Function at 0x180006ad0
Capabilities:
Copy file
Get disk information
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
xor ecx, ecx
call fcn.18007f040
mov ecx, eax
call fcn.18007bb48
call fcn.18007bb1c
and eax, 0x80000003
jge 0x180006b0a
dec eax
or eax, 0xfffffffc
inc eax
xor edi, edi
test eax, eax
jne 0x180006c38
cmp dword [0x1800fe978], 0x89696a5f
jne 0x180006c24
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddAtomW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolIo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FreeDDElParam]
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetRect]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitCommEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64SuspendThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterPointerInputTarget]
call qword [sym.imp.USER32.dll_GetInputState]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNodeEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolWork]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64SuspendThread]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReclaimVirtualMemory]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetDlgItemInt]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EndDialog]
mov rdx, qword [rbp + 0x6f]
call fcn.1800022f0
add rsp, 0xe0
pop rdi
pop rbx
pop rbp
ret
cmp eax, 1
jne 0x180006d3a
mov dword [rbp + 0x67], 4
mov dword [rbp + 0x77], 0x3000
mov qword [rbp + 0x7f], rdi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x18f
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x18f
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov ecx, 0x10
call fcn.1800722f8
mov qword [rax + 8], rdi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], di
mov qword [rbp - 0xb], rdi
mov qword [rbp - 3], rdi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], edi
mov dword [rbp - 0x15], edi
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 7], xmm0
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f]
lea r8, [rbp + 0x7f]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.180013b10
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.180016870
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rdi
mov edx, 0x10
call fcn.18007220c
mov rax, rbx
add rsp, 0xe0
pop rdi
pop rbx
pop rbp
ret
cmp eax, 2
jne 0x180007009
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x22d
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x22d
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov ecx, 0x10
call fcn.1800722f8
mov qword [rax + 8], rdi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], di
mov qword [rbp - 0xb], rdi
mov qword [rbp - 3], rdi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], edi
mov dword [rbp - 0x15], edi
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 7], xmm0
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.1800138f0
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.180016870
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rdi
mov edx, 0x10
call fcn.18007220c
mov qword [rbp + 0x77], rbx
cmp dword [0x1800fe978], 0xed7c4381
jne 0x180006f22
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
lea rax, [0x180116ae0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x180116b10]
call qword [sym.imp.KERNEL32.dll_GetDurationFormatEx]
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolCleanupGroup]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x180116b38]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileMUIPath]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTapePosition]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNodeEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BuildCommDCBW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFiber]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateHardLinkTransactedW]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessGroupAffinity]
mov dword [rbp + 0x67], 8
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
add rax, 0x220
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x220
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov ecx, 0x10
call fcn.1800722f8
mov qword [rax + 8], rdi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], 0
mov qword [rbp - 0xb], rdi
mov qword [rbp - 3], rdi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], edi
mov dword [rbp - 0x15], edi
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 7], xmm0
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x67]
lea r8, [rbp + 0x77]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.1800136b0
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.180016870
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rdi
mov edx, 0x10
call fcn.18007220c
mov rax, rbx
add rsp, 0xe0
pop rdi
pop rbx
pop rbp
ret
cmp eax, 3
jne 0x1800073d2
mov dword [rbp + 0x67], edi
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
add rax, 0x13a
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x13a
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov ecx, 0x10
call fcn.1800722f8
mov qword [rax + 8], rdi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], di
mov qword [rbp - 0xb], rdi
mov qword [rbp - 3], rdi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], edi
mov dword [rbp - 0x15], edi
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 7], xmm0
lea r9, [rbp + 0x6f]
lea r8, [rbp + 0x67]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.180016070
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.180016870
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rdi
mov edx, 0x10
call fcn.18007220c
mov qword [rbp + 0x37], rbx
mov dword [rbp + 0x67], 4
mov dword [rbp + 0x77], 0x3000
mov dword [rbp + 0x7f], 0x400
mov qword [rbp + 0x2f], rdi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x201
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], 0x201
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov ecx, 0x10
call fcn.1800722f8
mov qword [rax + 8], rdi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], 0
mov qword [rbp - 0xb], rdi
mov qword [rbp - 3], rdi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], edi
mov dword [rbp - 0x15], edi
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp + 7], xmm0
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x7f]
lea r8, [rbp + 0x2f]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.180013470
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.180016870
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rdi
mov edx, 0x10
call fcn.18007220c
mov qword [rbp + 0x27], rbx
mov rax, qword [sym.imp.KERNEL32.dll_LocalLock]
add rax, 0x2a4
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], 0x2a4
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp + 7], xmm0
lea rdx, [rbp + 0x37]
lea rcx, [rbp + 7]
call fcn.18000f010
mov rbx, rax
cmp dword [0x1800fe978], 0x5100f520
jne 0x1800072fc
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolCleanupGroup]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64SuspendThread]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumberEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientProcessId]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryProtectedPolicy]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrefetchVirtualMemory]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfoExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rbp + 0x67], 0x8000
mov dword [rbp + 0x77], edi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
add rax, 0x1cf
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], 0x1cf
xor eax, eax
mov word [rbp - 0x59], ax
mov byte [rbp - 0x57], al
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], rdi
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov ecx, 0x10
call fcn.1800722f8
mov qword [rax + 8], rdi
mov qword [rbp - 0x51], rax
lea rcx, [rbp - 0x51]
mov qword [rax], rcx
mov word [rbp - 0x21], 0
mov qword [rbp - 0x1b], rdi
mov qword [rbp - 0x13], rdi
xor eax, eax
mov word [rbp - 0x1e], ax
mov byte [rbp - 0x1c], al
mov word [rbp - 0x1b], ax
mov byte [rbp - 0x19], al
mov word [rbp - 0x18], ax
mov byte [rbp - 0x16], al
mov word [rbp - 0x15], ax
mov byte [rbp - 0x13], al
mov word [rbp - 0x12], ax
mov byte [rbp - 0x10], al
mov word [rbp - 0xf], ax
mov byte [rbp - 0xd], al
mov dword [rbp - 0x55], edi
mov dword [rbp - 0x25], edi
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp + 7], xmm0
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x77]
lea r8, [rbp + 0x27]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.180013230
nop
lea rcx, [rbp - 0x51]
call fcn.180016870
mov rcx, qword [rbp - 0x51]
mov qword [rbp - 0x51], rdi
jmp 0x180006ff1
mov rax, rdi
add rsp, 0xe0
pop rdi
pop rbx
pop rbp
ret