Function at 0x140009d60
Capabilities:
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa00]
sub rsp, 0xb00
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rsp + 0xb40], rbx
mov rax, qword [0x14029f7a8]
xor rax, rsp
mov qword [rbp + 0x9f0], rax
mov r13, r8
mov r14, rdx
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x50], r8
mov r12, qword [rbp + 0xa60]
mov qword [rsp + 0x60], r12
mov qword [rbp - 0x48], r12
xor ebx, ebx
mov dword [rsp + 0x30], ebx
xor edx, edx
mov r8d, 0x230
lea rcx, [rbp - 0x40]
call fcn.1401b5d40
mov dword [rsp + 0x50], ebx
mov rax, qword [r13]
mov edx, dword [rax - 0x10]
test edx, edx
js 0x14000a508
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edx
or eax, ecx
jge 0x140009dfd
mov rcx, r13
call fcn.1400080a0
mov r15, qword [r13]
call fcn.1400315f4
mov rcx, rax
test rax, rax
je 0x14000a513
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov edx, 0x5c
mov rcx, qword [r14]
call fcn.1401b4f10
mov edi, 0xffffffff
test rax, rax
jne 0x140009e3c
mov eax, edi
jmp 0x140009e42
sub rax, qword [r14]
sar rax, 1
test eax, eax
cmovns ebx, eax
mov rcx, qword [r14]
cmp ebx, dword [rcx - 0x10]
jl 0x140009e63
add rcx, 0xffffffffffffffe8
call fcn.14000c170
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
jmp 0x140009e9d
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x140009e77
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x140009e85
call fcn.1400315f4
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov r9, rax
mov r8d, ebx
mov rdx, qword [r14]
lea rcx, [rsp + 0x70]
call fcn.14000bbd0
mov rbx, qword [rsp + 0x70]
mov dword [rsp + 0x30], 1
call fcn.1400315f4
mov rcx, rax
test rax, rax
je 0x14000a51e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, str.OldExecutable.bak
lea rcx, [rsp + 0x58]
cmp rdx, 0x10000
jae 0x140009ee4
movzx edx, dx
call fcn.140007da0
jmp 0x140009ef0
mov r8d, 0x11
call fcn.1400081d0
nop
lea rsi, [rbx - 0x18]
mov rcx, qword [rsi]
test rcx, rcx
je 0x140009f0a
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140009f1b
call fcn.1400315f4
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14000a529
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x30], 3
mov eax, 0x5c
mov word [rsp + 0x40], ax
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x40]
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14000bc70
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.14000b9b0
nop
mov dword [rsp + 0x30], 1
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009f9f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009fbd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, r15
call fcn.140029b10
mov qword [rbp - 0x68], rax
test rax, rax
je 0x14000a228
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x50]
lea rdx, [0x1402597f0]
mov rcx, rax
call fcn.140029cb0
test eax, eax
jne 0x14000a228
lea rdx, str.Moss.fut
lea rcx, [rbp - 0x70]
call fcn.1400082f0
mov r15, rax
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000a02b
mov rdx, qword [rcx]
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
jne 0x14000a03c
call fcn.1400315f4
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14000a534
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x30], 9
mov eax, 0x5c
mov word [rsp + 0x44], ax
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x44]
mov r8d, dword [rbx - 0x10]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.14000bc70
nop
mov rbx, qword [rsp + 0x78]
lea r12, [rbx - 0x18]
mov rcx, qword [r12]
test rcx, rcx
je 0x14000a0a7
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14000a0b8
call fcn.1400315f4
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14000a4fd
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x30], 0x19
mov r9, qword [r15]
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.14000bc70
mov rdx, qword [rbp - 0x80]
lea rbx, [rdx - 0x18]
mov r15, qword [rsp + 0x38]
add r15, 0xffffffffffffffe8
cmp rbx, r15
je 0x14000a15a
cmp dword [r15 + 0x10], 0
jl 0x14000a14c
mov rax, qword [r15]
cmp qword [rbx], rax
jne 0x14000a14c
mov rcx, rbx
call fcn.14000c170
mov qword [rbp - 0x78], rax
mov ecx, edi
lock xadd dword [r15 + 0x10], ecx
sub ecx, 1
jg 0x14000a141
mov rcx, qword [r15]
mov r8, qword [rcx]
mov rdx, r15
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, qword [rbp - 0x78]
add rax, 0x18
mov qword [rsp + 0x38], rax
jmp 0x14000a15a
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.1400081d0
mov dword [rsp + 0x30], 9
mov eax, edi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x14000a17b
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [r12 + 0x10], eax
sub eax, 1
jg 0x14000a197
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000a1b4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x80
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [rbx - 8], 1
jle 0x14000a20c
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140007f90
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rbp - 0x68]
cmp dword [rcx], 1
je 0x14000a301
mov dword [0x14038a840], 0x80000
mov r12, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000a247
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x14000a260
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000a27f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000a29c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000a2ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r12]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14000a2d5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rbp + 0x9f0]
xor rcx, rsp
call fcn.1401b1a60
mov rbx, qword [rsp + 0xb40]
add rsp, 0xb00
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8, rbx
mov edx, dword [rsp + 0x50]
mov rcx, qword [rcx + 8]
call fcn.140029680
mov dword [0x14038a840], eax
test eax, eax
jne 0x14000a223
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x1f0]
call fcn.1401b5d40
cmp dword [rbx - 8], 1
jle 0x14000a356
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140007f90
mov rbx, qword [rsp + 0x38]
lea rdx, [rbp + 0x1f0]
mov rcx, rbx
call fcn.1400213e0
mov r8d, 2
mov rdx, qword [rsp + 0x48]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x14000a420
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000a3a0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x14000a3b9
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000a3d8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000a3f5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000a413
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx]
jmp 0x14000a2be
mov r8d, 2
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, 1
mov ebx, 0
sete bl
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000a463
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x14000a47c
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000a49b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000a4b8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000a4d6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14000a4f6
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
jmp 0x14000a2d7
mov ecx, 0x80004005
call fcn.1400081b0
nop
mov ecx, 0x80070057
call fcn.1400081b0
int3
mov ecx, 0x80004005
call fcn.1400081b0
nop
mov ecx, 0x80004005
call fcn.1400081b0
nop
mov ecx, 0x80004005
call fcn.1400081b0
nop
mov ecx, 0x80004005
call fcn.1400081b0
int3