Function at 0x140004c10
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path
Get file attributes
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x630]
sub rsp, 0x730
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rbp + 0x620], rax
xor esi, esi
mov qword [rsp + 0x50], rdx
mov rdi, rcx
mov qword [rsp + 0x78], rsi
xor ecx, ecx
mov qword [rsp + 0x60], rsi
mov rax, rdx
mov qword [rbp - 0x70], rcx
xorps xmm0, xmm0
mov dword [rsp + 0x6c], esi
mov rcx, rax
mov dword [rsp + 0x68], esi
xor r9d, r9d
mov dword [rsp + 0x70], esi
lea r8, [rbp + 0x200]
mov edx, 0x104
movups xmmword [rbp - 0x80], xmm0
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFullPathNameW]
nop dword [rax + rax]
dec eax
cmp eax, 0x103
jbe 0x140004d35
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x140004d14
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140004d14
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140004d14
mov dword [rsp + 0x40], eax
lea rdx, [0x140008e66]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov dword [rsp + 0x44], 0x96
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.140001008
test edi, edi
jne 0x140004d22
mov ebx, 0x8000ffff
jmp 0x14000568d
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x14000568d
or ebx, 0xffffffff
lea rcx, [rbp + 0x200]
mov qword [rsp + 0x50], rcx
test rdi, rdi
je 0x140004dd9
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov dword [rsp + 0x58], eax
cmp eax, ebx
jne 0x140004dd4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x140004d14
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140004d14
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140004d14
mov dword [rsp + 0x44], eax
lea rdx, [0x140008e66]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov dword [rsp + 0x40], 0x9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
jmp 0x140004d00
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov dword [rsp + 0x58], eax
cmp eax, ebx
jne 0x140004e65
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x140004d14
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140004d14
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140004d14
mov dword [rsp + 0x44], eax
lea rdx, [0x140008e66]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov dword [rsp + 0x40], 0xa1
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
jmp 0x140004d00
test al, 0x10
je 0x140004ee4
cmp dword [section..data], 2
jbe 0x140004eda
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140004eda
mov rax, qword [0x14000b018]
and rax, r8
cmp rax, qword [0x14000b018]
jne 0x140004eda
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x48], rax
lea rdx, [0x140008e66]
lea rax, [rsp + 0x44]
mov dword [rsp + 0x40], 0xa5
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.140001008
mov eax, 0x80070002
jmp 0x14000568f
lea rax, [rsp + 0x70]
mov r14d, 1
mov qword [rbp - 0x60], rax
lea rax, [rsp + 0x68]
mov qword [rbp - 0x58], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x50], rax
lea rax, [rsp + 0x50]
mov qword [rbp - 0x48], rax
lea rax, [rsp + 0x6c]
mov qword [rbp - 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rbp - 0x38], rax
lea rax, [rsp + 0x78]
mov qword [rbp - 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rbp - 0x28], rax
mov byte [rbp - 0x20], r14b
call fcn.140004af8
mov ebx, eax
test eax, eax
jns 0x140004f8b
cmp dword [section..data], 2
jbe 0x140005684
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140005684
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140005684
mov dword [rsp + 0x40], 0xc7
lea rdx, [0x140008dd9]
jmp 0x14000515f
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, r14d
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r8d, [r9 + 0xf]
call qword [sym.imp.api_ms_win_security_provider_l1_1_0.dll_GetNamedSecurityInfoW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x140005051
cmp dword [section..data], 2
jbe 0x140005036
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140005036
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140005036
mov dword [rsp + 0x44], eax
lea rdx, [0x140008e66]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov dword [rsp + 0x40], 0xd6
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.140001008
lea rcx, [rbp - 0x60]
call fcn.1400056c0
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x14000568f
xor r9d, r9d
lea r8, [rsp + 0x60]
mov edx, r14d
lea rcx, str.O:BA
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
nop dword [rax + rax]
test eax, eax
jne 0x140005104
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x1400050f2
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x1400050f2
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x1400050f2
mov dword [rsp + 0x40], 0xdc
lea rdx, [0x140008e66]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], edi
call fcn.140001008
test edi, edi
jne 0x14000522d
mov ebx, 0x8000ffff
jmp 0x140005684
mov r8, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call fcn.140004814
mov ebx, eax
test eax, eax
jns 0x140005197
cmp dword [section..data], 2
jbe 0x140005684
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140005684
mov rax, qword [0x14000b018]
and rax, r8
cmp rax, qword [0x14000b018]
jne 0x140005684
mov dword [rsp + 0x40], 0xe1
lea rdx, [0x140008dd9]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], ebx
call fcn.140001008
jmp 0x140005684
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x6c], r14d
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
xor r9d, r9d
mov qword [rsp + 0x60], rsi
lea r8, [rsp + 0x60]
mov edx, r14d
lea rcx, str.O:BAG:BAD:_A__GA___BA_
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
nop dword [rax + rax]
test eax, eax
jne 0x140005240
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x1400050f2
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x1400050f2
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x1400050f2
mov dword [rsp + 0x40], 0xec
lea rdx, [0x140008e66]
jmp 0x1400050bf
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x140005684
mov r8, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call fcn.140004814
mov ebx, eax
test eax, eax
jns 0x1400052a0
cmp dword [section..data], 2
jbe 0x140005684
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140005684
mov rax, qword [0x14000b018]
and rax, r8
cmp rax, qword [0x14000b018]
jne 0x140005684
mov dword [rsp + 0x40], 0xf1
lea rdx, [0x140008dd9]
jmp 0x14000515f
test byte [rsp + 0x58], 3
je 0x14000531a
mov rcx, qword [rsp + 0x50]
mov edx, 0x80
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
nop dword [rax + rax]
test eax, eax
jne 0x14000531a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x1400050f2
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x1400050f2
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x1400050f2
mov dword [rsp + 0x40], 0xf5
lea rdx, [0x140008e66]
jmp 0x1400050bf
mov r8d, 0x104
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0x200]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumePathNameW]
nop dword [rax + rax]
test eax, eax
jne 0x140005397
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x1400050f2
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x1400050f2
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x1400050f2
mov dword [rsp + 0x40], 0x100
lea rdx, [0x140008e66]
jmp 0x1400050bf
lea r9, [rbp - 0x10]
mov word [rbp + 0x616], si
xor r8d, r8d
lea rdx, [0x1400088e8]
lea rcx, [rbp + 0x410]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetTempFileNameW]
nop dword [rax + rax]
test eax, eax
jne 0x14000541c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x1400050f2
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x1400050f2
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x1400050f2
mov dword [rsp + 0x40], 0x103
lea rdx, [0x140008e66]
jmp 0x1400050bf
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp - 0x10]
mov r8d, r14d
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
nop dword [rax + rax]
test eax, eax
jne 0x140005491
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x1400050f2
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x1400050f2
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x1400050f2
mov dword [rsp + 0x40], 0x108
lea rdx, [0x140008e66]
jmp 0x1400050bf
test rdi, rdi
je 0x140005636
mov rax, qword [rsp + 0x60]
lea r9, [rbp - 0x80]
mov rcx, qword [rsp + 0x50]
mov edx, 0x40000000
mov qword [rsp + 0x30], rsi
mov r8d, 3
mov dword [rsp + 0x28], 0x2000000
mov qword [rbp - 0x78], rax
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x68], r14d
mov dword [rbp - 0x80], 0x18
mov dword [rbp - 0x70], esi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
cmp rax, 0xffffffffffffffff
jne 0x140005543
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x1400050f2
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x1400050f2
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x1400050f2
mov dword [rsp + 0x40], 0x120
lea rdx, [0x140008e66]
jmp 0x1400050bf
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x400000
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_CopyFileExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400055d6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x1400050f2
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x1400050f2
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x1400050f2
mov dword [rsp + 0x40], 0x126
lea rdx, [0x140008e66]
jmp 0x1400050bf
mov r8, qword [rsp + 0x78]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x68], esi
call fcn.1400049a4
mov ebx, eax
test eax, eax
jns 0x140005636
cmp dword [section..data], 2
jbe 0x140005684
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140005684
mov rax, qword [0x14000b018]
and rax, r8
cmp rax, qword [0x14000b018]
jne 0x140005684
mov dword [rsp + 0x40], 0x12a
lea rdx, [0x140008dd9]
jmp 0x14000515f
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x14000567d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 5
je 0x140005667
cmp eax, 0x20
je 0x140005667
cmp eax, 0x4c8
jne 0x14000567d
xor edx, edx
lea rcx, [rbp - 0x10]
lea r8d, [rdx + 4]
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
nop dword [rax + rax]
mov dword [rsp + 0x70], r14d
mov ebx, esi
lea rcx, [rbp - 0x60]
call fcn.1400056c0
mov eax, ebx
mov rcx, qword [rbp + 0x620]
xor rcx, rsp
call fcn.1400073d0
lea r11, [rsp + 0x730]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret