Function at 0x140004ed4
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path
Get file attributes
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x5e0]
sub rsp, 0x6e0
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rbp + 0x5d0], rax
xor r15d, r15d
mov qword [rsp + 0x48], rdx
mov r14, rcx
mov qword [rsp + 0x70], r15
xor ecx, ecx
mov qword [rsp + 0x78], r15
mov rax, rdx
mov qword [rbp - 0x70], rcx
xorps xmm0, xmm0
mov dword [rsp + 0x64], r15d
mov rcx, rax
mov dword [rsp + 0x60], r15d
xor r9d, r9d
mov dword [rsp + 0x68], r15d
lea r8, [rbp + 0x1b0]
mov edx, 0x104
movups xmmword [rbp - 0x80], xmm0
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFullPathNameW]
nop dword [rax + rax]
dec eax
cmp eax, 0x103
jbe 0x140004ffa
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x140004fda
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x140004fda
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x140004fda
mov dword [rsp + 0x40], eax
lea rdx, [0x140009d0e]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov dword [rsp + 0x44], 0x96
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.140001008
test edi, edi
jne 0x140004fe5
mov ebx, 0x8000ffff
jmp 0x140004ff3
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
mov eax, ebx
jmp 0x1400059c8
or ebx, 0xffffffff
lea rcx, [rbp + 0x1b0]
mov qword [rsp + 0x48], rcx
test r14, r14
je 0x14000509e
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov dword [rsp + 0x50], eax
cmp eax, ebx
jne 0x140005099
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x140004fda
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x140004fda
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x140004fda
mov dword [rsp + 0x44], eax
lea rdx, [0x140009d0e]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov dword [rsp + 0x40], 0x9d
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
jmp 0x140004fc6
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov dword [rsp + 0x50], eax
cmp eax, ebx
jne 0x14000512a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x140004fda
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x140004fda
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x140004fda
mov dword [rsp + 0x44], eax
lea rdx, [0x140009d0e]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov dword [rsp + 0x40], 0xa1
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
jmp 0x140004fc6
test al, 0x10
je 0x1400051a9
cmp dword [section..data], 2
jbe 0x14000519f
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x14000519f
mov rax, qword [0x14000c018]
and rax, r8
cmp rax, qword [0x14000c018]
jne 0x14000519f
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x58], rax
lea rdx, [0x140009d0e]
lea rax, [rsp + 0x44]
mov dword [rsp + 0x40], 0xa5
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.140001008
mov eax, 0x80070002
jmp 0x1400059c8
call fcn.140004dbc
mov ebx, eax
test eax, eax
jns 0x14000529d
cmp dword [section..data], 2
jbe 0x140005225
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x140005225
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x140005225
mov dword [rsp + 0x44], eax
lea rdx, [0x140009c81]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov dword [rsp + 0x40], 0xc7
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.140001008
cmp dword [rsp + 0x68], r15d
jne 0x140005268
cmp dword [rsp + 0x60], r15d
je 0x14000524e
mov r8d, 1
mov rdx, qword [rsp + 0x48]
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
nop dword [rax + rax]
cmp dword [rsp + 0x64], r15d
je 0x140005268
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call fcn.140004c68
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000527e
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140004ff3
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
jmp 0x140004ff3
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea edi, [r9 + 1]
mov edx, edi
lea r8d, [r9 + 0xf]
call qword [sym.imp.api_ms_win_security_provider_l1_1_0.dll_GetNamedSecurityInfoW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x140005377
cmp dword [section..data], 2
jbe 0x14000534b
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x14000534b
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x14000534b
mov dword [rsp + 0x44], eax
lea rdx, [0x140009d0e]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov dword [rsp + 0x40], 0xd6
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.140001008
movzx ebx, si
or ebx, 0x80070000
test esi, esi
cmovle ebx, esi
cmp dword [rsp + 0x68], r15d
jne 0x140005268
cmp dword [rsp + 0x60], r15d
je 0x14000524e
mov r8d, edi
jmp 0x140005239
xor r9d, r9d
lea r8, [rsp + 0x78]
mov edx, edi
lea rcx, str.O:BA
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
nop dword [rax + rax]
test eax, eax
jne 0x140005429
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov esi, eax
jbe 0x140005417
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x140005417
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x140005417
mov dword [rsp + 0x40], 0xdc
lea rdx, [0x140009d0e]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], esi
call fcn.140001008
test esi, esi
jne 0x14000534b
mov ebx, 0x8000ffff
jmp 0x140005359
mov r8, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
call fcn.140004ad8
mov ebx, eax
test eax, eax
jns 0x1400054bc
cmp dword [section..data], 2
jbe 0x140005359
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x140005359
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x140005359
mov dword [rsp + 0x40], 0xe1
lea rdx, [0x140009c81]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], ebx
call fcn.140001008
jmp 0x140005359
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x64], edi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
xor r9d, r9d
mov qword [rsp + 0x78], r15
lea r8, [rsp + 0x78]
mov edx, edi
lea rcx, str.O:BAG:BAD:_A__GA___BA_
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
nop dword [rax + rax]
test eax, eax
jne 0x140005550
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov esi, eax
jbe 0x140005417
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x140005417
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x140005417
mov dword [rsp + 0x40], 0xec
lea rdx, [0x140009d0e]
jmp 0x1400053e4
mov r8, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
call fcn.140004ad8
mov ebx, eax
test eax, eax
jns 0x1400055b0
cmp dword [section..data], 2
jbe 0x140005359
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x140005359
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x140005359
mov dword [rsp + 0x40], 0xf1
lea rdx, [0x140009c81]
jmp 0x140005484
test byte [rsp + 0x50], 3
je 0x14000562a
mov rcx, qword [rsp + 0x48]
mov edx, 0x80
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
nop dword [rax + rax]
test eax, eax
jne 0x14000562a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov esi, eax
jbe 0x140005417
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x140005417
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x140005417
mov dword [rsp + 0x40], 0xf5
lea rdx, [0x140009d0e]
jmp 0x1400053e4
mov r8d, 0x104
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumePathNameW]
nop dword [rax + rax]
test eax, eax
jne 0x1400056a7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov esi, eax
jbe 0x140005417
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x140005417
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x140005417
mov dword [rsp + 0x40], 0x100
lea rdx, [0x140009d0e]
jmp 0x1400053e4
lea r9, [rbp - 0x60]
mov word [rbp + 0x5c6], r15w
xor r8d, r8d
lea rdx, [0x1400098a8]
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetTempFileNameW]
nop dword [rax + rax]
test eax, eax
jne 0x14000572d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov esi, eax
jbe 0x140005417
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x140005417
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x140005417
mov dword [rsp + 0x40], 0x103
lea rdx, [0x140009d0e]
jmp 0x1400053e4
mov rcx, qword [rsp + 0x48]
lea rdx, [rbp - 0x60]
mov r8d, edi
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400057a2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov esi, eax
jbe 0x140005417
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x140005417
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x140005417
mov dword [rsp + 0x40], 0x108
lea rdx, [0x140009d0e]
jmp 0x1400053e4
test r14, r14
je 0x14000594f
mov rax, qword [rsp + 0x78]
lea r9, [rbp - 0x80]
mov rcx, qword [rsp + 0x48]
mov edx, 0x40000000
mov qword [rsp + 0x30], r15
mov r8d, 3
mov dword [rsp + 0x28], 0x2000000
mov qword [rbp - 0x78], rax
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x60], edi
mov dword [rbp - 0x80], 0x18
mov dword [rbp - 0x70], r15d
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
cmp rax, 0xffffffffffffffff
jne 0x140005853
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov esi, eax
jbe 0x140005417
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x140005417
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x140005417
mov dword [rsp + 0x40], 0x120
lea rdx, [0x140009d0e]
jmp 0x1400053e4
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x400000
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_CopyFileExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400058e6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov esi, eax
jbe 0x140005417
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x140005417
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x140005417
mov dword [rsp + 0x40], 0x126
lea rdx, [0x140009d0e]
jmp 0x1400053e4
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x60], r15d
call fcn.140004c68
mov ebx, eax
test eax, eax
jns 0x14000594f
cmp dword [section..data], 2
jbe 0x140005359
mov r8d, 0x800
test qword [0x14000c010], r8
je 0x140005359
mov rcx, qword [0x14000c018]
and rcx, r8
cmp rcx, qword [0x14000c018]
jne 0x140005359
mov dword [rsp + 0x40], 0x12a
lea rdx, [0x140009c81]
jmp 0x140005484
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x140005996
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 5
je 0x140005980
cmp eax, 0x20
je 0x140005980
cmp eax, 0x4c8
jne 0x140005996
xor edx, edx
lea rcx, [rbp - 0x60]
lea r8d, [rdx + 4]
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x68], edi
test rcx, rcx
je 0x1400059b0
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400059c6
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
xor eax, eax
mov rcx, qword [rbp + 0x5d0]
xor rcx, rsp
call fcn.140007d00
mov rbx, qword [rsp + 0x720]
add rsp, 0x6e0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret