Function at 0x140001e16
Capabilities:
Check if file exists
Copy file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x808
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x780], 0xfffffffffffffffe
mov rsi, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov cl, 1
mov rdx, r8
mov r8, r9
call fcn.14002df10
mov r13, rax
test rax, rax
jne 0x140002528
test r14, r14
je 0x140001fb7
js 0x14000253f
mov al, byte [0x14005e250]
xor ecx, ecx
mov rdx, r14
call fcn.14002fd70
test rax, rax
je 0x140002544
mov qword [rbp + 0x770], rax
mov rcx, rax
mov rdx, rbx
mov r8, r14
call fcn.1400455e0
mov al, byte [0x14005e250]
xor ecx, ecx
mov rdx, r14
call fcn.14002fd70
test rax, rax
je 0x14000254f
mov r15, rax
mov rcx, rax
mov rdx, rbx
mov r8, r14
call fcn.1400455e0
lea rcx, [rbp + 0x470]
mov qword [rcx], r14
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r14
mov byte [rcx + 0x18], 0
lea rdx, [0x140052720]
push 1
pop r8
mov qword [rbp + 0x740], r8
call fcn.14002d230
mov rax, qword [rbp + 0x470]
mov qword [rbp + 0x768], rax
mov rdx, qword [rbp + 0x478]
mov r8, qword [rbp + 0x480]
mov byte [rbp + 0x77e], 1
lea rcx, [rbp + 0x218]
mov qword [rbp + 0x738], rdx
call fcn.14002b340
mov rax, qword [rbp + 0x218]
mov r13, qword [rbp + 0x220]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x140001f87
mov rcx, qword [rbp + 0x228]
lea rdx, [rbp + 0x470]
mov qword [rdx], rax
mov qword [rdx + 8], r13
mov qword [rdx + 0x10], rcx
mov byte [rbp + 0x77e], 1
lea rcx, [rbp + 0x748]
call fcn.14002c950
mov r12, qword [rbp + 0x748]
mov r13, qword [rbp + 0x750]
cmp r12, rbx
jne 0x140001fc6
mov rsi, qword [rbp + 0x770]
cmp qword [rbp + 0x768], 0
je 0x140001fa7
push 1
pop rdx
mov rcx, qword [rbp + 0x738]
call fcn.14000aea0
push 1
pop rdx
mov rcx, rsi
call fcn.14000aea0
jmp 0x140002528
movabs r13, 0x300000002
jmp 0x140002528
lea rbx, [rbp + 0x470]
mov r8d, 0x250
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, r13
mov rdx, rbx
call qword [sym.imp.kernel32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x140002060
mov qword [rbp + 0x730], rax
mov al, byte [0x14005e250]
push 0x30
pop rdx
xor ecx, ecx
call fcn.14002fd70
test rax, rax
je 0x14000257d
mov r15, rax
push 1
pop rax
mov qword [r15], rax
mov qword [r15 + 8], rax
mov qword [r15 + 0x10], r14
mov rax, qword [rbp + 0x770]
mov qword [r15 + 0x18], rax
mov qword [r15 + 0x20], r14
mov byte [r15 + 0x28], 0
lea rcx, [rbp - 0x48]
lea rdx, [rbp + 0x470]
mov r8d, 0x250
call fcn.1400455e0
test r12, r12
je 0x14000205a
push 2
pop rdx
mov rcx, r13
call fcn.14000aea0
push 1
pop r14
jmp 0x1400020ca
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x140002441
mov al, byte [0x14005e250]
push 0x30
pop rdx
xor ecx, ecx
call fcn.14002fd70
test rax, rax
je 0x140002598
mov r15, rax
push 1
pop rax
mov qword [r15], rax
mov qword [r15 + 8], rax
mov qword [r15 + 0x10], r14
mov rax, qword [rbp + 0x770]
mov qword [r15 + 0x18], rax
mov qword [r15 + 0x20], r14
mov byte [r15 + 0x28], 0
test r12, r12
je 0x1400020bd
push 2
pop rdx
mov rcx, r13
call fcn.14000aea0
xor r14d, r14d
push 0xffffffffffffffff
pop rax
mov qword [rbp + 0x730], rax
cmp qword [rbp + 0x768], 0
je 0x1400020e3
push 1
pop rdx
mov rcx, qword [rbp + 0x738]
call fcn.14000aea0
lea rbx, [rbp + 0x484]
lea rdx, [rbp - 0x48]
mov r8d, 0x254
mov rcx, rbx
call fcn.1400455e0
mov qword [rbx - 0x14], r15
mov rax, qword [rbp + 0x730]
mov qword [rbx - 0xc], rax
mov dword [rbx - 4], r14d
lea rcx, [rbp - 0x48]
lea rdx, [rbp + 0x470]
call fcn.14002cf00
cmp qword [rbp - 0x48], 0
je 0x14000248e
mov rbx, qword [rbp - 0x40]
mov r13, qword [rbp - 0x38]
test rbx, rbx
je 0x14000251c
mov r8d, 0x248
lea rcx, [rbp + 0x228]
lea rdx, [rbp - 0x30]
call fcn.1400455e0
mov qword [rbp + 0x218], rbx
mov qword [rbp + 0x220], r13
mov r15, qword [rbx + 0x18]
mov r14, qword [rbx + 0x20]
lea rcx, [rbp + 0x6f0]
lea rdx, [rbp + 0x218]
call case.0x140028fc2.119
mov r13, qword [rbp + 0x6f8]
mov rbx, qword [rbp + 0x700]
push 1
pop r12
test r14, r14
mov qword [rbp + 0x770], r13
je 0x1400021ba
js 0x140002563
mov al, byte [0x14005e250]
xor ecx, ecx
mov rdx, r14
call fcn.14002fd70
test rax, rax
je 0x14000256c
mov r12, rax
mov rcx, r12
mov rdx, r15
mov r8, r14
call fcn.1400455e0
mov qword [rbp + 0x748], r14
mov qword [rbp + 0x750], r12
mov qword [rbp + 0x758], r14
mov byte [rbp + 0x760], 0
lea rcx, [rbp + 0x748]
mov rdx, r13
mov r8, rbx
call fcn.14002d230
mov r15, qword [rbp + 0x748]
mov r14, qword [rbp + 0x750]
mov r13, qword [rbp + 0x758]
cmp qword [rbp + 0x6f0], 0
je 0x140002224
mov rcx, qword [rbp + 0x770]
push 1
pop rdx
call fcn.14000aea0
lea rcx, [rbp + 0x748]
lea rdx, [rbp + 0x218]
call case.0x140028fc2.119
mov rbx, qword [rbp + 0x750]
mov rax, qword [rbp + 0x758]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x6f0]
mov rdx, rdi
mov r8, rsi
mov r9, rbx
call fcn.14002f770
mov rcx, qword [rbp + 0x748]
mov rdx, rbx
call fcn.140001693
mov rcx, r14
mov rdx, r13
call fcn.14002eb40
mov r12, qword [rbp + 0x6f8]
mov rbx, qword [rbp + 0x700]
test al, al
je 0x1400022aa
mov rcx, r14
mov rdx, r13
mov r8, r12
mov r9, rbx
call fcn.140001e16
test rax, rax
je 0x140002416
jmp 0x1400024a2
lea rcx, [rbp + 0x710]
mov rdx, r14
mov r8, r13
call fcn.14002b340
mov rax, qword [rbp + 0x710]
mov rdx, qword [rbp + 0x718]
movabs r13, 0x8000000000000000
cmp rax, r13
je 0x1400024a7
mov rcx, qword [rbp + 0x720]
mov qword [rbp + 0x748], rax
mov qword [rbp + 0x750], rdx
mov qword [rbp + 0x758], rcx
lea rcx, [rbp + 0x6d8]
lea rdx, [rbp + 0x748]
call fcn.14002c950
mov rcx, qword [rbp + 0x6d8]
mov rax, qword [rbp + 0x6e0]
mov qword [rbp + 0x770], rax
mov qword [rbp + 0x768], rcx
cmp rcx, r13
je 0x1400024ae
lea rcx, [rbp + 0x710]
mov rdx, r12
mov r8, rbx
call fcn.14002b340
mov rax, qword [rbp + 0x710]
mov r13, qword [rbp + 0x718]
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x1400024db
mov rcx, qword [rbp + 0x720]
mov qword [rbp + 0x748], rax
mov qword [rbp + 0x750], r13
mov qword [rbp + 0x758], rcx
lea rcx, [rbp + 0x6d8]
lea rdx, [rbp + 0x748]
call fcn.14002c950
mov rbx, qword [rbp + 0x6d8]
mov r13, qword [rbp + 0x6e0]
movabs rax, 0x8000000000000000
cmp rbx, rax
je 0x1400024db
and qword [rbp + 0x748], 0
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x770]
mov rdx, r13
lea r8, [0x1400335e0]
lea r9, [rbp + 0x748]
call qword [sym.imp.kernel32.dll_CopyFileExW]
test eax, eax
je 0x1400024b7
test rbx, rbx
je 0x1400023fd
mov rcx, r13
push 2
pop rdx
call fcn.14000aea0
cmp qword [rbp + 0x768], 0
je 0x140002416
mov rcx, qword [rbp + 0x770]
push 2
pop rdx
call fcn.14000aea0
mov rcx, qword [rbp + 0x6f0]
mov rdx, r12
call fcn.140001693
mov rcx, r15
mov rdx, r14
call fcn.140001693
lea rcx, [rbp + 0x218]
call fcn.1400016c9
jmp 0x14000210f
mov ebx, eax
test r12, r12
je 0x140002453
push 2
pop rdx
mov rcx, r13
call fcn.14000aea0
shl rbx, 0x20
cmp qword [rbp + 0x768], 0
mov rsi, qword [rbp + 0x770]
je 0x140002477
push 1
pop rdx
mov rcx, qword [rbp + 0x738]
call fcn.14000aea0
or rbx, 2
push 1
pop rdx
mov rcx, rsi
call fcn.14000aea0
mov r13, rbx
jmp 0x140002528
lea rcx, [rbp + 0x470]
call fcn.1400015ee
xor r13d, r13d
jmp 0x140002528
mov r13, rax
jmp 0x1400024f6
mov qword [rbp + 0x770], rdx
mov r13, qword [rbp + 0x770]
jmp 0x1400024f6
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, rax
test rbx, rbx
je 0x1400024d8
push 2
pop rdx
mov rcx, r13
call fcn.14000aea0
mov r13, rsi
mov rcx, qword [rbp + 0x770]
mov rax, qword [rbp + 0x768]
test rax, rax
je 0x1400024f6
push 2
pop rdx
call fcn.14000aea0
mov rcx, qword [rbp + 0x6f0]
mov rdx, r12
call fcn.140001693
mov rcx, r15
mov rdx, r14
call fcn.140001693
lea rcx, [rbp + 0x218]
call fcn.1400016c9
lea rcx, [rbp + 0x470]
call fcn.1400015ee
mov rax, r13
add rsp, 0x808
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.14000af80
push 1
pop rcx
mov rdx, r14
call fcn.140045700
mov byte [rbp + 0x77f], 1
push 1
pop rcx
mov rdx, r14
call fcn.140045700
jmp 0x1400025b1
xor eax, eax
mov qword [rbp + 0x740], rax
mov rcx, qword [rbp + 0x740]
mov rdx, r14
call fcn.140045700
jmp 0x1400025b1
mov qword [rbp + 0x740], r12
mov qword [rbp + 0x728], r13
push 8
pop rcx
push 0x30
pop rdx
call fcn.140045720
jmp 0x1400025b1
mov qword [rbp + 0x740], r12
mov qword [rbp + 0x728], r13
push 8
pop rcx
push 0x30
pop rdx
call fcn.140045720
ud2