Function at 0x14020e220
Capabilities:
Copy file
Get disk size
Read file on windows
Terminate thread

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov word [rsp + 8], cx
push rsi
push rdi
sub rsp, 0x178
movabs rax, 0xf84ebe7241cb1f15
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x120]
lea rcx, str.nordic_stenographic
mov rdi, rax
mov rsi, rcx
mov ecx, ILFindChild
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x110]
lea rcx, str.pinups_Intercut
mov rdi, rax
mov rsi, rcx
mov ecx, ILRemoveLastID
rep movsb byte [rdi], byte [rsi]
movabs rax, 0x7981e48ad476c605
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x38], 0x81b3d236
movabs rax, 0x6cd3fd4af8db90d8
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x31], 0x86
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x7c], al
cmp byte [rsp + 0x7c], 0x77
je 0x14020e35c
cmp byte [rsp + 0x7c], 0x86
je 0x14020e2dd
jmp 0x14020e413
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x32], al
movabs rax, 0x8d258ee1ac3f4baf
cmp qword [rsp + 0x60], rax
ja 0x14020e31f
lea rax, [rsp + 0x38]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x30], 0x21
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x50], rax
jmp 0x14020e357
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xc8]
mov r8d, 0x4d
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
mov dword [rsp + 0x80], eax
jmp 0x14020e413
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x84], al
cmp byte [rsp + 0x84], 0x36
je 0x14020e385
cmp byte [rsp + 0x84], 0x58
je 0x14020e407
jmp 0x14020e413
mov eax, dword [rsp + 0x38]
and eax, 0xa8e33db1
mov rcx, qword [rsp + 0x48]
cmp eax, dword [rcx]
jbe 0x14020e3a6
mov eax, 0x210
mov word [rsp + 0x1b0], ax
jmp 0x14020e405
mov dword [rsp + 0x28], PathMakeUniqueName
lea rax, [rsp + 0x110]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x138]
lea r8, str.rescale_mean_effortlessly_Grittiest_freckles
mov edx, 0x3c
mov ecx, ILGetSize
call qword [sym.imp.KERNEL32.dll_GetCurrencyFormatA]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x38]
mov eax, dword [rax]
or eax, ecx
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
movzx edx, byte [rsp + 0x31]
movzx ecx, word [rsp + 0x1b0]
call fcn.14020e020
nop
jmp 0x14020e413
movzx eax, byte [rsp + 0x32]
xor eax, 0x30
mov byte [rsp + 0x31], al
movzx eax, word [rsp + 0x1b0]
mov word [rsp + 0x34], ax
movsx eax, byte [rsp + 0x30]
cmp eax, 5
jge 0x14020e54b
mov eax, dword [rsp + 0x38]
sub eax, 0xf6eb15bb
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
mov eax, 0x2d3c
mov word [rsp + 0x190], ax
movzx eax, word [rsp + 0x34]
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0x5b1
je 0x14020e534
cmp dword [rsp + 0x88], 0xa15
je 0x14020e47a
jmp 0x14020e546
mov eax, dword [rsp + 0x38]
add eax, 0xf395b3ae
mov rcx, qword [rsp + 0x48]
cmp eax, dword [rcx]
je 0x14020e532
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xfc]
mov r8d, 0xfc
mov dl, 0xe3
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
mov dword [rsp + 0xc0], eax
mov eax, dword [rsp + 0x38]
add eax, 0x82ae1de3
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
movzx eax, byte [rsp + 0x32]
sub eax, 0xba
mov byte [rsp + 0x31], al
movzx eax, word [rsp + 0x34]
mov word [rsp + 0x20], ax
mov r9d, dword [rsp + 0x1a8]
mov rax, qword [rsp + 0x48]
mov r8d, dword [rax]
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax]
movzx ecx, word [rsp + 0x1b0]
call fcn.14020d3d0
lea r9, [rsp + 0xe0]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x50]
lea rcx, str.C:oxcartLineage
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov dword [rsp + 0x9c], eax
jmp 0x14020e546
movzx eax, word [rsp + 0x1b0]
xor eax, 0x9d8
mov word [rsp + 0x34], ax
jmp 0x14020ead4
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
shl rax, 0
cmp rax, qword [rsp + 0x60]
ja 0x14020ea84
movzx eax, word [rsp + 0x34]
or eax, 0x2b9
movzx ecx, word [rsp + 0x1b0]
cmp eax, ecx
jge 0x14020e622
movzx eax, word [rsp + 0x34]
mov word [rsp + 0x20], ax
mov r9d, dword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov r8d, dword [rax]
mov rdx, qword [rsp + 0x60]
movzx ecx, word [rsp + 0x1b0]
call fcn.14020d3d0
mov rax, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x1a0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
movzx eax, byte [rsp + 0x32]
mov byte [rsp + 0x8c], al
cmp byte [rsp + 0x8c], 0x6b
je 0x14020e5e2
cmp byte [rsp + 0x8c], 0xeb
je 0x14020e615
jmp 0x14020e622
mov r8d, 1
lea rdx, str.C:BeastliestMadam
lea rcx, str.C:hounding_seagoingMaulingUndoubtedly_scrollable
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [rsp + 0x98], eax
mov eax, dword [rsp + 0x38]
add eax, 0xbd4a4ce9
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
jmp 0x14020e622
mov eax, 0x61df
mov word [rsp + 0x190], ax
lea rax, [rsp + 0x40]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x90], eax
cmp dword [rsp + 0x90], 0
je 0x14020e72a
cmp dword [rsp + 0x90], 0x12f8d498
je 0x14020e664
jmp 0x14020e74c
movzx eax, word [rsp + 0x1b0]
movzx ecx, word [rsp + 0x34]
sub eax, ecx
mov rcx, qword [rsp + 0x68]
movzx ecx, word [rcx]
cmp eax, ecx
jge 0x14020e728
mov rax, qword [rsp + 0x68]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x34]
add eax, ecx
mov rcx, qword [rsp + 0x68]
mov word [rcx], ax
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov dword [rsp + 0xe8], eax
movsx eax, byte [rsp + 0x30]
sub eax, 0x13
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x68]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x34]
and eax, ecx
movzx ecx, word [rsp + 0x1b0]
cmp eax, ecx
jne 0x14020e728
mov rax, qword [rsp + 0xa8]
mov eax, dword [rax]
add eax, dword [rsp + 0x1a8]
mov rcx, qword [rsp + 0xa8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x198], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xec]
mov r8d, 0xf6
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
mov dword [rsp + 0x98], eax
jmp 0x14020e74c
movzx eax, word [rsp + 0x190]
mov word [rsp + 0x58], ax
movzx eax, word [rsp + 0x190]
mov word [rsp + 0x44], ax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa0], rax
movsx eax, word [rsp + 0x44]
mov dword [rsp + 0xbc], eax
cmp dword [rsp + 0xbc], 0x57ba
je 0x14020e782
jmp 0x14020e793
movsx eax, byte [rsp + 0x30]
sar eax, 5
mov byte [rsp + 0x30], al
jmp 0x14020ea15
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x198]
mov rdx, qword [rsp + 0xa0]
or rdx, rcx
mov rcx, rdx
cmp rax, rcx
jl 0x14020e937
movsx eax, byte [rsp + 0x30]
imul eax, eax, 0x26
cmp eax, 0x73
jg 0x14020e879
movsx eax, word [rsp + 0x190]
movsx ecx, word [rsp + 0x58]
sub eax, ecx
movsx ecx, word [rsp + 0x44]
cmp eax, ecx
jge 0x14020e80b
mov rax, qword [rsp + 0x68]
movzx r8d, word [rax]
movzx edx, word [rsp + 0x34]
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax]
call fcn.14020daf0
nop
jmp 0x14020e874
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x198]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x1a0]
mov rdx, qword [rsp + 0xa0]
sub rdx, rcx
mov rcx, rdx
cmp rax, rcx
jle 0x14020e874
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov dword [rsp + 0xc0], eax
movzx eax, word [rsp + 0x58]
mov word [rsp + 0x190], ax
mov eax, dword [rsp + 0x78]
mov ecx, dword [rsp + 0x1a8]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa8]
mov dword [rcx], eax
jmp 0x14020e932
movzx eax, byte [rsp + 0x32]
mov byte [rsp + 0xb0], al
cmp byte [rsp + 0xb0], 0x86
je 0x14020e891
jmp 0x14020e902
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xd0], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0xb4], eax
cmp dword [rsp + 0xb4], 0x7d294871
je 0x14020e8b8
jmp 0x14020e900
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x198], rax
mov r8d, 0x3d
mov edx, 0xc
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov dword [rsp + 0xf0], eax
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x198]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
jmp 0x14020e932
mov edx, 0xe0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
mov dword [rsp + 0xf4], eax
mov eax, dword [rsp + 0x1a8]
mov ecx, dword [rsp + 0x78]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa8]
mov dword [rcx], eax
jmp 0x14020ea15
movsx eax, word [rsp + 0x44]
mov dword [rsp + 0x94], eax
cmp dword [rsp + 0x94], 0x274d
je 0x14020ea05
cmp dword [rsp + 0x94], 0x5cf9
je 0x14020e966
jmp 0x14020ea15
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
add rax, qword [rsp + 0xd0]
cmp rax, qword [rsp + 0x60]
ja 0x14020e9ec
movzx eax, byte [rsp + 0x32]
sub eax, 0x5b
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x60]
movzx ecx, al
mov rax, qword [rsp + 0xd0]
shr rax, cl
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov dword [rsp + 0x28], 0x88
lea rax, [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov r9d, 0x53
lea r8, str.Clarity_repairing_Repels_citadel
mov edx, 0xc2
mov ecx, 0xa9
call qword [sym.imp.KERNEL32.dll_LCMapStringA]
mov dword [rsp + 0xf8], eax
mov rax, qword [rsp + 0x68]
movzx eax, word [rax]
mov word [rsp + 0x3c], ax
jmp 0x14020ea03
mov rax, qword [rsp + 0x68]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3c]
or eax, ecx
mov rcx, qword [rsp + 0x68]
mov word [rcx], ax
jmp 0x14020ea15
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x198], rax
mov eax, dword [rsp + 0x38]
add eax, 0x495fc51f
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
mov rax, qword [rsp + 0x68]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x1b0]
sub eax, ecx
mov word [rsp + 0x34], ax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov word [rsp + 0x3c], ax
movzx eax, word [rsp + 0x3c]
mov word [rsp + 0x20], ax
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
movzx ecx, word [rsp + 0x190]
call fcn.14020e220
movzx eax, word [rsp + 0x1b0]
movzx ecx, word [rsp + 0x3c]
shl eax, cl
mov rcx, qword [rsp + 0x68]
mov word [rcx], ax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x100], rcx
movzx ecx, al
mov rax, qword [rsp + 0x100]
mov rax, qword [rax]
shr rax, cl
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov eax, dword [rsp + 0x1a8]
mov dword [rsp + 0x40], eax
mov edx, 0x43
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [rsp + 0x9c], eax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov qword [rsp + 0x108], rax
movabs rax, 0xa82cf8245204bd56
cmp qword [rsp + 0x108], rax
je 0x14020eafa
jmp 0x14020eb14
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
add eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
lea rdx, [rsp + 0x70]
lea rcx, str.C:RiggerCompleteness
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
mov dword [rsp + 0x9c], eax
movzx eax, word [rsp + 0x34]
mov dword [rsp + 0xb8], eax
cmp dword [rsp + 0xb8], 0xc71
je 0x14020eb5a
jmp 0x14020eb65
mov eax, dword [rsp + 0x1a8]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x1a0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
movabs rax, 0x99bf0026403185ef
mov rcx, qword [rsp + 0x60]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
movzx edx, byte [rsp + 0x32]
movzx ecx, word [rsp + 0x1b0]
call fcn.14020e020
mov eax, 0xc3
add rsp, 0x178
pop rdi
pop rsi
ret