Function at 0x140001fbc
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov rdi, rdx
mov r14, rcx
call fcn.140001ed8
xor r12d, r12d
mov ebx, eax
test eax, eax
jns 0x14000205a
cmp dword [section..data], 2
jbe 0x140002053
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140002053
mov rax, qword [0x14000b018]
and rax, r8
cmp rax, qword [0x14000b018]
jne 0x140002053
lea rax, [0x140008568]
mov dword [rbp + 0x77], ebx
mov qword [rbp - 9], rax
lea rdx, [0x140008c31]
lea rax, [rbp + 0x77]
mov dword [rbp + 0x7f], 0x41
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
call fcn.140001008
mov eax, ebx
jmp 0x1400021c4
mov r13d, 1
cmp ebx, r13d
jne 0x14000206d
mov eax, r13d
jmp 0x1400021c4
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l2_1_2.dll_CopyFileW]
nop dword [rax + rax]
test eax, eax
jne 0x1400021c2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0x20
jne 0x140002295
or rcx, 0xffffffffffffffff
mov rbx, rcx
inc rbx
cmp word [rdi + rbx*2], r12w
jne 0x1400020a8
add rbx, 6
mov eax, 2
mul rbx
cmovo rax, rcx
mov rcx, qword gs:[0x60]
mov r8, rax
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov r15, rax
test rax, rax
jne 0x140002160
cmp dword [section..data], 2
mov ebx, 0x8007000e
jbe 0x140002053
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140002053
mov rax, qword [0x14000b018]
and rax, r8
cmp rax, qword [0x14000b018]
jne 0x140002053
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x29], ebx
mov qword [rsp + 0x30], rcx
lea rax, [0x140008568]
lea rcx, [rbp - 0x25]
mov dword [rbp - 0x25], 0x4e
mov qword [rsp + 0x28], rcx
lea rdx, [0x140008c6e]
lea rcx, [rbp - 1]
mov qword [rbp - 1], rax
mov qword [rsp + 0x20], rcx
jmp 0x14000204e
movzx esi, r12w
movzx eax, si
lea r8, str._ws._x
mov r9, rdi
mov dword [rsp + 0x20], eax
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.ntdll.dll_swprintf_s]
nop dword [rax + rax]
mov rcx, r15
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_MoveFileW]
nop dword [rax + rax]
test eax, eax
jne 0x1400021e0
add si, r13w
mov eax, 0xffff
cmp si, ax
jb 0x140002164
mov rcx, r15
call fcn.1400062b4
xor eax, eax
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 4]
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
nop dword [rax + rax]
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l2_1_2.dll_CopyFileW]
nop dword [rax + rax]
test eax, eax
jne 0x1400021ba
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov ebx, eax
jbe 0x140002283
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140002283
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140002283
mov dword [rbp - 0x21], eax
lea rdx, [0x140008cbe]
lea rax, [0x140008568]
mov dword [rbp - 0x1d], 0x58
mov qword [rbp + 7], rax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x1d]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
call fcn.140001008
test ebx, ebx
jne 0x14000238c
mov eax, 0x8000ffff
jmp 0x1400021c4
cmp ebx, 5
jne 0x140002321
mov rdx, rdi
mov rcx, r14
call fcn.140004ed4
mov ebx, eax
test eax, eax
jns 0x1400021c2
cmp dword [section..data], 2
jbe 0x140002053
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140002053
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140002053
mov dword [rbp - 0x19], eax
lea rdx, [0x140008c31]
lea rax, [0x140008568]
mov dword [rbp - 0x15], 0x61
mov qword [rbp + 0xf], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x15]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xf]
jmp 0x140002049
test ebx, ebx
je 0x14000238c
cmp dword [section..data], 2
jbe 0x14000238c
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x14000238c
mov rax, qword [0x14000b018]
and rax, r8
cmp rax, qword [0x14000b018]
jne 0x14000238c
lea rax, [0x140008568]
mov dword [rbp - 0x11], ebx
mov qword [rbp + 0x17], rax
lea rdx, [0x140008cbe]
lea rax, [rbp - 0x11]
mov dword [rbp - 0xd], 0x65
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0xd]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
call fcn.140001008
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x1400021c4