Function at 0x180014d20
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x180079880]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov esi, edx
mov dword [rbp - 0x6d], edx
xor edx, edx
mov r13, rcx
mov edi, edx
mov dword [rbp - 0x71], edx
lea ebx, [rsi + 0x71b]
mov dword [rbp - 0x75], ebx
cmp esi, ebx
movzx ebx, byte [rbp - 0x79]
jae 0x180014e58
movzx r14d, byte [rbp - 0x79]
lea r11d, [rdx + 0x47]
mov eax, dword [rbp - 0x75]
lea r12d, [rdx + 0x6e]
movabs r9, 0x63006f00520020
movabs r15, 0x5f00430046
movabs r10, 0x52004f0052
mov r8d, 0x16
movabs rcx, 0x7fffffffffffffff
cmp esi, 0x273
ja 0x180014f60
je 0x180014f57
cmp esi, 0x17e
ja 0x180014efe
je 0x180014ee5
mov eax, esi
sub eax, 0x5c
je 0x180014ed9
sub eax, 0x6b
je 0x180014eb4
sub eax, 0x4c
je 0x180014e88
cmp eax, 0x1f
jne 0x180014e47
mov word [rbp - 0x23], dx
lea r8d, [rax - 0x1d]
lea rdx, [0x1800719ba]
lea rcx, [rbp - 0x31]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, dword [0x180071a10]
xor edx, edx
mov dword [rbp - 0x1f], eax
movzx eax, word [0x180071a14]
mov word [rbp - 0x1b], ax
mov word [rbp - 0x19], dx
mov r11d, 0x47
movabs r10, 0x52004f0052
movabs r9, 0x63006f00520020
mov eax, dword [rbp - 0x75]
add esi, 0x6b
mov dword [rbp - 0x6d], esi
cmp esi, eax
jb 0x180014da4
movzx eax, bl
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.180050c90
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor r9d, r9d
lea r8, [rbp - 0x69]
xor edx, edx
mov ecx, 0xd5
call fcn.180047d10
test al, al
je 0x1800154e1
cmp dword [rbp - 0x69], 2
jae 0x18001553e
xor edx, edx
jmp 0x180014e2d
mov r8d, 4
lea rdx, [0x180071696]
lea rcx, [rbp - 0x2f]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor edx, edx
mov dword [rbp - 0x27], 0x30005f
jmp 0x180014e2d
mov dword [rbp - 0x31], 0x47
jmp 0x180014e47
xor edx, edx
mov ecx, 0xfa
call fcn.180007b10
cmp eax, 3
setae bl
xor edx, edx
jmp 0x180014e2d
mov eax, esi
sub eax, 0x19d
je 0x180014f3e
sub eax, 0x4c
je 0x180014e58
cmp eax, 0x1f
jne 0x180014e47
mov word [rbp - 0x13], dx
lea r8d, [rax - 0x1d]
lea rdx, [0x1800716de]
lea rcx, [rbp - 0x31]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
xor edx, edx
mov word [rbp - 0xf], r12w
jmp 0x180014e2d
mov eax, dword [0x180071918]
mov dword [rbp - 0x19], eax
movzx eax, word [0x18007191c]
mov word [rbp - 0x15], ax
jmp 0x180014e47
mov qword [rbp - 0xd], r9
jmp 0x180014e4a
cmp esi, 0x48a
ja 0x1800154bb
je 0x18001505a
mov eax, esi
sub eax, 0x2de
je 0x18001502d
sub eax, 0x6b
je 0x180015004
sub eax, 0x6b
je 0x180014fe6
cmp eax, 0x6b
jne 0x180014e47
lea rcx, [rbp - 1]
sub rcx, 2
nop
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180014fa0
mov eax, dword [0x1800718b8]
lea rdx, [0x1800718bc]
mov dword [rcx], eax
mov r8d, 1
lea rcx, [rbp - 1]
mov dword [rbp + 0x11], 0x4f
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
movabs rax, 0x520045005f
xor edx, edx
mov qword [rbp + 0x15], rax
jmp 0x180014e2d
mov r8d, 2
lea rdx, [0x1800718b0]
lea rcx, [rbp - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
xor edx, edx
jmp 0x180014e2d
mov r8d, 1
mov qword [rbp + 1], r15
lea rdx, [0x180071680]
lea rcx, [rbp - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
xor edx, edx
mov dword [rbp + 9], 0x45
jmp 0x180014e2d
mov word [rbp - 5], dx
lea rcx, [rbp - 5]
lea rdx, [0x1800718e8]
mov r8d, 1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor edx, edx
mov dword [rbp - 1], 0x4e
mov word [rbp - 3], dx
jmp 0x180014e2d
cmp qword [r13 + 0x10], 0x35
mov qword [rbp + 0x1b], r10
mov byte [rbp - 0x79], 1
jb 0x180015534
mov r12d, 0x11a
cmp r12d, 0x11a
je 0x1800151fc
cmp r12d, 0x7eae
je 0x18001509b
cmp r12d, 0xfc42
je 0x180014e58
jmp 0x18001548a
mov rax, qword [r13 + 0x10]
mov qword [rbp - 0x39], 0xf
mov byte [rbp - 0x51], 0
cmp rax, 0x11
jb 0x18001554c
add rax, 0xffffffffffffffef
mov esi, 0x24
cmp rax, rsi
cmovb rsi, rax
cmp qword [r13 + 0x18], 0x10
mov rax, r13
jb 0x1800150d3
mov rax, qword [r13]
lea r14, [rax + 0x11]
cmp rsi, 0xf
ja 0x1800150fa
mov r8, rsi
mov qword [rbp - 0x41], rsi
mov rdx, r14
lea rcx, [rbp - 0x51]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi - 0x51], 0
jmp 0x180015188
cmp rsi, rcx
ja 0x180015552
mov rdi, rsi
or rdi, 0xf
cmp rdi, rcx
jbe 0x180015114
mov rdi, rcx
jmp 0x18001511c
cmp rdi, 0x16
cmovb rdi, r8
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x180015155
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180015558
mov rcx, rax
call fcn.1800504a0
test rax, rax
je 0x180015545
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x180015167
test rcx, rcx
je 0x180015164
call fcn.1800504a0
mov rbx, rax
jmp 0x180015167
mov rbx, rdx
mov r8, rsi
mov qword [rbp - 0x41], rsi
mov rdx, r14
mov qword [rbp - 0x39], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [rbp - 0x71]
mov byte [rbx + rsi], 0
mov qword [rbp - 0x51], rbx
or edi, 1
lea rdx, [rbp - 0x51]
lea rcx, [0x1800797b8]
mov dword [rbp - 0x71], edi
call fcn.1800032e0
mov rdx, qword [rbp - 0x39]
cmp rdx, 0x10
jb 0x1800151d9
mov rcx, qword [rbp - 0x51]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800151d4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015545
call fcn.1800504dc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov edx, 1
lea r8, [rbp - 0x59]
mov ecx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
mov bl, 1
jmp 0x18001547a
mov r14d, 0xb
mov qword [rbp - 0x39], 0xf
cmp qword [r13 + 0x10], r14
mov r15, r13
mov byte [rbp - 0x51], 0
cmovb r14, qword [r13 + 0x10]
cmp qword [r13 + 0x18], 0x10
jb 0x180015225
mov r15, qword [r13]
cmp r14, 0xf
ja 0x180015249
mov r8, r14
mov qword [rbp - 0x41], r14
mov rdx, r15
lea rcx, [rbp - 0x51]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + r14 - 0x51], 0
jmp 0x1800152d8
cmp r14, rcx
ja 0x180015552
mov rsi, r14
or rsi, 0xf
cmp rsi, rcx
jbe 0x180015263
mov rsi, rcx
jmp 0x18001526b
cmp rsi, 0x16
cmovb rsi, r8
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1800152a4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180015558
mov rcx, rax
call fcn.1800504a0
test rax, rax
je 0x180015545
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800152b6
test rcx, rcx
je 0x1800152b3
call fcn.1800504a0
mov rdi, rax
jmp 0x1800152b6
mov rdi, rdx
mov r8, r14
mov qword [rbp - 0x41], r14
mov rdx, r15
mov qword [rbp - 0x39], rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov qword [rbp - 0x51], rdi
mov edi, dword [rbp - 0x71]
or edi, 2
lea rdx, [rbp - 0x51]
lea rcx, [0x1800797d8]
mov dword [rbp - 0x71], edi
call fcn.1800032e0
mov rax, qword [rbp - 0x39]
cmp rax, 0x10
jb 0x18001532a
mov rcx, qword [rbp - 0x51]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015325
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015545
call fcn.1800504dc
mov rax, qword [r13 + 0x10]
mov qword [rbp - 0x39], 0xf
mov byte [rbp - 0x51], 0
cmp rax, 0xb
jb 0x18001554c
add rax, 0xfffffffffffffff5
mov r14d, 6
cmp rax, r14
cmovb r14, rax
cmp qword [r13 + 0x18], 0x10
mov rax, r13
jb 0x180015363
mov rax, qword [r13]
lea r15, [rax + 0xb]
cmp r14, 0xf
ja 0x18001538b
mov r8, r14
mov qword [rbp - 0x41], r14
mov rdx, r15
lea rcx, [rbp - 0x51]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + r14 - 0x51], 0
jmp 0x180015428
movabs rax, 0x7fffffffffffffff
cmp r14, rax
ja 0x180015552
mov rsi, r14
or rsi, 0xf
cmp rsi, rax
jbe 0x1800153af
mov rsi, rax
jmp 0x1800153bc
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1800153f5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180015558
mov rcx, rax
call fcn.1800504a0
test rax, rax
je 0x180015545
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180015406
test rcx, rcx
je 0x180015404
call fcn.1800504a0
mov rdi, rax
jmp 0x180015406
xor edi, edi
mov r8, r14
mov qword [rbp - 0x41], r14
mov rdx, r15
mov qword [rbp - 0x39], rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov qword [rbp - 0x51], rdi
mov edi, dword [rbp - 0x71]
or edi, 4
lea rdx, [rbp - 0x51]
lea rcx, [0x1800797f8]
mov dword [rbp - 0x71], edi
call fcn.1800032e0
mov rax, qword [rbp - 0x39]
cmp rax, 0x10
jb 0x18001547a
mov rcx, qword [rbp - 0x51]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180015475
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180015545
call fcn.1800504dc
xor edx, edx
movabs rcx, 0x7fffffffffffffff
lea r8d, [rdx + 0x16]
add r12d, 0x7d94
cmp r12d, 0x178bc
jbe 0x180015073
mov esi, dword [rbp - 0x6d]
movabs r15, 0x5f00430046
movzx r14d, byte [rbp - 0x79]
mov r12d, 0x6e
jmp 0x180014e2d
mov eax, esi
sub eax, 0x4f5
je 0x180015521
sub eax, 0x6b
je 0x1800154e8
cmp eax, 0x6b
jne 0x180014e47
test r14b, r14b
je 0x1800154e1
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor al, al
jmp 0x180014e5b
mov dword [rsp + 0x28], 1
lea rcx, [rbp - 1]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
lea rdx, [rbp - 0x31]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
xor edx, edx
movzx eax, r14b
mov ecx, edx
cmp qword [rbp - 0x61], rcx
cmovne ecx, eax
movzx r14d, cl
jmp 0x180014e2d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp - 0x61], rax
xor edx, edx
jmp 0x180014e2d
movzx r14d, byte [rbp - 0x79]
jmp 0x180014e4a
mov al, 1
jmp 0x180014e5b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003dc00
int3
call fcn.18003dbc0
int3
call fcn.18003da80
int3