Function at 0x140017a8c
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1000]
mov eax, 0x1100
call fcn.14001b620
sub rsp, rax
mov rax, qword [0x140023128]
xor rax, rsp
mov qword [rbp + 0xff0], rax
mov r14, r8
mov r13, rdx
mov qword [rsp + 0x58], rdx
mov rdi, rcx
lea rdx, [rsp + 0x68]
call fcn.140018c04
mov rbx, rax
lea rdx, [rsp + 0x60]
mov rcx, r13
call fcn.1400160ec
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400121c0
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
or rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
xor ebx, ebx
test eax, eax
jg 0x140017b33
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [0x14001d898]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140017b63
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [0x14001d898]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.140018aac
nop
mov dword [rsp + 0x30], ebx
mov r12d, ebx
mov dword [rsp + 0x40], ebx
test dword [rdi + 0x70], 0x400
je 0x140017c0b
mov r9d, dword [r14 + 0x18]
mov r8d, dword [r14 + 0x14]
mov rdx, r13
mov rcx, rdi
call fcn.140018780
xor r13d, r13d
test eax, eax
jne 0x140017c0e
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140017bd4
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [0x14001d898]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140017c04
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [0x14001d898]
xor eax, eax
jmp 0x140018163
xor r13d, r13d
mov ebx, dword [r14 + 0x10]
mov rcx, qword [rsp + 0x38]
add rcx, 0xffffffffffffffe8
call fcn.140002a04
lea rsi, [rax + 0x18]
mov rcx, rsi
test ebx, ebx
je 0x140017c38
mov r15d, dword [rdi + 0x70]
and r15d, 0x3127
jmp 0x140017c61
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
mov r15d, eax
cmp eax, 0xffffffff
jne 0x140017c51
mov r15d, r13d
jmp 0x140017c73
and r15d, 0x3127
test r15b, 7
je 0x140017c73
mov rcx, rsi
mov edx, r15d
and edx, 0xfffffff8
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop dword [rax + rax]
lea rdx, [rsi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140017c9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [0x14001d898]
mov ebx, 0x4000
mov esi, r13d
mov r8d, dword [0x140024678]
test r8d, r8d
je 0x140017cdf
test dword [rdi + 0x70], ebx
je 0x140017cdf
mov r9d, dword [r14]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call fcn.140018270
test eax, eax
je 0x140018029
mov r12d, 1
jmp 0x140018072
mov edx, dword [r14 + 4]
test edx, edx
jne 0x140017cf6
cmp dword [r14 + 8], r13d
je 0x140017cf6
test dword [rdi + 0x70], ebx
je 0x140017fdb
mov ecx, r13d
cmp dword [0x1400246c8], r13d
jne 0x140017d11
mov eax, 0x2000000
cmp dword [0x140024600], r13d
cmove ecx, eax
mov eax, ecx
or eax, 8
cmp dword [r14 + 0xc], r13d
cmove eax, ecx
mov ecx, eax
or ecx, 2
test edx, edx
cmove ecx, eax
cmp dword [0x140024628], r13d
je 0x140017d34
bts ecx, 0xc
cmp dword [0x1400245c8], r13d
je 0x140017d41
bts ecx, 0x12
cmp dword [0x140024680], r13d
je 0x140017d4e
bts ecx, 0xb
cmp dword [0x1400245cc], r13d
je 0x140017d5b
bts ecx, 0x1c
mov ebx, ecx
bts ebx, 0xf
cmp dword [r14 + 0x1c], r13d
cmove ebx, ecx
test r8d, r8d
jne 0x1400181a0
cmp dword [0x1400246bc], r13d
je 0x140017e9f
cmp byte [0x1400231e0], r13b
je 0x140017e9f
mov dword [rsp + 0x50], r13d
test byte [rdi + 0x70], 0x10
je 0x140017d9c
or r13, 0xffffffffffffffff
jmp 0x140017da3
mov r13, qword [rdi + 0x88]
xor ecx, ecx
mov r12b, cl
jmp 0x140017e6e
mov r12b, r8b
cmp byte [0x1400231e0], r8b
je 0x140017e7e
mov rax, r8
mov rcx, qword [0x1400231c8]
mov rdx, qword [0x1400231e8]
cmp rcx, rdx
jbe 0x140017dd9
mov rax, rcx
sub rax, rdx
cmp r13, rax
jbe 0x140017e7e
mov r12b, 1
test rax, rax
jne 0x140017e7e
mov word [rbp - 0x10], r8w
mov r9d, 0x100
lea r8, [rbp - 0x10]
lea edx, [r9 - 0x21]
mov rcx, qword [0x140023f08]
call qword [sym.imp.USER32.dll_LoadStringW]
nop dword [rax + rax]
mov r9, qword [0x1400231c8]
mov r8d, dword [rsp + 0x50]
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x7f0]
call fcn.140008cec
lea rdx, [rbp + 0x7f0]
call fcn.14000f8d8
mov rcx, qword [0x140024128]
call qword [sym.imp.msvcrt.dll_fflush]
nop dword [rax + rax]
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov edx, eax
mov ecx, dword [r14 + 0x18]
call fcn.14000ba44
xor ecx, ecx
test eax, eax
je 0x14001825f
call fcn.14000b8b8
xor r8d, r8d
test eax, eax
jns 0x140017dad
bts ebx, 0x1b
mov byte [rdi + 0x90], 1
test r12b, r12b
je 0x140017e99
bts ebx, 0x1a
mov byte [rdi + 0x91], 1
mov r13d, 1
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x78]
call sub.msvcrt.dll_memset
mov edx, dword [0x1400243d4]
mov eax, dword [0x1400243d0]
xor r8d, r8d
test eax, eax
jne 0x140017ec5
test edx, edx
je 0x140017f0e
test byte [rdi + 0x70], 0x10
je 0x140017ed1
or rcx, 0xffffffffffffffff
jmp 0x140017ed8
mov rcx, qword [rdi + 0x88]
cmp rcx, qword [0x1400243d8]
jb 0x140017f0e
test eax, eax
je 0x140017efc
mov ecx, 0x1000
cmp eax, ecx
jae 0x140017ef2
mov eax, ecx
jmp 0x140017efc
mov ecx, 0x40000000
cmp eax, ecx
cmova eax, ecx
mov dword [rbp - 0x80], WSACleanup
mov dword [rbp - 0x5c], eax
mov dword [rbp - 0x58], edx
mov r12b, 1
jmp 0x140017f18
mov dword [rbp - 0x80], 0x20
mov r12b, r8b
mov dword [rbp - 0x7c], ebx
cmp dword [r14], r8d
jne 0x140017f25
test r13d, r13d
je 0x140017f34
lea rax, [0x14000a1c0]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdi
lea r8, [rbp - 0x80]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CopyFile2]
nop dword [rax + rax]
mov ecx, eax
xor r8d, r8d
cmp eax, 0x80070057
jne 0x140017f73
test r12b, r12b
je 0x140017fcb
mov edx, r8d
mov dword [0x1400243d4], edx
mov eax, r8d
mov dword [0x1400243d0], eax
jmp 0x140017f84
test r12b, r12b
je 0x140017f90
mov edx, dword [0x1400243d4]
mov eax, dword [0x1400243d0]
cmp ecx, 0x80070057
je 0x140017ebd
xor r13d, r13d
test ecx, ecx
jns 0x140017cd4
mov eax, ecx
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x140017fd1
cmp ecx, 0x800704d3
jne 0x140017fce
cmp byte [rdi + 0x98], r13b
je 0x140017fc0
mov ecx, dword [rdi + 0x94]
movzx esi, cx
mov r12d, r13d
jmp 0x140018072
xor r13d, r13d
movzx esi, cx
mov ebx, 0x4000
mov r12d, dword [rsp + 0x40]
cmp dword [r14 + 8], r13d
je 0x140018029
test dword [rdi + 0x70], ebx
jne 0x140018029
test byte [rdi + 0x70], 0x10
je 0x140017ff2
or rax, 0xffffffffffffffff
jmp 0x140017ff9
mov rax, qword [rdi + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, dword [r14]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call fcn.1400174dc
test eax, eax
jne 0x140017cd4
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
cmp esi, 0x7b
jne 0x140018041
test dword [rdi + 0x70], ebx
jmp 0x140018044
cmp esi, 2
mov edx, dword [r14 + 0x14]
mov rcx, rdi
je 0x14001818e
inc r12d
mov dword [rsp + 0x40], r12d
mov r9d, r12d
mov r8d, dword [r14 + 0x18]
call fcn.14000a788
test eax, eax
jne 0x140017ca3
mov r12d, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
add rcx, 0xffffffffffffffe8
call fcn.140002a04
lea rdi, [rax + 0x18]
test r15b, 7
je 0x1400180b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov edx, r15d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
lea rdx, [rdi - 0x18]
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1400180e7
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [0x14001d898]
test r12d, r12d
jne 0x1400180ff
test esi, esi
je 0x1400180ff
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140018130
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [0x14001d898]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov ecx, ebx
lock xadd dword [rdx + 0x10], ecx
add ecx, ebx
test ecx, ecx
jg 0x140018160
mov rcx, qword [rdx]
mov r8, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [r8 + 8]
call qword [0x14001d898]
mov eax, r12d
mov rcx, qword [rbp + 0xff0]
xor rcx, rsp
call fcn.140001800
mov rbx, qword [rsp + 0x1158]
add rsp, 0x1100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r9d, [r12 + 1]
xor r8d, r8d
call fcn.14000a788
jmp 0x14001806d
mov edx, 0x80
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
or r9d, 0xffffffff
mov r8d, dword [r14 + 0x14]
mov rdx, qword [rsp + 0x58]
mov rcx, rdi
call fcn.140018780
test eax, eax
jne 0x1400181f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
jmp 0x14001806d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_DecryptFileW]
nop dword [rax + rax]
test eax, eax
jne 0x14001821a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
jmp 0x140018249
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14001820a
bt eax, 0xe
jae 0x140018249
mov esi, 0x1771
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
jmp 0x14001806d
mov r12d, ecx
jmp 0x140018072