Function at 0x1800049b0
Capabilities:
Copy file
Delete directory

Disassembly:
sub rsp, 0x58
mov dword [rsp + 0x48], 0x220
lea rax, [fcn.180004c90]
add rax, 0x220
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000f4c0
mov rax, qword [0x18010c3e8]
mov r8d, dword [0x18010c3d4]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x3e58]
mov dword [rax + 4], 0x38793b18
cmp r8d, 0xac6ecd44
jne 0x180004ae2
xor edx, edx
mov qword [rsp + 0x50], rbx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_SetArcDirection]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreatePolygonRgn]
call qword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_CopyFileTransactedW]
call qword [sym.imp.KERNEL32.dll_GetACP]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsFree]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateBitmap]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientComputerNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
mov r8d, dword [0x18010c3d4]
mov rbx, qword [rsp + 0x50]
mov rax, qword [0x18010c3f0]
mov rcx, qword [rax + 0x18]
mov rax, qword [0x18010c3e8]
mov edx, dword [rcx + 0x8f8]
mov rcx, qword [rax + 0x18]
add edx, 0x6f2b7b2d
mov rax, qword [rcx + 0x3e58]
mov dword [rax], edx
cmp r8d, 0x83b38448
jne 0x180004c3c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetupComm]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_DeleteDC]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetDIBColorTable]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenJobObjectW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitCommEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
xor ecx, ecx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetProcessorSystemCycleTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddIntegrityLabelToBoundaryDescriptor]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetFontLanguageInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetViewportExtEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileSectionW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_LineTo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenJobObjectW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_SetBitmapDimensionEx]
mov rax, qword [0x18010c3e8]
mov rcx, qword [rax + 0x18]
mov rax, qword [0x18010c3f0]
mov rdx, qword [rcx + 0x3e58]
mov rcx, qword [rax + 0x18]
mov eax, dword [rcx + 0x8f8]
add dword [rdx + 4], eax
mov rax, qword [0x18010c3e0]
mov r8, qword [rax + 0x18]
mov rax, qword [0x18010c3e8]
mov rcx, qword [rax + 0x18]
mov eax, dword [r8 + 0x2cd8]
mov rdx, qword [rcx + 0x3e58]
mov dword [rdx + 8], eax
add rsp, 0x58
ret