Function at 0x14002b7c0
Capabilities:
Copy file
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x360
mov rdi, rcx
mov esi, r8d
mov r13, rdx
lea rcx, [rsp + 0x68]
mov edx, 0x19c8
and esi, 0x30000
call fcn.140061584
mov r8, qword [rsp + 0x68]
lea r9, [rsp + 0x40]
xor r15d, r15d
mov edx, 0x527
mov rcx, r13
mov qword [rsp + 0x40], r15
call fcn.14006245c
mov r11, qword [rsp + 0x40]
cmp r11, r15
jne 0x14002b836
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r12d, [r15 + 1]
mov ebx, eax
cmp eax, r15d
cmove ebx, r12d
jmp 0x14002bdf2
mov rbp, qword [rsp + 0x68]
sub r11, rbp
mov rdx, rbp
sar r11, 1
lea r14, [rbp + 0xa50]
movsxd rax, r11d
mov rcx, r14
lea r10, [rax + rax]
mov r8, r10
call fcn.14001cecc
lea rax, [r10 + r14]
xor edx, edx
mov word [rax], r15w
mov rcx, qword [rdi + 0x168]
mov qword [rsp + 0x70], rax
lea rbx, [r14 + 0xa50]
lea r12d, [rdx + 1]
cmp rcx, rdx
je 0x14002b93b
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rdi + 0x168]
lea r8d, [r12 + 0x5b]
movsxd rcx, eax
cmp r8w, word [rdx + rcx*2 - 2]
je 0x14002b8b1
lea r8d, [r12 + 0x2e]
cmp r8w, word [rdx + rcx*2 - 2]
jne 0x14002b8b4
sub eax, r12d
cdqe
mov rcx, rbx
lea r10, [rax + rax]
mov r8, r10
call fcn.14001cecc
lea rcx, [r10 + rbx]
lea rdx, [0x140115d98]
mov r8d, 0xc
call fcn.14001cecc
mov rdx, qword [rdi + 0x168]
lea rcx, [rbx + 0xa50]
mov r8, r10
call fcn.14001cecc
lea rcx, [r10 + rbx + 0xa50]
lea rdx, str.SYSTEM32DRIVERS_
mov r8d, 0x26
call fcn.14001cecc
mov rdx, qword [rdi + 0x168]
lea rcx, [rbx + 0x14a0]
mov r8, r10
call fcn.14001cecc
lea rdx, str.SYSTEM32_
add rcx, r10
mov r8d, 0x16
call fcn.14001cecc
jmp 0x14002b9d0
lea rcx, [rsp + 0x78]
lea rdx, str._SystemRoot_INF_
mov r8d, 0x24
call fcn.1400f84f0
lea rcx, [rsp + 0x78]
mov r8d, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rsp + 0xd0]
lea rdx, str._SystemRoot_SYSTEM32DRIVERS_
mov r8d, 0x3e
call fcn.1400f84f0
lea rdx, [rbx + 0xa50]
lea rcx, [rsp + 0xd0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rsp + 0xa0]
lea rdx, str._SystemRoot_SYSTEM32_
mov r8d, 0x2e
call fcn.1400f84f0
lea rdx, [rbx + 0x14a0]
lea rcx, [rsp + 0xa0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbx + 0xa50]
mov dword [rsp + 0x3b0], eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbx + 0x14a0]
mov dword [rsp + 0x58], eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, dword [rsp + 0x3b0]
mov rdx, qword [rsp + 0x40]
lea rcx, [rbx + rcx*2]
mov dword [rsp + 0x3b8], eax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x30]
mov edx, 0x2800
call fcn.140061584
mov rcx, qword [rsp + 0x30]
lea r8, str.ToSys:Copy___s_
mov r9, r13
mov edx, 0x27ff
call fcn.1400f8b38
mov rdx, qword [rsp + 0x30]
xor eax, eax
add rdi, 8
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x11]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], rdi
call fcn.140025950
lea rcx, [rsp + 0x30]
call fcn.140058d88
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CopyFileW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
cmp esi, edx
je 0x14002baee
lea rcx, [rsp + 0x30]
mov edx, 0x2800
call fcn.140061584
mov rcx, qword [rsp + 0x30]
lea r8, str.ToSys:TreatINF___s_
mov r9, rbx
mov edx, 0x27ff
call fcn.1400f8b38
mov rdx, qword [rsp + 0x30]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r9d, [rax + 0x11]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140025950
lea rcx, [rsp + 0x30]
call fcn.140058d88
mov edx, esi
mov rcx, rbx
call fcn.14002083c
lea rcx, [rsp + 0x30]
mov edx, 0x2800
call fcn.140061584
mov rcx, qword [rsp + 0x30]
lea r8, str.ToSys:END___s_
mov r9, r13
mov edx, 0x27ff
call fcn.1400f8b38
mov rdx, qword [rsp + 0x30]
xor r13d, r13d
lea r9d, [r13 + 0x11]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140025950
lea rcx, [rsp + 0x30]
call fcn.140058d88
mov rcx, qword [rsp + 0x40]
lea r8d, [r13 + 8]
lea rdx, [0x140115c78]
call fcn.14001cecc
lea rcx, [rsp + 0x114]
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0x110], r13d
call fcn.1400f78a0
lea r8, [rsp + 0x110]
lea rcx, [rsp + 0x38]
mov rdx, rbp
mov qword [rsp + 0x38], r13
call fcn.1400f6c34
cmp qword [rsp + 0x38], r13
je 0x14002bdea
lea edi, [r13 + 4]
test byte [rsp + 0x110], 0x10
jne 0x14002bdb8
mov ecx, 0x2e
cmp cx, word [rsp + 0x13c]
jne 0x14002bbdf
movzx eax, word [rsp + 0x13e]
cmp ax, r13w
je 0x14002bdb8
cmp cx, ax
jne 0x14002bbdf
cmp word [rsp + 0x140], r13w
je 0x14002bdb8
lea rcx, [rsp + 0x13c]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x13c]
add eax, r12d
movsxd r8, eax
add r8, r8
call fcn.14001cecc
lea rcx, [rsp + 0x13c]
call fcn.1400f7e30
mov ebp, dword [rsp + 0x3b8]
lea rdx, [0x140115c68]
cmp eax, edi
cmovl eax, edi
lea rdi, [rbx + 0x14a0]
cdqe
lea r13, [rsp + rax*2 + 0x134]
mov rcx, r13
call fcn.1400f8054
xor edx, edx
cmp eax, edx
jne 0x14002bc51
mov ebp, dword [rsp + 0x3b0]
mov rdi, rbx
lea rdx, str..SYS
mov rcx, r13
call fcn.1400f8054
xor r13d, r13d
cmp eax, r13d
jne 0x14002bc73
mov ebp, dword [rsp + 0x58]
lea rdi, [rbx + 0xa50]
movsxd rax, ebp
lea rdx, [rsp + 0x13c]
lea rcx, [rdi + rax*2]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebp, 0x2800
lea rcx, [rsp + 0x30]
mov rdx, rbp
call fcn.140061584
mov rcx, qword [rsp + 0x30]
lea r8, str.ToSys:Copy___s_
lea edx, [rbp - 1]
mov r9, r14
call fcn.1400f8b38
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
mov r9d, 0x11
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140025950
lea rcx, [rsp + 0x30]
call fcn.140058d88
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp rbx, rdi
jne 0x14002bd55
cmp esi, r13d
je 0x14002bd55
lea rcx, [rsp + 0x60]
mov rdx, rbp
call fcn.140061584
mov rcx, qword [rsp + 0x60]
lea r8, str.ToSys:TreatINF___s_
lea edx, [rbp - 1]
mov r9, rbx
call fcn.1400f8b38
mov rdi, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
mov r9d, 0x11
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140025950
lea rcx, [rsp + 0x60]
call fcn.140058d88
mov edx, esi
mov rcx, rbx
call fcn.14002083c
jmp 0x14002bd5a
mov rdi, qword [rsp + 0x48]
lea rcx, [rsp + 0x50]
mov rdx, rbp
call fcn.140061584
mov rcx, qword [rsp + 0x50]
lea r8, str.ToSys:End___s_
mov r9, r14
mov edx, 0x27ff
call fcn.1400f8b38
mov rdx, qword [rsp + 0x50]
mov r9d, 0x11
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140025950
lea rcx, [rsp + 0x50]
call fcn.140058d88
mov word [rsp + 0x140], r13w
mov edi, 4
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r13d
jne 0x14002bb9c
mov rcx, qword [rsp + 0x38]
cmp rcx, r13
je 0x14002bdea
cmp rcx, 0xffffffffffffffff
je 0x14002bdea
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x38], r13
mov ebx, r13d
lea rcx, [rsp + 0x68]
call fcn.140058d88
mov eax, ebx
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x360
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret