Function at 0x180036d50
Capabilities:
Copy file
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x490
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r14, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x270]
call fcn.18004c900
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.18004c900
cmp byte [0x180081330], 0
je 0x180036dd8
lea rcx, [rsp + 0x60]
call fcn.18000d050
test al, al
je 0x180036dd8
lea r8, [rsp + 0x270]
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.18000d3f0
test al, al
jne 0x180036dfb
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.18004c900
mov rdx, r14
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xe0000000
lea r8d, [r15 + 1]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
je 0x1800370ea
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r12d, eax
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
lea r8d, [r15 + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rsi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1800370c8
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea edx, [r15 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1800370c8
mov byte [rsp + 0x20], 1
mov r9, rax
xor r8d, r8d
mov rdx, rbx
call fcn.180007830
test al, al
je 0x1800370b5
movsxd r8, dword [rdi + 0x3c]
add r8, rdi
movzx eax, word [r8 + 0x18]
mov ecx, 0x10b
cmp ax, cx
je 0x180036eeb
mov ecx, 0x20b
cmp ax, cx
jne 0x1800370b5
mov r15d, 1
movzx edx, word [r8 + 0x14]
add rdx, r8
movzx eax, word [r8 + 6]
test r15d, r15d
jne 0x180036fde
mov r9, rdi
cmp eax, 1
jbe 0x180036f92
dec eax
lea ecx, [rax + rax*4]
shl ecx, 3
add rcx, rdx
mov eax, dword [rcx + 0x20]
sub dword [r8 + 0x50], eax
mov edx, dword [rcx + 0x2c]
mov dword [rsp + 0x40], edx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 0x28], xmm0
mov qword [rcx + 0x38], rax
mov eax, 0xffff
add word [r8 + 6], ax
mov r8, rsi
mov rcx, rbx
call fcn.18000dc30
cmp word [rsp + 0x60], r15w
je 0x180036f8b
xor r8d, r8d
mov rdx, r14
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov dl, 1
lea rcx, [rsp + 0x60]
test eax, eax
je 0x180036f7f
call fcn.18000d220
mov al, 1
jmp 0x1800370f8
call fcn.18000d220
xor al, al
jmp 0x1800370f8
mov al, 1
jmp 0x1800370f8
mov r8, rsi
mov edx, r12d
mov rcx, rbx
call fcn.18000dc30
mov dl, 1
lea rcx, [rsp + 0x60]
call fcn.18000d220
xor al, al
jmp 0x1800370f8
mov r9, rdi
cmp eax, 1
jbe 0x18003706f
dec eax
lea ecx, [rax + rax*4]
shl ecx, 3
add rcx, rdx
mov eax, dword [rcx + 0x20]
sub dword [r8 + 0x50], eax
mov edx, dword [rcx + 0x2c]
mov dword [rsp + 0x40], edx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 0x28], xmm0
mov qword [rcx + 0x38], rax
mov eax, 0xffff
add word [r8 + 6], ax
mov r8, rsi
mov rcx, rbx
call fcn.18000dc30
cmp word [rsp + 0x60], 0
je 0x180037068
xor r8d, r8d
mov rdx, r14
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov dl, 1
lea rcx, [rsp + 0x60]
test eax, eax
je 0x18003705c
call fcn.18000d220
mov al, 1
jmp 0x1800370f8
call fcn.18000d220
xor al, al
jmp 0x1800370f8
mov al, 1
jmp 0x1800370f8
mov r8, rsi
mov edx, r12d
mov rcx, rbx
call fcn.18000dc30
mov dl, 1
lea rcx, [rsp + 0x60]
call fcn.18000d220
xor al, al
jmp 0x1800370f8
mov r9, rdi
mov r8, rsi
mov edx, r12d
mov rcx, rbx
call fcn.18000dc30
jmp 0x1800370ea
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1800370ea
test byte [rsp + 0x48], 2
jne 0x1800370ea
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dl, 1
lea rcx, [rsp + 0x60]
call fcn.18000d220
xor al, al
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.180049ad0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret