Function at 0x14000a970
Capabilities:
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa00]
sub rsp, 0xb00
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rsp + 0xb40], rbx
mov rax, qword [0x1402ad7a8]
xor rax, rsp
mov qword [rbp + 0x9f0], rax
mov r13, r8
mov r14, rdx
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x50], r8
mov r12, qword [rbp + 0xa60]
mov qword [rsp + 0x60], r12
mov qword [rbp - 0x48], r12
xor ebx, ebx
mov dword [rsp + 0x30], ebx
xor edx, edx
mov r8d, 0x230
lea rcx, [rbp - 0x40]
call fcn.1401bd260
mov dword [rsp + 0x50], ebx
mov rax, qword [r13]
mov edx, dword [rax - 0x10]
test edx, edx
js 0x14000b118
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edx
or eax, ecx
jge 0x14000aa0d
mov rcx, r13
call fcn.140008c00
mov r15, qword [r13]
call fcn.140036e34
mov rcx, rax
test rax, rax
je 0x14000b123
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov edx, 0x5c
mov rcx, qword [r14]
call fcn.1401bc430
mov edi, 0xffffffff
test rax, rax
jne 0x14000aa4c
mov eax, edi
jmp 0x14000aa52
sub rax, qword [r14]
sar rax, 1
test eax, eax
cmovns ebx, eax
mov rcx, qword [r14]
cmp ebx, dword [rcx - 0x10]
jl 0x14000aa73
add rcx, 0xffffffffffffffe8
call fcn.14000cd80
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
jmp 0x14000aaad
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x14000aa87
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x14000aa95
call fcn.140036e34
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov r9, rax
mov r8d, ebx
mov rdx, qword [r14]
lea rcx, [rsp + 0x70]
call fcn.14000c7e0
mov rbx, qword [rsp + 0x70]
mov dword [rsp + 0x30], 1
call fcn.140036e34
mov rcx, rax
test rax, rax
je 0x14000b12e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, str.OldExecutable.bak
lea rcx, [rsp + 0x58]
cmp rdx, 0x10000
jae 0x14000aaf4
movzx edx, dx
call fcn.140008900
jmp 0x14000ab00
mov r8d, 0x11
call fcn.140008d30
nop
lea rsi, [rbx - 0x18]
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000ab1a
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14000ab2b
call fcn.140036e34
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14000b139
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x30], 3
mov eax, 0x5c
mov word [rsp + 0x40], ax
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x40]
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14000c880
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.14000c5c0
nop
mov dword [rsp + 0x30], 1
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000abaf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000abcd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, r15
call fcn.14002f350
mov qword [rbp - 0x68], rax
test rax, rax
je 0x14000ae38
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x50]
lea rdx, [0x140265dc0]
mov rcx, rax
call fcn.14002f4f0
test eax, eax
jne 0x14000ae38
lea rdx, str.Moss.fut
lea rcx, [rbp - 0x70]
call fcn.140008e50
mov r15, rax
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000ac3b
mov rdx, qword [rcx]
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
jne 0x14000ac4c
call fcn.140036e34
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14000b144
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x30], 9
mov eax, 0x5c
mov word [rsp + 0x44], ax
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x44]
mov r8d, dword [rbx - 0x10]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.14000c880
nop
mov rbx, qword [rsp + 0x78]
lea r12, [rbx - 0x18]
mov rcx, qword [r12]
test rcx, rcx
je 0x14000acb7
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14000acc8
call fcn.140036e34
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14000b10d
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x30], 0x19
mov r9, qword [r15]
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.14000c880
mov rdx, qword [rbp - 0x80]
lea rbx, [rdx - 0x18]
mov r15, qword [rsp + 0x38]
add r15, 0xffffffffffffffe8
cmp rbx, r15
je 0x14000ad6a
cmp dword [r15 + 0x10], 0
jl 0x14000ad5c
mov rax, qword [r15]
cmp qword [rbx], rax
jne 0x14000ad5c
mov rcx, rbx
call fcn.14000cd80
mov qword [rbp - 0x78], rax
mov ecx, edi
lock xadd dword [r15 + 0x10], ecx
sub ecx, 1
jg 0x14000ad51
mov rcx, qword [r15]
mov r8, qword [rcx]
mov rdx, r15
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, qword [rbp - 0x78]
add rax, 0x18
mov qword [rsp + 0x38], rax
jmp 0x14000ad6a
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140008d30
mov dword [rsp + 0x30], 9
mov eax, edi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x14000ad8b
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [r12 + 0x10], eax
sub eax, 1
jg 0x14000ada7
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000adc4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x80
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [rbx - 8], 1
jle 0x14000ae1c
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140008af0
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rbp - 0x68]
cmp dword [rcx], 1
je 0x14000af11
mov dword [0x1403c0d44], 0x80000
mov r12, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000ae57
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x14000ae70
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000ae8f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000aeac
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000aeca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r12]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14000aee5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rbp + 0x9f0]
xor rcx, rsp
call fcn.1401b72a0
mov rbx, qword [rsp + 0xb40]
add rsp, 0xb00
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8, rbx
mov edx, dword [rsp + 0x50]
mov rcx, qword [rcx + 8]
call fcn.14002eec0
mov dword [0x1403c0d44], eax
test eax, eax
jne 0x14000ae33
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x1f0]
call fcn.1401bd260
cmp dword [rbx - 8], 1
jle 0x14000af66
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140008af0
mov rbx, qword [rsp + 0x38]
lea rdx, [rbp + 0x1f0]
mov rcx, rbx
call fcn.1400255a0
mov r8d, 2
mov rdx, qword [rsp + 0x48]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x14000b030
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000afb0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x14000afc9
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000afe8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b005
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b023
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx]
jmp 0x14000aece
mov r8d, 2
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, 1
mov ebx, 0
sete bl
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b073
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x14000b08c
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b0ab
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b0c8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b0e6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14000b106
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
jmp 0x14000aee7
mov ecx, 0x80004005
call fcn.140008d10
nop
mov ecx, 0x80070057
call fcn.140008d10
int3
mov ecx, 0x80004005
call fcn.140008d10
nop
mov ecx, 0x80004005
call fcn.140008d10
nop
mov ecx, 0x80004005
call fcn.140008d10
nop
mov ecx, 0x80004005
call fcn.140008d10
int3