Function at 0x1000f9b94
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x470
mov rax, qword [0x100151198]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor r14d, r14d
or rdi, 0xffffffffffffffff
mov r12, r9
mov r13, r8
mov ebp, r14d
cmp r9, r14
je 0x1000f9dcb
lea rcx, [r11 - 0x248]
mov edx, 0x104
mov word [r11 - 0x248], r14w
mov word [rsp + 0x40], r14w
call fcn.1000f9e30
cmp eax, r14d
mov ebx, eax
jge 0x1000f9c3b
mov rcx, qword [0x100152eb8]
lea rsi, [0x100152eb8]
cmp rcx, rsi
je 0x1000f9db5
test byte [rcx + 0x1c], 1
je 0x1000f9db5
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0xf]
lea r8, [0x10001dba8]
mov r9d, eax
call fcn.100036328
jmp 0x1000f9db5
lea rsi, [0x100152eb8]
lea r9, [rsp + 0x40]
lea rdx, [0x100027310]
lea rcx, [rsp + 0x250]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp eax, r14d
je 0x1000f9d49
lea rcx, [rsp + 0x40]
cmp r13, r14
je 0x1000f9ce0
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x40]
mov r8, r13
mov edx, 0x104
call fcn.10006aa64
cmp eax, r14d
jge 0x1000f9cb9
mov rcx, qword [0x100152eb8]
cmp rcx, rsi
je 0x1000f9cb9
test byte [rcx + 0x1c], 1
je 0x1000f9cb9
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dba8]
mov edx, 0xf
mov r9d, ebx
call fcn.100036328
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x40]
jmp 0x1000f9cf5
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rsp + 0x40]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1000f9d6b
mov edx, 0x2080
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, r14d
jne 0x1000f9d49
mov rcx, qword [0x100152eb8]
cmp rcx, rsi
je 0x1000f9d49
test byte [rcx + 0x1c], 2
je 0x1000f9d49
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x11]
lea r8, [0x10001dba8]
call fcn.100034764
mov ecx, 0x64
inc ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp ebp, 0x32
jb 0x1000f9c42
mov ebx, 0x80004005
mov eax, ebx
jmp 0x1000f9dfe
mov r8d, 0x104
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, r14d
jne 0x1000f9d9f
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x1000f9dba
mov ebx, 0x80004005
jmp 0x1000f9dba
cmp rdi, 0xffffffffffffffff
je 0x1000f9db2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or rdi, 0xffffffffffffffff
mov ebx, r14d
cmp ebx, r14d
jge 0x1000f9d64
cmp rdi, 0xffffffffffffffff
je 0x1000f9d64
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000f9d64
mov rcx, qword [0x100152eb8]
lea rsi, [0x100152eb8]
cmp rcx, rsi
je 0x1000f9df9
test byte [rcx + 0x1c], 1
je 0x1000f9df9
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dba8]
mov edx, 0xd
call fcn.100034764
mov eax, 0x80070057
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.10011b980
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret