Function at 0x140001dc0
Capabilities:
Copy file
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x1f80
call fcn.140006c80
sub rsp, rax
mov rax, qword [0x14000e008]
xor rax, rsp
mov qword [rsp + 0x1f70], rax
lea rdx, [0x14000c6dc]
lea rcx, str.c:prtatibminstall.log
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x14000e638], rax
test rax, rax
je 0x140002164
lea r8, str.starting_to_create_the_xml_file_for_this_geo_its_below
mov rcx, rax
lea rdx, [0x14000c71c]
call fcn.140001010
mov rcx, qword [0x14000e638]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rdx, [0x140007c68]
lea rcx, str.lrs_awps_config.xml
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
lea rdx, [0x140007c84]
mov rdi, rax
lea rcx, str.lrs_awps_config.bak
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rdi, rdi
je 0x1400020e4
test rax, rax
je 0x1400020e4
lea rsi, str.__DefaultServer_
lea rbp, str.__IppServer_
lea r14, str.__LrsqServer_
nop dword [rax]
nop word [rax + rax]
xor edx, edx
lea rcx, [rsp + 0xfd0]
mov r8d, 0xfa0
call sub.VCRUNTIME140.dll_memset
mov r8, rdi
lea rcx, [rsp + 0xfd0]
mov edx, 0xff
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
lea rdx, str._DefaultServer_
lea rcx, [rsp + 0xfd0]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x140001f57
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0xfa0
call sub.VCRUNTIME140.dll_memset
lea r8, str._DefaultServer_
mov qword [rsp + 0x20], rsi
lea r9, [0x14000e9d0]
lea rdx, str._s_s_s_n
lea rcx, [rsp + 0x30]
call fcn.140005e80
mov rdx, rbx
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputs]
lea rdx, [0x14000c6dc]
lea rcx, str.c:prtatibminstall.log
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x14000e638], rax
test rax, rax
je 0x140002164
lea r8, [rsp + 0x30]
jmp 0x14000200e
lea rdx, str._IppServer_
lea rcx, [rsp + 0xfd0]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x140001f94
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0xfa0
call sub.VCRUNTIME140.dll_memset
lea r8, str._IppServer_
mov qword [rsp + 0x20], rbp
jmp 0x140001f03
lea rdx, str._LrsqServer_
lea rcx, [rsp + 0xfd0]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x140001fd1
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0xfa0
call sub.VCRUNTIME140.dll_memset
lea r8, str._LrsqServer_
mov qword [rsp + 0x20], r14
jmp 0x140001f03
mov rdx, rbx
lea rcx, [rsp + 0xfd0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputs]
lea rdx, [0x14000c6dc]
lea rcx, str.c:prtatibminstall.log
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x14000e638], rax
test rax, rax
je 0x140002164
lea r8, [rsp + 0xfd0]
lea rdx, [0x14000c71c]
mov rcx, rax
call fcn.140001010
mov rcx, qword [0x14000e638]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
test eax, eax
je 0x140001ea0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor r8d, r8d
lea rdx, str.lrs_awps_config.xml
lea rcx, str.lrs_awps_config.bak
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rdx, [0x14000c6dc]
lea rcx, str.c:prtatibminstall.log
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x14000e638], rax
test rax, rax
je 0x140002164
lea r8, str.xml_file_above_created_for_this_geo_NOTE_IT_DOESNT_HAVE_SPACES_BETWEEN_EVERY_PARAM_JUST_SHOWING_YOU_IT_IN_THE_LOG_SO_YOU_KNOW_ITS_POINTING_TO_THE_CORRECT_SERVER
mov rcx, rax
lea rdx, [0x14000c71c]
call fcn.140001010
mov rcx, qword [0x14000e638]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rcx, qword [rsp + 0x1f70]
xor rcx, rsp
call fcn.140005f50
lea r11, [rsp + 0x1f80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
lea r8, str.failed_to_open_xml_file_will_exit_here
lea rdx, [0x140007a8c]
lea rcx, [0x14000ead0]
call fcn.140005e20
lea rdx, [0x14000c6dc]
lea rcx, str.c:prtatibminstall.log
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x14000e638], rax
test rax, rax
je 0x140002164
lea r8, [0x14000ead0]
mov rcx, rax
lea rdx, [0x14000c71c]
call fcn.140001010
mov rcx, qword [0x14000e638]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor r9d, r9d
lea r8, str.print_ibm_message
lea rdx, [0x14000ead0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x1400020b6
lea r8, str.failed_to_open_log_file_fatal_err
lea rdx, [0x140007a8c]
lea rcx, [0x14000ead0]
call fcn.140005e20
xor r9d, r9d
lea r8, str.Print_ibm_install
lea rdx, [0x14000ead0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3