Function at 0x1400070f0
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Get windows directory from kuser_shared_data
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x750]
sub rsp, 0x850
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x740], rax
mov esi, dword [0x14000d8dc]
lea rax, [rbp + 0x330]
mov edx, 0x7ffe0030
xor r14d, r14d
cmp rax, rdx
je 0x140007174
movzx ecx, word [rdx]
lea rax, [rbp + 0x330]
test cx, cx
je 0x140007170
lea r8, [rbp + 0x330]
sub rdx, r8
nop dword [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140007160
mov word [rax], r14w
lea rax, [rbp + 0x330]
cmp word [rbp + 0x330], r14w
je 0x14000718f
add rax, 2
cmp word [rax], r14w
jne 0x140007185
lea rdx, str._system32_
mov ecx, 0x5c
sub rdx, rax
nop
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400071a0
mov word [rax], r14w
lea rbx, [rbp + 0x330]
movzx ecx, word [rbp + 0x330]
test cx, cx
je 0x1400071da
nop word [rax + rax]
add rbx, 2
cmp word [rbx], r14w
jne 0x1400071d0
lea rax, [rbp + 0x330]
sub rbx, rax
lea rax, [rbp + 0x330]
sar rbx, 1
test cx, cx
je 0x1400071fd
add rax, 2
cmp word [rax], r14w
jne 0x1400071f3
mov edx, 0x6e
lea r8, str.ntoskrnl.exe
movzx ecx, dx
sub r8, rax
nop
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [r8 + rax]
test cx, cx
jne 0x140007210
movzx ecx, word [0x14000d980]
mov word [rax], r14w
lea rax, [rsp + 0x20]
test cx, cx
je 0x140007261
lea r8, [0x14000d980]
lea r9, [rsp + 0x20]
sub r8, r9
nop word [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [r8 + rax]
test cx, cx
jne 0x140007250
mov word [rax], r14w
lea rdi, [rsp + 0x20]
movzx ecx, word [rsp + 0x20]
test cx, cx
je 0x14000727e
add rdi, 2
cmp word [rdi], r14w
jne 0x140007274
lea rax, [rsp + 0x20]
sub rdi, rax
lea rax, [rsp + 0x20]
sar rdi, 1
test cx, cx
je 0x14000729d
add rax, 2
cmp word [rax], r14w
jne 0x140007293
lea rcx, str.ntkrnlmp.exe
sub rcx, rax
nop word [rax + rax]
mov word [rax], dx
lea rax, [rax + 2]
movzx edx, word [rcx + rax]
test dx, dx
jne 0x1400072b0
lea rcx, [rsp + 0x20]
mov word [rax], r14w
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400072ef
mov edx, 0x80
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x330]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000744a
lea rcx, [rbp + 0x330]
lea rcx, [rcx + rbx*2]
test esi, esi
je 0x140007392
test rcx, rcx
je 0x140007354
lea rdx, str.winload.efi
cmp rcx, rdx
je 0x140007354
mov eax, 0x77
sub rdx, rcx
nop dword [rax]
nop dword [rax + rax]
mov word [rcx], ax
lea rcx, [rcx + 2]
movzx eax, word [rdx + rcx]
test ax, ax
jne 0x140007340
mov word [rcx], r14w
lea rcx, [rsp + 0x20]
lea rcx, [rcx + rdi*2]
test rcx, rcx
je 0x140007405
lea rdx, str.osloader.efi
cmp rcx, rdx
je 0x140007405
mov eax, 0x6f
sub rdx, rcx
nop
mov word [rcx], ax
lea rcx, [rcx + 2]
movzx eax, word [rdx + rcx]
test ax, ax
jne 0x140007380
jmp 0x140007401
test rcx, rcx
je 0x1400073c4
lea rdx, str.winload.exe
cmp rcx, rdx
je 0x1400073c4
mov eax, 0x77
sub rdx, rcx
nop dword [rax + rax]
mov word [rcx], ax
lea rcx, [rcx + 2]
movzx eax, word [rdx + rcx]
test ax, ax
jne 0x1400073b0
mov word [rcx], r14w
lea rcx, [rsp + 0x20]
lea rcx, [rcx + rdi*2]
test rcx, rcx
je 0x140007405
lea r8, str.osloader.exe
cmp rcx, r8
je 0x140007405
mov eax, 0x6f
sub r8, rcx
nop word [rax + rax]
mov word [rcx], ax
lea rcx, [rcx + 2]
movzx eax, word [r8 + rcx]
test ax, ax
jne 0x1400073f0
mov word [rcx], r14w
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140007430
mov edx, 0x80
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x330]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne al
mov rcx, qword [rbp + 0x740]
xor rcx, rsp
call fcn.1400081d0
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret