Function at 0x1000fa088
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x470
mov rax, qword [0x100152198]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor r14d, r14d
or rdi, 0xffffffffffffffff
mov r12, r9
mov r13, r8
mov ebp, r14d
cmp r9, r14
je 0x1000fa2bf
lea rcx, [r11 - 0x248]
mov edx, 0x104
mov word [r11 - 0x248], r14w
mov word [rsp + 0x40], r14w
call fcn.1000fa324
cmp eax, r14d
mov ebx, eax
jge 0x1000fa12f
mov rcx, qword [0x100153eb8]
lea rsi, [0x100153eb8]
cmp rcx, rsi
je 0x1000fa2a9
test byte [rcx + 0x1c], 1
je 0x1000fa2a9
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0xf]
lea r8, [0x10001dba8]
mov r9d, eax
call fcn.100036510
jmp 0x1000fa2a9
lea rsi, [0x100153eb8]
lea r9, [rsp + 0x40]
lea rdx, [0x100027320]
lea rcx, [rsp + 0x250]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp eax, r14d
je 0x1000fa23d
lea rcx, [rsp + 0x40]
cmp r13, r14
je 0x1000fa1d4
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x40]
mov r8, r13
mov edx, 0x104
call fcn.10006ad10
cmp eax, r14d
jge 0x1000fa1ad
mov rcx, qword [0x100153eb8]
cmp rcx, rsi
je 0x1000fa1ad
test byte [rcx + 0x1c], 1
je 0x1000fa1ad
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dba8]
mov edx, 0xf
mov r9d, ebx
call fcn.100036510
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x40]
jmp 0x1000fa1e9
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rsp + 0x40]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1000fa25f
mov edx, 0x2080
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, r14d
jne 0x1000fa23d
mov rcx, qword [0x100153eb8]
cmp rcx, rsi
je 0x1000fa23d
test byte [rcx + 0x1c], 2
je 0x1000fa23d
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x11]
lea r8, [0x10001dba8]
call fcn.100034784
mov ecx, 0x64
inc ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp ebp, 0x32
jb 0x1000fa136
mov ebx, 0x80004005
mov eax, ebx
jmp 0x1000fa2f2
mov r8d, 0x104
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, r14d
jne 0x1000fa293
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x1000fa2ae
mov ebx, 0x80004005
jmp 0x1000fa2ae
cmp rdi, 0xffffffffffffffff
je 0x1000fa2a6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or rdi, 0xffffffffffffffff
mov ebx, r14d
cmp ebx, r14d
jge 0x1000fa258
cmp rdi, 0xffffffffffffffff
je 0x1000fa258
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000fa258
mov rcx, qword [0x100153eb8]
lea rsi, [0x100153eb8]
cmp rcx, rsi
je 0x1000fa2ed
test byte [rcx + 0x1c], 1
je 0x1000fa2ed
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dba8]
mov edx, 0xd
call fcn.100034784
mov eax, 0x80070057
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.10011be80
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret