Function at 0x180004df0
Capabilities:
Copy file
Delete file
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xa80], rax
mov rbx, rdx
mov rsi, rcx
mov rcx, qword [0x180023d18]
lea rdx, [rsp + 0x660]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [0x18001e700]
call fcn.180006530
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rbx, rbx
je 0x180004e85
mov r8d, dword [rbx - 8]
lea rcx, [rbx - 8]
add r8, 8
xor edx, edx
call fcn.180008180
lea rcx, [rbx - 8]
call fcn.180005370
lea rcx, [0x18001e720]
call fcn.1800063c0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rbx, rbx
je 0x180004ec4
mov r8d, dword [rbx - 8]
lea rcx, [rbx - 8]
add r8, 8
xor edx, edx
call fcn.180008180
lea rcx, [rbx - 8]
call fcn.180005370
lea rdx, [rsp + 0x30]
xor ecx, ecx
call rdi
test eax, eax
je 0x180004edc
cmp eax, 0xb7
jne 0x1800050d1
lea rcx, [0x18001e740]
call fcn.180006530
lea rcx, [0x18001e760]
mov rdi, rax
call fcn.180006530
lea rdx, [rsp + 0x30]
mov rbx, rax
sub rdx, 2
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x180004f03
mov ecx, dword [0x18001e780]
mov dword [rdx], ecx
xor ecx, ecx
nop dword [rax + rax]
movzx eax, word [rsp + rcx + 0x30]
mov word [rsp + rcx + 0x240], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180004f20
lea rcx, [rsp + 0x240]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180004f42
xor edx, edx
nop
movzx eax, word [rdi + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x180004f50
xor ecx, ecx
movzx eax, word [rsp + rcx + 0x30]
mov word [rsp + rcx + 0x450], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180004f63
lea rcx, [rsp + 0x450]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180004f85
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbx + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x180004fa0
cmp dword [0x180023ccc], 0
lea rcx, [rsp + 0x30]
mov r8, rdi
cmovne r8, rbx
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180004fd0
xor edx, edx
nop dword [rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x180004fe0
test rbx, rbx
je 0x180005013
mov r8d, dword [rbx - 8]
lea rcx, [rbx - 8]
add r8, 8
xor edx, edx
call fcn.180008180
lea rcx, [rbx - 8]
call fcn.180005370
test rdi, rdi
je 0x180005034
mov r8d, dword [rdi - 8]
lea rcx, [rdi - 8]
add r8, 8
xor edx, edx
call fcn.180008180
lea rcx, [rdi - 8]
call fcn.180005370
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x450]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x660]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1800050d1
cmp dword [0x180023ccc], 0
lea r8, [0x18001e784]
je 0x1800050c2
mov qword [rsp + 0x28], r8
lea rax, [0x18001e790]
lea r8, str.__s___s__s
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov edx, 0x104
lea rcx, [rsp + 0x870]
call fcn.180001370
lea r8, [rsp + 0x870]
mov rcx, rsi
lea rdx, str.rundll32.exe
call fcn.180006990
jmp 0x1800050d3
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.180006990
jmp 0x1800050d3
xor eax, eax
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.180006d30
lea r11, [rsp + 0xa90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret