Function at 0x180001fb0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x50
mov rax, qword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea r8, [rsp + 0x68]
mov dword [rsp + 0x48], 0x1d7
lea rdx, [rsp + 0x60]
add rax, 0x1d7
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
xor ebx, ebx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x60], ebx
call fcn.18000f2a0
cmp dword [0x18010ccf0], 0xb437e5ad
mov qword [rsp + 0x70], rax
jne 0x18000216e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
call qword [sym.imp.USER32.dll_InSendMessage]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursorPos]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CheckMenuItem]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTimeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
xor ecx, ecx
call qword [sym.imp.USER32.dll_LockWindowUpdate]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DeregisterShellHookWindow]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapDialogRect]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueue]
xor r8d, r8d
lea rdx, [0x180125258]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNLSVersionEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleHistoryInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
mov rax, qword [sym.imp.KERNEL32.dll_GlobalLock]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x48], 0x135
lea rcx, [rsp + 0x40]
add rax, 0x135
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000f430
add rsp, 0x50
pop rbx
ret