]
mov rbx, rax
test r14, r14
jne 0x140002ea7
mov rcx, qword [rax + 0x30]
lea edx, [r13 + 2]
call fcn.140004100
mov r14, rax
mov qword [0x14001e6d8], rax
cmp qword [0x14001e6c8], 0
mov qword [rsp + 0x4f8], rsi
jne 0x140002ee8
mov rcx, qword [rbx + 0x50]
call fcn.140002920
test rax, rax
je 0x140003114
xor edx, edx
mov rcx, rax
call fcn.140004100
mov rdx, qword [r14 + 0x10]
mov rcx, rax
mov qword [0x14001e6c8], rax
call fcn.140003ee0
mov rdx, qword [rdi + 0x18]
xor esi, esi
mov ecx, esi
lea rax, [rdx + 0x10]
movups xmm0, xmmword [rdx]
movups xmmword [rsp + 0x30], xmm0
cmp qword [rax], rcx
je 0x140002f0c
inc ecx
lea rax, [rax + 0x18]
cmp qword [rax], rsi
jne 0x140002f01
mov rbx, qword [rsp + 0x38]
movsxd rax, ecx
lea rcx, [rax + rax*2]
movups xmm1, xmmword [rdx + rcx*8 - 0x18]
movsd xmm0, qword [rdx + rcx*8 - 8]
mov edx, r15d
movsd qword [rsp + 0x58], xmm0
mov rdi, qword [rsp + 0x58]
sub rdi, rbx
psrldq xmm1, 8
movq rax, xmm1
add rdi, rax
sub edx, 1
je 0x140003011
sub edx, 1
je 0x140003007
sub edx, 1
je 0x140003007
sub edx, 1
je 0x140002f80
cmp edx, 1
jne 0x14000311f
call fcn.140005790
mov rsi, rax
test rax, rax
je 0x140003136
jmp 0x140003031
mov edx, 0x104
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, str.ntdll.dll
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x190]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rdx, [rbp - 0x80]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, str.._ntdlol.txt
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x80]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor r8d, r8d
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
mov edx, 1
mov r13, rax
call fcn.140004100
mov r14, rax
mov rcx, rax
jmp 0x140003014
mov ecx, r15d
call fcn.140003150
jmp 0x14000302e
mov rcx, r14
lea rdx, str.NtProtectVirtualMemory
call fcn.140004240
test eax, eax
je 0x140003031
mov edx, eax
mov rcx, r14
call fcn.140003e50
mov rsi, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rbx
mov r9d, 0x40
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x70]
mov qword [rsp + 0x70], rdi
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffffffffffff
call rsi
test eax, eax
js 0x140003114
test rdi, rdi
je 0x140003090
mov rdx, qword [rsp + 0x30]
sub rdx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx + rdx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x140003080
mov r9d, dword [rsp + 0x68]
lea rax, [rsp + 0x68]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffffffffffff
call rsi
test eax, eax
js 0x140003114
cmp r15d, 4
jne 0x1400030d9
lea rax, [r13 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400030cf
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rsi, qword [rsp + 0x4f8]
mov r13, qword [rsp + 0x4b8]
mov rbx, qword [rsp + 0x4f0]
mov r14, qword [rsp + 0x4b0]
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.140008f20
add rsp, 0x4c0
pop r15
pop rdi
pop rbp
ret
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
lea rcx, str.Unhook_method_does_not_exist__exiting..._n
call fcn.140001010
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
lea rcx, str.Something_wrong_happened_with_CreateSyscallStubWithVirtuallAlloc__aborting..._n
call fcn.140001010
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3