Function at 0x1400033e0
Capabilities:
Copy file
Delete directory
Delete file
Query environment variable

Disassembly:
push rbp
lea rbp, [rsp - 0x26b0]
mov eax, 0x27b0
call fcn.14001b140
sub rsp, rax
mov rax, qword [0x14002a010]
xor rax, rsp
mov qword [rbp + 0x26a0], rax
movaps xmm0, xmmword [str._ProgramFiles_NewElantechETDCtrl.exe]
lea rdx, [rbp + 0x4a0]
movaps xmm1, xmmword [0x140025530]
lea rcx, [rsp + 0x60]
mov eax, dword [0x140025568]
mov r8d, 0x100
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x140025540]
movaps xmmword [rbp - 0x80], xmm0
movsd xmm0, qword [0x140025560]
movsd qword [rbp - 0x60], xmm0
movaps xmm0, xmmword [str._ProgramFiles_ElantechETDCtrl.exe]
movaps xmmword [rsp + 0x70], xmm1
movaps xmm1, xmmword [0x140025550]
movaps xmmword [rbp + 0x200], xmm0
movaps xmm0, xmmword [0x140025590]
movaps xmmword [rbp - 0x70], xmm1
movaps xmm1, xmmword [0x140025580]
movaps xmmword [rbp + 0x220], xmm0
movsd xmm0, qword [0x1400255b0]
mov dword [rbp - 0x58], eax
movzx eax, word [0x14002556c]
movaps xmmword [rbp + 0x210], xmm1
movaps xmm1, xmmword [0x1400255a0]
movsd qword [rbp + 0x240], xmm0
mov word [rbp - 0x54], ax
movaps xmmword [rbp + 0x230], xmm1
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r8d, 0x100
lea rdx, [rbp + 0x14a0]
lea rcx, [rbp + 0x200]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor r8d, r8d
lea rdx, [rbp + 0x14a0]
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1400034f9
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movaps xmm0, xmmword [str._ProgramFiles_NewElantechETDCtrlHelper.exe]
lea rdx, [rbp + 0x6a0]
movaps xmm1, xmmword [0x1400255d0]
lea rcx, [rbp + 0x1a0]
movzx eax, word [0x140025618]
mov r8d, 0x100
movaps xmmword [rbp + 0x1a0], xmm0
movaps xmm0, xmmword [0x1400255e0]
movaps xmmword [rbp + 0x1c0], xmm0
movaps xmm0, xmmword [0x140025600]
movaps xmmword [rbp + 0x1b0], xmm1
movaps xmm1, xmmword [0x1400255f0]
movaps xmmword [rbp + 0x1e0], xmm0
movaps xmm0, xmmword [str._ProgramFiles_ElantechETDCtrlHelper.exe]
movaps xmmword [rbp + 0x1d0], xmm1
movsd xmm1, qword [0x140025610]
movaps xmmword [rbp + 0x340], xmm0
movaps xmm0, xmmword [0x140025640]
movsd qword [rbp + 0x1f0], xmm1
movaps xmm1, xmmword [0x140025630]
movaps xmmword [rbp + 0x360], xmm0
movaps xmm0, xmmword [0x140025660]
movaps xmmword [rbp + 0x350], xmm1
movaps xmm1, xmmword [0x140025650]
mov word [rbp + 0x1f8], ax
mov eax, dword [0x140025670]
movaps xmmword [rbp + 0x380], xmm0
movaps xmmword [rbp + 0x370], xmm1
mov dword [rbp + 0x390], eax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r8d, 0x100
lea rdx, [rbp + 0x16a0]
lea rcx, [rbp + 0x340]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor r8d, r8d
lea rdx, [rbp + 0x16a0]
lea rcx, [rbp + 0x6a0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000360b
lea rcx, [rbp + 0x6a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movaps xmm0, xmmword [str._ProgramFiles_NewElantechETDCmds.dll]
lea rdx, [rbp + 0x8a0]
movaps xmm1, xmmword [0x140025690]
lea rcx, [rbp - 0x50]
mov eax, dword [0x1400256c8]
mov r8d, 0x100
movaps xmmword [rbp - 0x50], xmm0
movaps xmm0, xmmword [0x1400256a0]
movaps xmmword [rbp - 0x30], xmm0
movsd xmm0, qword [0x1400256c0]
movsd qword [rbp - 0x10], xmm0
movaps xmm0, xmmword [str._ProgramFiles_ElantechETDCmds.dll]
movaps xmmword [rbp - 0x40], xmm1
movaps xmm1, xmmword [0x1400256b0]
movaps xmmword [rbp + 0x250], xmm0
movaps xmm0, xmmword [0x1400256f0]
movaps xmmword [rbp - 0x20], xmm1
movaps xmm1, xmmword [0x1400256e0]
movaps xmmword [rbp + 0x270], xmm0
movsd xmm0, qword [0x140025710]
mov dword [rbp - 8], eax
movzx eax, word [0x1400256cc]
movaps xmmword [rbp + 0x260], xmm1
movaps xmm1, xmmword [0x140025700]
movsd qword [rbp + 0x290], xmm0
mov word [rbp - 4], ax
movaps xmmword [rbp + 0x280], xmm1
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r8d, 0x100
lea rdx, [rbp + 0x18a0]
lea rcx, [rbp + 0x250]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor r8d, r8d
lea rdx, [rbp + 0x18a0]
lea rcx, [rbp + 0x8a0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1400036f9
lea rcx, [rbp + 0x8a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movaps xmm0, xmmword [str._ProgramFiles_NewElantechETDApix.dll]
lea rdx, [rbp + 0xaa0]
movaps xmm1, xmmword [0x140025730]
lea rcx, [rbp]
mov eax, dword [0x140025768]
mov r8d, 0x100
movaps xmmword [rbp], xmm0
movaps xmm0, xmmword [0x140025740]
movaps xmmword [rbp + 0x20], xmm0
movsd xmm0, qword [0x140025760]
movsd qword [rbp + 0x40], xmm0
movaps xmm0, xmmword [str._ProgramFiles_ElantechETDApix.dll]
movaps xmmword [rbp + 0x10], xmm1
movaps xmm1, xmmword [0x140025750]
movaps xmmword [rbp + 0x2a0], xmm0
movaps xmm0, xmmword [0x140025790]
movaps xmmword [rbp + 0x30], xmm1
movaps xmm1, xmmword [0x140025780]
movaps xmmword [rbp + 0x2c0], xmm0
movsd xmm0, qword [0x1400257b0]
mov dword [rbp + 0x48], eax
movzx eax, word [0x14002576c]
movaps xmmword [rbp + 0x2b0], xmm1
movaps xmm1, xmmword [0x1400257a0]
movsd qword [rbp + 0x2e0], xmm0
mov word [rbp + 0x4c], ax
movaps xmmword [rbp + 0x2d0], xmm1
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r8d, 0x100
lea rdx, [rbp + 0x1aa0]
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor r8d, r8d
lea rdx, [rbp + 0x1aa0]
lea rcx, [rbp + 0xaa0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1400037e7
lea rcx, [rbp + 0xaa0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movaps xmm0, xmmword [str._ProgramFiles_NewElantechETDFavorite.dll]
lea rdx, [rbp + 0xca0]
movaps xmm1, xmmword [0x1400257d0]
lea rcx, [rbp + 0x140]
mov eax, dword [0x140025810]
mov r8d, 0x100
movaps xmmword [rbp + 0x140], xmm0
movaps xmm0, xmmword [0x1400257e0]
movaps xmmword [rbp + 0x160], xmm0
movaps xmm0, xmmword [0x140025800]
movaps xmmword [rbp + 0x180], xmm0
movaps xmm0, xmmword [str._ProgramFiles_ElantechETDFavorite.dll]
movaps xmmword [rbp + 0x150], xmm1
movaps xmm1, xmmword [0x1400257f0]
movaps xmmword [rbp + 0x400], xmm0
movaps xmm0, xmmword [0x140025840]
movaps xmmword [rbp + 0x170], xmm1
movaps xmm1, xmmword [0x140025830]
movaps xmmword [rbp + 0x420], xmm0
movaps xmm0, xmmword [0x140025860]
mov dword [rbp + 0x190], eax
movzx eax, word [0x140025814]
movaps xmmword [rbp + 0x410], xmm1
movaps xmm1, xmmword [0x140025850]
movaps xmmword [rbp + 0x440], xmm0
mov word [rbp + 0x194], ax
movaps xmmword [rbp + 0x430], xmm1
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r8d, 0x100
lea rdx, [rbp + 0x1ca0]
lea rcx, [rbp + 0x400]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor r8d, r8d
lea rdx, [rbp + 0x1ca0]
lea rcx, [rbp + 0xca0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1400038e9
lea rcx, [rbp + 0xca0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movaps xmm0, xmmword [str._ProgramFiles_NewElantechETDMcpl.dll]
lea rdx, [rbp + 0xea0]
movaps xmm1, xmmword [0x140025880]
lea rcx, [rbp + 0x50]
mov eax, dword [0x1400258b8]
mov r8d, 0x100
movaps xmmword [rbp + 0x50], xmm0
movaps xmm0, xmmword [0x140025890]
movaps xmmword [rbp + 0x70], xmm0
movsd xmm0, qword [0x1400258b0]
movsd qword [rbp + 0x90], xmm0
movaps xmm0, xmmword [str._ProgramFiles_ElantechETDMcpl.dll]
movaps xmmword [rbp + 0x60], xmm1
movaps xmm1, xmmword [0x1400258a0]
movaps xmmword [rbp + 0x2f0], xmm0
movaps xmm0, xmmword [0x1400258e0]
movaps xmmword [rbp + 0x80], xmm1
movaps xmm1, xmmword [0x1400258d0]
movaps xmmword [rbp + 0x310], xmm0
movsd xmm0, qword [0x140025900]
mov dword [rbp + 0x98], eax
movzx eax, word [0x1400258bc]
movaps xmmword [rbp + 0x300], xmm1
movaps xmm1, xmmword [0x1400258f0]
movsd qword [rbp + 0x330], xmm0
mov word [rbp + 0x9c], ax
movaps xmmword [rbp + 0x320], xmm1
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r8d, 0x100
lea rdx, [rbp + 0x1ea0]
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor r8d, r8d
lea rdx, [rbp + 0x1ea0]
lea rcx, [rbp + 0xea0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1400039e3
lea rcx, [rbp + 0xea0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movaps xmm0, xmmword [str._ProgramFiles_NewElantechETDService.exe]
lea rdx, [rbp + 0x10a0]
movaps xmm1, xmmword [0x140025920]
lea rcx, [rbp + 0x3a0]
mov eax, dword [0x140025960]
mov r8d, 0x100
movaps xmmword [rbp + 0x3a0], xmm0
movaps xmm0, xmmword [0x140025930]
movaps xmmword [rbp + 0x3c0], xmm0
movaps xmm0, xmmword [0x140025950]
movaps xmmword [rbp + 0x3e0], xmm0
movaps xmm0, xmmword [str._ProgramFiles_ElantechETDService.exe]
movaps xmmword [rbp + 0x3b0], xmm1
movaps xmm1, xmmword [0x140025940]
movaps xmmword [rbp + 0xa0], xmm0
movaps xmm0, xmmword [0x140025990]
movaps xmmword [rbp + 0x3d0], xmm1
movaps xmm1, xmmword [0x140025980]
mov dword [rbp + 0x3f0], eax
mov eax, dword [0x1400259b8]
movaps xmmword [rbp + 0xc0], xmm0
movsd xmm0, qword [0x1400259b0]
movaps xmmword [rbp + 0xb0], xmm1
movaps xmm1, xmmword [0x1400259a0]
mov dword [rbp + 0xe8], eax
movzx eax, word [0x1400259bc]
movsd qword [rbp + 0xe0], xmm0
movaps xmmword [rbp + 0xd0], xmm1
mov word [rbp + 0xec], ax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r8d, 0x100
lea rdx, [rbp + 0x20a0]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor r8d, r8d
lea rdx, [rbp + 0x20a0]
lea rcx, [rbp + 0x10a0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [rbp + 0x10a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movaps xmm0, xmmword [str._ProgramFiles_NewElantechETDTouch.exe]
lea rdx, [rbp + 0x12a0]
movaps xmm1, xmmword [0x1400259d0]
lea rcx, [rbp + 0x450]
movzx eax, word [0x140025a58]
mov r8d, 0x100
movaps xmmword [rbp + 0x450], xmm0
movaps xmm0, xmmword [0x1400259e0]
movaps xmmword [rbp + 0x460], xmm1
movaps xmm1, xmmword [0x1400259f0]
movaps xmmword [rbp + 0x470], xmm0
movaps xmm0, xmmword [0x140025a00]
movaps xmmword [rbp + 0x480], xmm1
movaps xmm1, xmmword [str._ProgramFiles_ElantechETDTouch.exe]
movaps xmmword [rbp + 0x490], xmm0
movaps xmm0, xmmword [0x140025a20]
movaps xmmword [rbp + 0xf0], xmm1
movaps xmm1, xmmword [0x140025a30]
movaps xmmword [rbp + 0x100], xmm0
movaps xmm0, xmmword [0x140025a40]
movaps xmmword [rbp + 0x110], xmm1
movsd xmm1, qword [0x140025a50]
movaps xmmword [rbp + 0x120], xmm0
movsd qword [rbp + 0x130], xmm1
mov word [rbp + 0x138], ax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r8d, 0x100
lea rdx, [rbp + 0x22a0]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor r8d, r8d
lea rdx, [rbp + 0x22a0]
lea rcx, [rbp + 0x12a0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140003be7
lea rcx, [rbp + 0x12a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movups xmm0, xmmword [str._ProgramFiles_NewElantech]
mov eax, dword [0x1400252a0]
lea rdx, [rbp + 0x24a0]
movups xmm1, xmmword [0x140025280]
mov dword [rsp + 0x50], eax
mov r8d, 0x100
movzx eax, word [0x1400252a4]
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x54], ax
movups xmm0, xmmword [0x140025290]
movups xmmword [rsp + 0x30], xmm1
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rbp + 0x24a0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x140003c5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.RemoveDirectory_failed_w_err_0x_08lx_n
call fcn.140001320
mov rcx, qword [rbp + 0x26a0]
xor rcx, rsp
call fcn.140006060
add rsp, 0x27b0
pop rbp
ret