Function at 0x180003b30
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1802e8850]
xor rax, rsp
mov qword [rbp + 0x78], rax
mov rsi, r8
mov r14, rdx
mov r15, rcx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
call fcn.180098f78
mov rcx, rax
xor r12d, r12d
test rax, rax
je 0x1800042c9
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x70], rax
mov rdx, rsi
lea edi, [r12 + 0x10]
cmp qword [rsi + 0x18], rdi
jb 0x180003ba2
mov rdx, qword [rsi]
lea rcx, [rsp + 0x48]
call fcn.1800071b4
mov r8, rax
lea rdx, [rsp + 0x40]
call fcn.1800798dc
nop
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.180007bd4
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180003be6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x40], r12
mov r13d, 0xf
mov qword [rbp + 0x48], r13
mov byte [rbp + 0x30], r12b
mov rbx, qword [rbp + 0x70]
mov rdx, rbx
lea rcx, [rbp + 0x30]
call fcn.18000818c
nop
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], r13
mov byte [rbp + 0x50], r12b
mov rdx, rbx
lea rcx, [rbp + 0x50]
call fcn.18000818c
nop
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x28]
call fcn.180076d4c
nop
mov r8, rax
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1800092b4
lea rcx, [rbp + 0x30]
cmp rcx, rax
je 0x180003c61
mov r8b, r12b
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.180008320
mov r13d, 0x1000
mov rdx, qword [rsp + 0x68]
cmp rdx, rdi
jb 0x180003c9f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r13
jb 0x180003c9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800042d4
call fcn.180099310
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], r12b
mov rdx, qword [rbp - 0x38]
cmp rdx, rdi
jb 0x180003ce8
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, r13
jb 0x180003ce3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800042da
call fcn.180099310
lea rdx, [rbp - 0x30]
call fcn.1800762a0
nop
mov r8, rax
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.1800092b4
lea rcx, [rbp + 0x50]
cmp rcx, rax
je 0x180003d1b
mov r8b, r12b
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.180008320
mov rdx, qword [rbp - 0x78]
cmp rdx, rdi
jb 0x180003d52
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r13
jb 0x180003d4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800042e0
call fcn.180099310
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], r12b
mov rdx, qword [rbp - 0x18]
cmp rdx, rdi
jb 0x180003d99
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, r13
jb 0x180003d94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800042e6
call fcn.180099310
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], rdi
cmovae rcx, qword [rbp + 0x30]
call fcn.180016148
mov rcx, qword [r14 + 0x10]
movabs rax, 0x7fffffffffffffff
mov rdx, qword [rbp + 0x40]
sub rax, rdx
cmp rax, rcx
jb 0x1800042ec
lea r9, [rbp + 0x30]
cmp qword [rbp + 0x48], rdi
cmovae r9, qword [rbp + 0x30]
mov rax, r14
cmp qword [r14 + 0x18], rdi
jb 0x180003de2
mov rax, qword [r14]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp - 0x70]
call fcn.180009b84
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], rdi
cmovae rdx, qword [rbp - 0x70]
mov rcx, rsi
cmp qword [rsi + 0x18], rdi
jb 0x180003e13
mov rcx, qword [rsi]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdx, qword [rbp - 0x58]
cmp rdx, rdi
jb 0x180003e52
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, r13
jb 0x180003e4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800042f2
call fcn.180099310
mov rdx, r15
call fcn.180080fa8
mov rcx, rax
call fcn.180097250
mov r13, rax
test rax, rax
jne 0x18000400d
mov rdx, qword [rbp + 0x68]
mov r13d, 0x1000
cmp rdx, rdi
jb 0x180003eaa
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, r13
jb 0x180003ea5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800042fe
call fcn.180099310
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], 0xf
mov byte [rbp + 0x50], r12b
mov rdx, qword [rbp + 0x48]
cmp rdx, rdi
jb 0x180003ef0
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, r13
jb 0x180003eeb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004304
call fcn.180099310
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], r12b
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180003f1b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r15 + 0x18]
cmp rdx, rdi
jb 0x180003f50
mov rcx, qword [r15]
inc rdx
cmp rdx, r13
jb 0x180003f4b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000430a
mov rcx, r8
call fcn.180099310
mov qword [r15 + 0x10], r12
mov ebx, 0xf
mov qword [r15 + 0x18], rbx
mov byte [r15], r12b
mov rdx, qword [r14 + 0x18]
cmp rdx, rdi
jb 0x180003f95
mov rcx, qword [r14]
inc rdx
cmp rdx, r13
jb 0x180003f90
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800042bd
mov rcx, r8
call fcn.180099310
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], rbx
mov byte [r14], r12b
mov rdx, qword [rsi + 0x18]
cmp rdx, rdi
jb 0x180003fd5
inc rdx
mov rcx, qword [rsi]
cmp rdx, r13
jb 0x180003fd0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800042c3
mov rcx, r8
call fcn.180099310
mov r13d, 0xf
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r13
mov byte [rsi], r12b
mov rcx, qword [rbp + 0x78]
xor rcx, rsp
call fcn.180218930
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rbp - 0x10]
call fcn.180075928
nop
mov rdx, rax
call fcn.180080fa8
mov rdi, rax
lea rdx, [rbp + 0x50]
call fcn.180080fa8
mov rdx, rax
mov r8, rdi
mov rcx, r13
call fcn.180004310
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x180004075
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004070
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800042f8
call fcn.180099310
cmp dword [r13], 2
je 0x18000408b
mov dword [0x1802f65f4], 0x80000
jmp 0x18000414e
mov rdi, qword [r13 + 8]
cmp byte [rdi + 0x40], 0
jne 0x1800040a0
mov rcx, rdi
call fcn.180097168
mov r12d, eax
mov byte [rdi + 0x40], 1
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x1800040ba
cmp qword [rdi + 0x18], 0
je 0x1800040ba
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
and qword [rdi + 0x30], 0
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1800040ce
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rdi + 0x18], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1800040e8
cmp byte [rdi + 0x10], 0
je 0x1800040e8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rdi + 8], 0
mov byte [rdi + 0x10], 0
mov dword [0x1802f65f4], r12d
mov rcx, qword [rdi + 0x68]
xor r12d, r12d
test rcx, rcx
je 0x18000410e
mov edx, 0x6aff8
call fcn.180099310
mov qword [rdi + 0x68], r12
mov rcx, qword [rdi + 0x50]
test rcx, rcx
je 0x180004120
call fcn.180098b00
mov qword [rdi + 0x50], r12
mov rcx, qword [rdi]
test rcx, rcx
je 0x180004131
call fcn.180098b00
mov qword [rdi], r12
mov edx, 0x40c0
mov rcx, rdi
call fcn.180099310
mov edx, 0x10
mov rcx, r13
call fcn.180099310
lea rcx, [rbp + 0x50]
call fcn.180016520
nop
mov rdx, qword [rbp + 0x68]
mov edi, 0x1000
cmp rdx, 0x10
jb 0x180004194
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, rdi
jb 0x18000418f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800042fe
call fcn.180099310
mov qword [rbp + 0x60], r12
mov r13d, 0xf
mov qword [rbp + 0x68], r13
mov byte [rbp + 0x50], r12b
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x1800041dd
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, rdi
jb 0x1800041d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004304
call fcn.180099310
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r13
mov byte [rbp + 0x30], r12b
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180004204
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x18000423a
mov rcx, qword [r15]
inc rdx
cmp rdx, rdi
jb 0x180004235
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000430a
mov rcx, r8
call fcn.180099310
mov qword [r15 + 0x10], r12
mov qword [r15 + 0x18], r13
mov byte [r15], r12b
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x180004277
mov rcx, qword [r14]
inc rdx
cmp rdx, rdi
jb 0x180004272
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800042bd
mov rcx, r8
call fcn.180099310
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], r13
mov byte [r14], r12b
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x180003fdb
inc rdx
mov rcx, qword [rsi]
cmp rdx, rdi
jb 0x1800042b3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800042c3
mov rcx, r8
call fcn.180099310
jmp 0x180003fdb
call fcn.1802209a8
nop
call fcn.1802209a8
nop
mov ecx, 0x80004005
call fcn.1800039f8
nop
call fcn.1802209a8
nop
call fcn.1802209a8
nop
call fcn.1802209a8
nop
call fcn.1802209a8
int3
call fcn.180002ff4
int3
call fcn.1802209a8
int3
call fcn.1802209a8
nop
call fcn.1802209a8
nop
call fcn.1802209a8
nop
call fcn.1802209a8
int3