Function at 0x18003dd50
Capabilities:
Copy file
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov r15d, r8d
mov r14d, edx
mov rsi, rcx
mov r12, 0xffffffffffffffff
test r9d, r9d
je 0x18003ddef
mov rbx, r12
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x18003dd86
add rbx, 5
mov eax, 2
mul rbx
cmovo rax, r12
mov rcx, rax
call fcn.18004a4dc
mov r8, rsi
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.180051ef4
lea r8, str..bak
mov rdx, rbx
mov rcx, rdi
call fcn.180052200
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, rdi
mov ebx, eax
call fcn.180049e70
test ebx, ebx
jne 0x18003ddef
xor al, al
jmp 0x18003e09b
xor ebx, ebx
mov qword [rbp + 0x1f], r12
mov qword [rbp - 9], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x19], xmm0
mov edi, 0x5a4d
mov qword [rbp + 0xf], rbx
mov qword [rbp + 0x17], rbx
mov qword [rbp - 0x41], rbx
mov qword [rbp - 0x39], rbx
mov dword [rbp - 0x31], ebx
movdqa xmmword [rbp - 0x29], xmm0
mov qword [rbp - 1], rbx
mov dword [rbp + 7], ebx
mov dword [rbp + 0x27], ebx
mov qword [rbp - 0x51], rbx
mov qword [rbp - 0x49], rbx
mov qword [rbp - 0x59], rsi
test rsi, rsi
je 0x18003de6a
lea rcx, [rbp - 0x59]
call fcn.18003fe70
mov rax, qword [rbp - 0x41]
test rax, rax
je 0x18003de6a
cmp word [rax], di
jne 0x18003de6a
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x18003de6a
cmp dword [rax], 0x4550
jne 0x18003de6a
lea rcx, [rbp - 0x59]
call fcn.1800403b0
lea rcx, [rbp - 0x59]
call fcn.1800402b0
test al, al
je 0x18003dfda
mov rax, qword [rbp - 0x41]
test rax, rax
je 0x18003dea5
cmp word [rax], di
jne 0x18003dea5
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x18003dea5
cmp dword [rax], 0x4550
jne 0x18003dea5
mov ecx, 0x10b
cmp word [rax + 0x18], cx
je 0x18003dea9
mov rax, qword [rbp - 0x21]
mov dword [rax + 0x3c], 0x200
test r14d, r14d
je 0x18003decc
mov rax, qword [rbp - 0x41]
test rax, rax
je 0x18003decc
mov dword [rbp - 0x31], ebx
mov qword [rbp - 0x39], rbx
mov dword [rax + 0x3c], 0x40
lea rcx, [rbp - 0x59]
call fcn.180041490
lea rcx, [rbp - 0x59]
call fcn.180041120
mov rdx, rsi
lea rcx, [rbp - 0x59]
call fcn.180040900
test al, al
je 0x18003dfda
test r15d, r15d
je 0x18003dfd5
mov rcx, rsi
call fcn.180044a40
mov dword [rbp - 0x69], ebx
mov r15, rax
mov dword [rbp + 0x7f], ebx
test eax, eax
je 0x18003dfd5
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0xc0000000
mov rcx, rsi
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, r12
je 0x18003dfd5
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], ebx
mov rcx, rax
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdi, rax
test rax, rax
je 0x18003dfcc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x18003dfc3
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
je 0x18003dfc3
lea r9, [rbp + 0x7f]
mov edx, r15d
lea r8, [rbp - 0x69]
mov rcx, rax
call qword [sym.imp.imagehlp.dll_CheckSumMappedFile]
test rax, rax
je 0x18003dfba
mov ecx, dword [rbp + 0x7f]
mov dword [rax + 0x58], ecx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov sil, 1
jmp 0x18003dfdd
xor sil, sil
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x18003dfeb
call fcn.180049e70
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x18003dff9
call fcn.180049e70
mov rdx, qword [rbp - 0x11]
movabs r14, 0x6db6db6db6db6db7
mov rcx, qword [rbp - 0x19]
mov rax, rdx
sub rax, rcx
sar rax, 3
imul rax, r14
test rax, rax
je 0x18003e055
mov rdi, rbx
mov rax, qword [rdi + rcx + 0x28]
test rax, rax
je 0x18003e03b
mov rcx, rax
call fcn.180049e70
mov rdx, qword [rbp - 0x11]
mov rcx, qword [rbp - 0x19]
mov rax, rdx
inc rbx
sub rax, rcx
add rdi, 0x38
sar rax, 3
imul rax, r14
cmp rbx, rax
jb 0x18003e021
mov qword [rbp - 0x11], rcx
test rcx, rcx
je 0x18003e097
mov rax, qword [rbp - 9]
sub rax, rcx
sar rax, 3
imul rax, r14
imul rdx, rax, 0x38
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003e092
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003e0b7
call fcn.180049e70
movzx eax, sil
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1800503fc
int3