Function at 0x18000eef0
Capabilities:
Copy file
Get disk size
Manipulate console buffer
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov dword [rbp + 0x67], 0x53f
lea rax, [fcn.180005660]
add rax, 0x13f
mov qword [rbp - 9], rax
mov dword [rbp - 1], 0x13f
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp - 9], xmm0
lea rdx, [rbp + 0x67]
lea rcx, [rbp - 9]
call fcn.1800198e0
mov qword [0x18010e3e8], rax
mov byte [0x18010e3e4], 1
xor edi, edi
cmp dword [0x18010e3e0], 0x2e0efade
jne 0x18000eff0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessGroupAffinity]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRecoveryCallback]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileIntW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreatePrivateNamespaceW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibraryWhenCallbackReturns]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileShortNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea rax, [0x18000a390]
add rax, 0x11b
mov qword [rbp - 9], rax
mov dword [rbp - 1], 0x11b
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp - 9], xmm0
lea rcx, [rbp - 9]
call fcn.180019710
lea rax, [0x180007b80]
add rax, 0x209
mov qword [rbp - 9], rax
mov dword [rbp - 1], 0x209
xor eax, eax
mov word [rbp + 7], ax
mov byte [rbp + 9], al
mov qword [rbp + 0xf], rdi
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x1f], rdi
mov qword [rbp + 0x27], rdi
mov qword [rbp + 0x2f], rdi
mov ecx, 0x10
call fcn.18006737c
mov qword [rax + 8], rdi
mov qword [rbp + 0xf], rax
lea rcx, [rbp + 0xf]
mov qword [rax], rcx
mov word [rbp + 0x3f], di
mov qword [rbp + 0x45], rdi
mov qword [rbp + 0x4d], rdi
xor eax, eax
mov word [rbp + 0x42], ax
mov byte [rbp + 0x44], al
mov word [rbp + 0x45], ax
mov byte [rbp + 0x47], al
mov word [rbp + 0x48], ax
mov byte [rbp + 0x4a], al
mov word [rbp + 0x4b], ax
mov byte [rbp + 0x4d], al
mov word [rbp + 0x4e], ax
mov byte [rbp + 0x50], al
mov word [rbp + 0x51], ax
mov byte [rbp + 0x53], al
mov dword [rbp + 0xb], edi
mov dword [rbp + 0x3b], edi
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp - 9], xmm0
lea rdx, [rbp - 9]
lea rcx, [rbp + 7]
call fcn.18001c260
movzx ebx, byte [rbp + 9]
lea rcx, [rbp + 0xf]
call fcn.180024630
mov rcx, qword [rbp + 0xf]
mov qword [rbp + 0xf], rdi
mov edx, 0x10
call fcn.180067290
cmp dword [0x18010e3e0], 0xeb1486cd
jne 0x18000f283
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1801283e8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileMUIInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSectionWhenCallbackReturns]
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x180128418]
call qword [sym.imp.KERNEL32.dll_FindFirstStreamW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileNameW]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
mov qword [rsp + 0x20], rdi
mov r9d, dword [rbp + 0x67]
mov r8d, dword [rbp + 0x67]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
lea rax, [0x180128448]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x180128480]
call qword [sym.imp.KERNEL32.dll_GetDurationFormatEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTimeEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
lea rax, [0x1801284a8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [0x1801284e8]
xor r8d, r8d
xor edx, edx
lea rcx, [0x180128508]
call qword [sym.imp.KERNEL32.dll_GetDateFormatEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapWalk]
test bl, bl
jne 0x18000f294
lea rcx, [0x180128548]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret