Function at 0x1400f8c24
Capabilities:
Copy file

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xb0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x1403d88e8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r15, r8
mov r14, rdx
movzx edx, cx
xor ebp, ebp
cmp dword [r14], ebp
jne 0x1400f8ca3
mov ecx, dword [r8]
mov eax, ecx
sub eax, 1
je 0x1400f8c9c
sub eax, 1
je 0x1400f8db8
sub eax, 2
je 0x1400f8d90
sub eax, 4
je 0x1400f8d68
sub eax, 8
je 0x1400f8d5c
sub eax, 0x10
je 0x1400f8cf7
cmp eax, 0x20
jne 0x1400f8d0a
mov dword [r14], ecx
mov qword [r14 + 8], rbp
mov ecx, dword [r8]
sub ecx, 1
je 0x1400f8fe6
sub ecx, 1
je 0x1400f8f35
sub ecx, 2
je 0x1400f8e48
sub ecx, 4
je 0x1400f8e12
sub ecx, 8
je 0x1400f8cd4
cmp ecx, 0x30
jne 0x1400f8d0a
cmp qword [r14 + 8], rbp
jne 0x1400f8d0a
xor r8d, r8d
mov rcx, qword [r15 + 8]
call qword [sym.imp.ole32.dll_OleDuplicateData]
mov qword [r14 + 8], rax
test rax, rax
setne bpl
jmp 0x1400f8e41
mov rdx, qword [r8 + 8]
xor ecx, ecx
call fcn.1400f8b68
mov rdi, rax
test rax, rax
jne 0x1400f8d11
xor eax, eax
jmp 0x1400f9005
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rbx, rax
xor edx, edx
mov rcx, qword [rax + 0x10]
call qword [sym.imp.GDI32.dll_CopyMetaFileW]
mov qword [rbx + 0x10], rax
mov rcx, rdi
test rax, rax
jne 0x1400f8d46
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1400f8d0a
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [r14 + 8], rdi
mov dword [r14], 0x20
jmp 0x1400f9000
mov dword [r14], 0x10
jmp 0x1400f8c9f
mov rdi, qword [r8 + 8]
mov qword [r14 + 8], rdi
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call fcn.14029e28c
mov rcx, rdi
call rbx
mov dword [r14], 8
jmp 0x1400f9000
mov rdi, qword [r8 + 8]
mov qword [r14 + 8], rdi
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call fcn.14029e28c
mov rcx, rdi
call rbx
mov dword [r14], 4
jmp 0x1400f9000
mov dword [r14], 2
mov rcx, qword [r8 + 8]
test rcx, rcx
je 0x1400f902c
call fcn.1402a577c
lea ebx, [rax + 1]
add rbx, rbx
mov eax, 0xffffffff
cmp rbx, rax
jbe 0x1400f8de6
mov rax, rbp
jmp 0x1400f8dee
mov ecx, ebx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [r14 + 8], rax
test rax, rax
je 0x1400f8d0a
mov r9, rbx
mov r8, qword [r15 + 8]
mov rdx, rbx
mov rcx, rax
call fcn.14001cdf0
jmp 0x1400f9000
mov rdi, qword [r8 + 8]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x38]
mov rcx, rbx
call fcn.14029e28c
mov rax, qword [r14 + 8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call rbx
test eax, eax
sete bpl
mov eax, ebp
jmp 0x1400f9005
mov rdi, qword [r8 + 8]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x60]
mov rcx, rbx
call fcn.14029e28c
mov r8d, 1
lea rdx, [rsp + 0x50]
mov rcx, rdi
call rbx
test eax, eax
jne 0x1400f8d0a
mov qword [rsp + 0x30], rbp
mov rsi, qword [r14 + 8]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x28]
mov rcx, rdi
call fcn.14029e28c
xor r9d, r9d
xor r8d, r8d
mov rbx, rbp
mov rdx, rbx
mov rcx, rsi
call rdi
mov rsi, qword [r15 + 8]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x28]
mov rcx, rdi
call fcn.14029e28c
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call rdi
mov rsi, qword [r15 + 8]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x38]
mov rcx, rdi
call fcn.14029e28c
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov r8, qword [rsp + 0x60]
mov rdx, qword [r14 + 8]
mov rcx, rsi
call rdi
test eax, eax
jne 0x1400f8d0a
mov rsi, qword [r14 + 8]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x28]
mov rcx, rdi
call fcn.14029e28c
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call rdi
mov rsi, qword [r15 + 8]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x28]
mov rcx, rdi
call fcn.14029e28c
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call rdi
jmp 0x1400f9000
mov rdx, qword [r8 + 8]
lea rcx, [rsp + 0x38]
call fcn.140015b30
nop
mov rdx, qword [r14 + 8]
lea rcx, [rsp + 0x30]
call fcn.140015b30
mov rax, qword [r14 + 8]
neg rax
sbb rdx, rdx
and rdx, qword [rsp + 0x30]
mov rax, qword [r15 + 8]
neg rax
sbb rcx, rcx
and rcx, qword [rsp + 0x38]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov r14d, eax
mov rsi, qword [rsp + 0x30]
or r15d, 0xffffffff
mov ecx, r15d
lock xadd dword [rsi - 8], ecx
add ecx, r15d
test ecx, ecx
jg 0x1400f8fb1
mov rdi, qword [rsi - 0x18]
mov r8, qword [rdi]
mov rbx, qword [r8 + 8]
mov rcx, rbx
call fcn.14029e28c
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
nop
mov rsi, qword [rsp + 0x38]
mov eax, r15d
lock xadd dword [rsi - 8], eax
add eax, r15d
test eax, eax
jg 0x1400f8fe1
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call fcn.14029e28c
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
mov eax, r14d
jmp 0x1400f9005
mov rdx, qword [r8 + 8]
mov rcx, qword [r14 + 8]
call fcn.1400f8b68
test rax, rax
je 0x1400f8d0a
mov qword [r14 + 8], rax
mov eax, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14029d880
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400f91a0
int3