Function at 0x14000a9c0
Capabilities:
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa00]
sub rsp, 0xb00
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rsp + 0xb40], rbx
mov rax, qword [0x1402ac7a8]
xor rax, rsp
mov qword [rbp + 0x9f0], rax
mov r13, r8
mov r14, rdx
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x50], r8
mov r12, qword [rbp + 0xa60]
mov qword [rsp + 0x60], r12
mov qword [rbp - 0x48], r12
xor ebx, ebx
mov dword [rsp + 0x30], ebx
xor edx, edx
mov r8d, 0x230
lea rcx, [rbp - 0x40]
call fcn.1401bcf00
mov dword [rsp + 0x50], ebx
mov rax, qword [r13]
mov edx, dword [rax - 0x10]
test edx, edx
js 0x14000b168
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edx
or eax, ecx
jge 0x14000aa5d
mov rcx, r13
call fcn.140008c00
mov r15, qword [r13]
call fcn.140036ad4
mov rcx, rax
test rax, rax
je 0x14000b173
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov edx, 0x5c
mov rcx, qword [r14]
call fcn.1401bc0d0
mov edi, 0xffffffff
test rax, rax
jne 0x14000aa9c
mov eax, edi
jmp 0x14000aaa2
sub rax, qword [r14]
sar rax, 1
test eax, eax
cmovns ebx, eax
mov rcx, qword [r14]
cmp ebx, dword [rcx - 0x10]
jl 0x14000aac3
add rcx, 0xffffffffffffffe8
call fcn.14000cdd0
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
jmp 0x14000aafd
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x14000aad7
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x14000aae5
call fcn.140036ad4
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov r9, rax
mov r8d, ebx
mov rdx, qword [r14]
lea rcx, [rsp + 0x70]
call fcn.14000c830
mov rbx, qword [rsp + 0x70]
mov dword [rsp + 0x30], 1
call fcn.140036ad4
mov rcx, rax
test rax, rax
je 0x14000b17e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, str.OldExecutable.bak
lea rcx, [rsp + 0x58]
cmp rdx, 0x10000
jae 0x14000ab44
movzx edx, dx
call fcn.140008900
jmp 0x14000ab50
mov r8d, 0x11
call fcn.140008d30
nop
lea rsi, [rbx - 0x18]
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000ab6a
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14000ab7b
call fcn.140036ad4
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14000b189
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x30], 3
mov eax, 0x5c
mov word [rsp + 0x40], ax
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x40]
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14000c8d0
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.14000c610
nop
mov dword [rsp + 0x30], 1
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000abff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000ac1d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, r15
call fcn.14002eff0
mov qword [rbp - 0x68], rax
test rax, rax
je 0x14000ae88
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x50]
lea rdx, [0x140264e30]
mov rcx, rax
call fcn.14002f190
test eax, eax
jne 0x14000ae88
lea rdx, str.Moss.fut
lea rcx, [rbp - 0x70]
call fcn.140008e50
mov r15, rax
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000ac8b
mov rdx, qword [rcx]
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
jne 0x14000ac9c
call fcn.140036ad4
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14000b194
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x30], 9
mov eax, 0x5c
mov word [rsp + 0x44], ax
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x44]
mov r8d, dword [rbx - 0x10]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.14000c8d0
nop
mov rbx, qword [rsp + 0x78]
lea r12, [rbx - 0x18]
mov rcx, qword [r12]
test rcx, rcx
je 0x14000ad07
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14000ad18
call fcn.140036ad4
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14000b15d
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x30], 0x19
mov r9, qword [r15]
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.14000c8d0
mov rdx, qword [rbp - 0x80]
lea rbx, [rdx - 0x18]
mov r15, qword [rsp + 0x38]
add r15, 0xffffffffffffffe8
cmp rbx, r15
je 0x14000adba
cmp dword [r15 + 0x10], 0
jl 0x14000adac
mov rax, qword [r15]
cmp qword [rbx], rax
jne 0x14000adac
mov rcx, rbx
call fcn.14000cdd0
mov qword [rbp - 0x78], rax
mov ecx, edi
lock xadd dword [r15 + 0x10], ecx
sub ecx, 1
jg 0x14000ada1
mov rcx, qword [r15]
mov r8, qword [rcx]
mov rdx, r15
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, qword [rbp - 0x78]
add rax, 0x18
mov qword [rsp + 0x38], rax
jmp 0x14000adba
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140008d30
mov dword [rsp + 0x30], 9
mov eax, edi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x14000addb
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [r12 + 0x10], eax
sub eax, 1
jg 0x14000adf7
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000ae14
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x80
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [rbx - 8], 1
jle 0x14000ae6c
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140008af0
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rbp - 0x68]
cmp dword [rcx], 1
je 0x14000af61
mov dword [0x1403aeb80], 0x80000
mov r12, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000aea7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x14000aec0
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000aedf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000aefc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000af1a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r12]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14000af35
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rbp + 0x9f0]
xor rcx, rsp
call fcn.1401b6f40
mov rbx, qword [rsp + 0xb40]
add rsp, 0xb00
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8, rbx
mov edx, dword [rsp + 0x50]
mov rcx, qword [rcx + 8]
call fcn.14002eb60
mov dword [0x1403aeb80], eax
test eax, eax
jne 0x14000ae83
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x1f0]
call fcn.1401bcf00
cmp dword [rbx - 8], 1
jle 0x14000afb6
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140008af0
mov rbx, qword [rsp + 0x38]
lea rdx, [rbp + 0x1f0]
mov rcx, rbx
call fcn.140025240
mov r8d, 2
mov rdx, qword [rsp + 0x48]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x14000b080
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b000
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x14000b019
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b038
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b055
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b073
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx]
jmp 0x14000af1e
mov r8d, 2
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, 1
mov ebx, 0
sete bl
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b0c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x14000b0dc
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b0fb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b118
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b136
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14000b156
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
jmp 0x14000af37
mov ecx, 0x80004005
call fcn.140008d10
nop
mov ecx, 0x80070057
call fcn.140008d10
int3
mov ecx, 0x80004005
call fcn.140008d10
nop
mov ecx, 0x80004005
call fcn.140008d10
nop
mov ecx, 0x80004005
call fcn.140008d10
nop
mov ecx, 0x80004005
call fcn.140008d10
int3