Function at 0x1800067d0
Capabilities:
Copy file
Get disk information
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rbx, rcx
xor ecx, ecx
call fcn.18008b19c
mov ecx, eax
call fcn.180087d94
call fcn.180087d68
and eax, 0x80000003
jge 0x180006808
dec eax
or eax, 0xfffffffc
inc eax
xor edi, edi
test eax, eax
jne 0x180006919
cmp dword [0x18010ccf0], 0x617f918b
jne 0x180006902
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetProcessRestrictionExemption]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
lea rax, [0x1801259b8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDurationFormat]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ModifyMenuW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetParent]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
call qword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetClassWord]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayDevicesW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DestroyAcceleratorTable]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerCreateRequest]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserPreferredUILanguages]
mov rdx, qword [rbp + 0x58]
mov rcx, rbx
call fcn.180001fb0
add rsp, 0x130
pop rdi
pop rbx
pop rbp
ret
cmp eax, 1
jne 0x180006abf
mov dword [rbp + 0x68], 4
mov dword [rsp + 0x50], 0x3000
mov qword [rbp - 0x30], rdi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x1fe
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x20], 0x1fe
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], rdi
mov ecx, 0x10
call fcn.180081f78
mov qword [rax + 8], rdi
mov qword [rbp - 0x78], rax
lea rcx, [rbp - 0x78]
mov qword [rax], rcx
mov word [rbp - 0x48], di
mov qword [rbp - 0x42], rdi
mov qword [rbp - 0x3a], rdi
xor eax, eax
mov word [rbp - 0x45], ax
mov byte [rbp - 0x43], al
mov word [rbp - 0x42], ax
mov byte [rbp - 0x40], al
mov word [rbp - 0x3f], ax
mov byte [rbp - 0x3d], al
mov word [rbp - 0x3c], ax
mov byte [rbp - 0x3a], al
mov word [rbp - 0x39], ax
mov byte [rbp - 0x37], al
mov word [rbp - 0x36], ax
mov byte [rbp - 0x34], al
mov dword [rbp - 0x4c], edi
mov dword [rbp - 0x7c], edi
lea rcx, [rsp + 0x70]
call fcn.180026f40
test al, al
je 0x180006a06
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.1800270d0
mov byte [rbp - 0x48], 0
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x60], rcx
and al, 1
mov byte [rsp + 0x68], al
mov dl, 1
lea rcx, [rsp + 0x60]
call fcn.180014be0
lea rcx, [rsp + 0x70]
call fcn.180029ac0
lea rax, [rsp + 0x70]
mov qword [rbp + 0x60], rax
lea rdx, [rbp + 0x60]
call fcn.180017770
mov byte [rbp + 0x60], 0
mov r8b, 1
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.18001ed50
mov byte [rbp + 0x60], 0
mov r8b, 1
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.18001ee20
mov byte [rbp + 0x60], 0
mov r8b, 1
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.18001efc0
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rbp - 0x10], xmm0
lea rax, [rbp + 0x68]
mov qword [rbp], rax
lea rax, [rsp + 0x50]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x58]
mov qword [rbp + 0x10], rax
lea rax, [rbp - 0x30]
mov qword [rbp + 0x18], rax
mov r8b, 1
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x70]
call fcn.18001f090
mov rbx, qword [rsp + 0x78]
lea rcx, [rbp - 0x78]
call fcn.180013fc0
mov rcx, qword [rbp - 0x78]
mov qword [rbp - 0x78], rdi
mov edx, 0x10
call fcn.180081e8c
mov rax, rbx
add rsp, 0x130
pop rdi
pop rbx
pop rbp
ret
cmp eax, 2
jne 0x180006c32
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x12c
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x12c
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.180011370
mov qword [rbp + 0x68], rax
cmp dword [0x18010ccf0], 0xecdf4aef
jne 0x180006be5
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileIntW]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
lock dec dword [rdi]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapePosition]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
lea rdx, [0x1801259f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadDescription]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleDisplayMode]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapQueryInformation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
mov dword [rbp + 0x60], 8
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
add rax, 0x24f
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x24f
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
lea r9, [rbp + 0x58]
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.1800114e0
add rsp, 0x130
pop rdi
pop rbx
pop rbp
ret
cmp eax, 3
jne 0x180006fe7
mov dword [rbp + 0x60], edi
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
add rax, 0x144
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x144
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x58]
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.18000f2a0
mov qword [rbp - 0x28], rax
mov dword [rbp + 0x68], 4
mov dword [rsp + 0x50], 0x3000
mov dword [rbp - 0x30], 0x400
mov qword [rbp - 0x18], rdi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x19a
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x19a
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], rdi
mov ecx, 0x10
call fcn.180081f78
mov qword [rax + 8], rdi
mov qword [rbp - 0x78], rax
lea rcx, [rbp - 0x78]
mov qword [rax], rcx
mov word [rbp - 0x48], di
mov qword [rbp - 0x42], rdi
mov qword [rbp - 0x3a], rdi
xor eax, eax
mov word [rbp - 0x45], ax
mov byte [rbp - 0x43], al
mov word [rbp - 0x42], ax
mov byte [rbp - 0x40], al
mov word [rbp - 0x3f], ax
mov byte [rbp - 0x3d], al
mov word [rbp - 0x3c], ax
mov byte [rbp - 0x3a], al
mov word [rbp - 0x39], ax
mov byte [rbp - 0x37], al
mov word [rbp - 0x36], ax
mov byte [rbp - 0x34], al
mov dword [rbp - 0x4c], edi
mov dword [rbp - 0x7c], edi
lea rcx, [rsp + 0x70]
call fcn.1800276f0
test al, al
je 0x180006d63
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.180027880
mov byte [rbp - 0x48], 0
lea rcx, [rsp + 0x70]
mov qword [rbp + 0x20], rcx
and al, 1
mov byte [rbp + 0x28], al
mov dl, 1
lea rcx, [rbp + 0x20]
call fcn.180014d30
lea rcx, [rsp + 0x70]
call fcn.180029ac0
lea rax, [rsp + 0x70]
mov qword [rbp + 0x60], rax
lea rdx, [rbp + 0x60]
call fcn.180017230
mov byte [rbp + 0x60], 0
mov r8b, 1
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.18001e120
mov byte [rbp + 0x60], 0
mov r8b, 1
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.18001e1f0
mov byte [rbp + 0x60], 0
mov r8b, 1
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.18001e390
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbp - 0x10], xmm0
lea rax, [rbp + 0x68]
mov qword [rbp], rax
lea rax, [rsp + 0x50]
mov qword [rbp + 8], rax
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
lea rax, [rbp - 0x18]
mov qword [rbp + 0x18], rax
mov r8b, 1
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x70]
call fcn.18001e460
mov rbx, qword [rsp + 0x78]
lea rcx, [rbp - 0x78]
call fcn.180013fc0
mov rcx, qword [rbp - 0x78]
mov qword [rbp - 0x78], rdi
mov edx, 0x10
call fcn.180081e8c
mov qword [rsp + 0x60], rbx
mov rax, qword [sym.imp.KERNEL32.dll_LocalLock]
add rax, 0x1c3
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x1c3
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x40]
call fcn.18000f430
mov rbx, rax
cmp dword [0x18010ccf0], 0xa26bb6a5
jne 0x180006f93
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x180125a30]
call qword [sym.imp.KERNEL32.dll_FindFirstStreamTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
call qword [sym.imp.KERNEL32.dll_GetSystemDEPPolicy]
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileTransactedW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
lea r9, [0x180125a50]
xor r8d, r8d
lea rdx, [0x180125a90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindStringOrdinal]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlPcToFileHeader]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
xor edx, edx
lea rcx, [0x180125ac8]
call qword [sym.imp.KERNEL32.dll_LoadModule]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlPcToFileHeader]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CallbackMayRunLong]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadErrorMode]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutexWhenCallbackReturns]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [rbp + 0x60], 0x8000
mov dword [rbp + 0x68], edi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
add rax, 0x25a
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x25a
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea r9, [rbp + 0x60]
lea r8, [rbp + 0x68]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.180011680
mov rax, rbx
add rsp, 0x130
pop rdi
pop rbx
pop rbp
ret
mov rax, rdi
add rsp, 0x130
pop rdi
pop rbx
pop rbp
ret