Function at 0x1400eb2d0
Capabilities:
Copy file
Delete file
Get file attributes
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, r8
mov rax, qword [0x14039de68]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x38]
mov r8b, 1
mov r9b, 1
call fcn.1400ea4a0
lea rcx, [rsp + 0x30]
mov rdx, rsi
mov r8b, 1
xor r9d, r9d
call fcn.1400ea4a0
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, 0x410
je 0x1400eb341
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x1400eb60a
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call fcn.14026e13c
lea rdx, [rsi + rax*2]
mov ecx, 2
xor r14d, r14d
nop word [rax + rax]
lea r8, [rax + r14]
dec r8
js 0x1400eb4d4
movzx r8d, word [rdx + r14*2 - 2]
dec r14
add rcx, 0xfffffffffffffffe
cmp r8d, 0x5c
je 0x1400eb386
cmp r8d, 0x2f
jne 0x1400eb360
lea r12, [rcx + rax*2]
add r14, rax
mov rax, r14
inc rax
mov r15, 0xffffffffffffffff
cmovs r12, r15
mov rcx, r12
call fcn.1402599b0
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call fcn.14025d290
mov rcx, rbx
mov rdx, rsi
mov r8, r14
call fcn.140279134
mov dword [rsp + 0x44], 0
lea rdx, [rsp + 0x44]
mov ecx, 4
call fcn.1400e09f0
test al, al
je 0x1400eb4a2
mov rcx, rbx
call fcn.14026e13c
mov r12, rax
lea rax, [rax*2 + 0x12]
add r12, 9
cmovns r15, rax
mov rcx, r15
call fcn.1402599b0
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14025d290
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x20], eax
lea r8, [0x1402c5da0]
mov rcx, r14
mov rdx, r12
mov r9, rbx
call fcn.1400ec250
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
je 0x1400eb49a
mov rcx, rbx
call fcn.1402599a8
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1402731cc
test eax, eax
jne 0x1400eb5d5
movzx eax, word [rsp + 0x56]
and eax, 0xf000
cmp eax, 0x8000
jne 0x1400eb5ca
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400eb5d5
mov rcx, r14
call fcn.1402599a8
lea rcx, [rsp + 0x50]
call qword [sym.imp.RPCRT4.dll_UuidCreateSequential]
cmp eax, 0x720
je 0x1400eb4b8
test eax, eax
jne 0x1400eb4cc
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x48]
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
je 0x1400eb502
mov rcx, rbx
call fcn.1402599a8
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
setne sil
jmp 0x1400eb60a
mov r15, qword [rsp + 0x48]
test r15, r15
je 0x1400eb4cc
mov rcx, rbx
call fcn.14026e13c
mov r14, rax
mov rcx, r15
call fcn.14026e13c
lea rcx, [r14 + rax]
lea r12, [r14 + rax]
inc r12
lea rax, [rcx*2 + 2]
test r12, r12
mov r13, 0xffffffffffffffff
cmovns r13, rax
mov rcx, r13
call fcn.1402599b0
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call fcn.14025d290
mov qword [rsp + 0x20], r15
lea r8, str._s_s
mov rcx, r14
mov rdx, r12
mov r9, rbx
call fcn.1400ec250
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
jne 0x1400eb5a4
mov rcx, r14
call fcn.1402599a8
xor r14d, r14d
mov qword [rsp + 0x50], r15
lea rcx, [rsp + 0x50]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov rcx, rbx
call fcn.1402599a8
test r14, r14
jne 0x1400eb462
jmp 0x1400eb4d4
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r14
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne sil
jne 0x1400eb602
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r14
call fcn.1402599a8
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400eb619
call fcn.1402599a8
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400eb628
call fcn.1402599a8
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140259980
mov eax, esi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret