Function at 0x180004e00
Capabilities:
Copy file
Create pipe

Disassembly:
push rbx
sub rsp, 0x50
mov dword [rsp + 0x48], 0x179
lea rax, [fcn.1800050c0]
add rax, 0x179
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180010a40
mov rax, qword [0x180100cd0]
xor ebx, ebx
mov r8d, dword [0x180100cd8]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx + 0x23a0]
mov dword [rax + 4], 0xa009bff5
cmp r8d, 0xbc65c8db
jne 0x180004f54
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateBitmapIndirect]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDynamicTimeZoneInformation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFlags]
xor r8d, r8d
lea rdx, [0x1801186c8]
lea rcx, [0x1801186f8]
call qword [sym.imp.KERNEL32.dll_CopyFile2]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov dword [rsp + 0x30], ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateFontIndirectExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPreferredUILanguages]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_IntersectClipRect]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreatePolygonRgn]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov r8d, dword [0x180100cd8]
mov rax, qword [0x180100ce0]
mov rcx, qword [rax + 0x10]
mov rax, qword [0x180100cd0]
mov edx, dword [rcx + 0x2310]
mov rcx, qword [rax + 0x10]
sub edx, 0x5ed25c7d
mov rax, qword [rcx + 0x23a0]
mov dword [rax], edx
cmp r8d, 0x17e1853d
jne 0x180005069
mov qword [rsp + 0x30], rbx
lea rax, [0x180118730]
mov dword [rsp + 0x28], ebx
lea r8, [0x180118758]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNLSString]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFiber]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_OffsetClipRgn]
mov r9d, dword [rsp + 0x60]
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlPcToFileHeader]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_EndPath]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreatePalette]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_PlayMetaFile]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov rax, qword [0x180100cd0]
mov rcx, qword [rax + 0x10]
mov rax, qword [0x180100ce0]
mov rdx, qword [rcx + 0x23a0]
mov rcx, qword [rax + 0x10]
mov eax, dword [rcx + 0x2310]
add dword [rdx + 4], eax
mov rax, qword [0x180100cc8]
mov r8, qword [rax + 0x10]
mov rax, qword [0x180100cd0]
mov rcx, qword [rax + 0x10]
mov eax, dword [r8 + 0x4438]
mov rdx, qword [rcx + 0x23a0]
mov dword [rdx + 8], eax
add rsp, 0x50
pop rbx
ret