Function at 0x180036520
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x130
mov qword [rsp + 0xd0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov rbx, rcx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18003656c
mov eax, 1
jmp 0x180036b50
lea rdx, str.AppData
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180036b4b
lea rdx, str.Application_Data
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180036b4b
lea rdx, [0x1800d0ce0]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180036b4b
lea rdx, [0x1800d0c3c]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180036b4b
mov rcx, rbx
call fcn.1800504b4
mov rsi, rax
lea rcx, [rsp + 0x20]
call fcn.180033be0
movsxd rdx, dword [rsp + 0x24]
cmp rsi, rdx
jbe 0x1800365f9
mov eax, 2
jmp 0x180036b50
movsxd rax, dword [rsp + 0x20]
test eax, eax
je 0x180036611
cmp rsi, rax
jae 0x180036611
mov eax, 2
jmp 0x180036b50
mov rcx, rbx
call fcn.180034cc0
test al, al
jne 0x180036627
mov eax, 3
jmp 0x180036b50
mov qword [rsp + 0x120], socket
xor ebp, ebp
mov qword [rsp + 0x118], rbp
mov byte [rsp + 0x108], bpl
lea r8, [rsp + 0x100]
mov rdx, rbx
lea rcx, [rsp + 0xd8]
call fcn.1800351d0
nop
cmp qword [rsp + 0xf0], rbp
jne 0x1800366be
cmp qword [rsp + 0xf8], 8
jb 0x180036680
mov rcx, qword [rsp + 0xe0]
call fcn.18009a864
mov qword [rsp + 0xf8], 7
mov qword [rsp + 0xf0], rbp
mov word [rsp + 0xe0], bp
cmp qword [rsp + 0x120], 0x10
jb 0x1800366b4
mov rcx, qword [rsp + 0x108]
call fcn.18009a864
mov eax, 5
jmp 0x180036b50
lea rcx, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 8
cmovae rcx, qword [rsp + 0xe0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180036738
cmp qword [rsp + 0xf8], 8
jb 0x1800366fa
mov rcx, qword [rsp + 0xe0]
call fcn.18009a864
mov qword [rsp + 0xf8], 7
mov qword [rsp + 0xf0], rbp
mov word [rsp + 0xe0], bp
cmp qword [rsp + 0x120], 0x10
jb 0x18003672e
mov rcx, qword [rsp + 0x108]
call fcn.18009a864
mov eax, 7
jmp 0x180036b50
lea rcx, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 8
cmovae rcx, qword [rsp + 0xe0]
xor edx, edx
call fcn.180050354
lea rdx, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 8
cmovae rdx, qword [rsp + 0xe0]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1800367fa
lea rcx, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 8
cmovae rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
cmp qword [rsp + 0xf8], 8
jb 0x1800367bc
mov rcx, qword [rsp + 0xe0]
call fcn.18009a864
mov qword [rsp + 0xf8], 7
mov qword [rsp + 0xf0], rbp
mov word [rsp + 0xe0], bp
cmp qword [rsp + 0x120], 0x10
jb 0x1800367f0
mov rcx, qword [rsp + 0x108]
call fcn.18009a864
mov eax, 4
jmp 0x180036b50
mov rcx, rbx
call fcn.1800361b0
movsxd rdx, dword [rsp + 0x28]
cmp rsi, rdx
jae 0x18003682e
lea rdx, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 8
cmovae rdx, qword [rsp + 0xe0]
mov rcx, rbx
call fcn.180036b80
lea rcx, str.RecordBackupLog
call fcn.180003e10
test al, al
je 0x180036afb
and dword [rsp + 0x88], 0xfffffe00
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0xa0], rbp
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbp
mov word [rsp + 0x38], bp
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.18000f510
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.180001590
nop
mov rdx, rax
lea rcx, [rsp + 0xa8]
call fcn.18006601c
mov rdi, rax
lea r8, [0x1800d1621]
lea rdx, str.file_path
lea rcx, [rsp + 0x80]
call fcn.1800671b4
mov rcx, rax
mov rdx, rdi
call fcn.1800662a8
nop
cmp qword [rsp + 0x78], 0x10
jb 0x180036902
mov rcx, qword [rsp + 0x60]
call fcn.18009a864
mov qword [rsp + 0x78], socket
mov qword [rsp + 0x70], rbp
mov byte [rsp + 0x60], 0
cmp qword [rsp + 0x50], 8
jb 0x180036927
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.180051c14
nop
mov rdx, rax
lea rcx, [rsp + 0xa8]
call fcn.18006601c
mov rdi, rax
lea r8, [0x1800d0de1]
lea rdx, str.file_size
lea rcx, [rsp + 0x80]
call fcn.1800671b4
mov rcx, rax
mov rdx, rdi
call fcn.1800662a8
nop
cmp qword [rsp + 0x78], 0x10
jb 0x18003698e
mov rcx, qword [rsp + 0x60]
call fcn.18009a864
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x38], 4
bts dword [rsp + 0x38], 8
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rbp
lea rcx, [rsp + 0x108]
cmp qword [rsp + 0x120], 0x10
cmovae rcx, qword [rsp + 0x108]
mov edx, dword [rsp + 0x118]
call fcn.18006587c
mov qword [rsp + 0x30], rax
lea r8, [0x1800d1631]
lea rdx, str.data_time
lea rcx, [rsp + 0x80]
call fcn.1800671b4
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.1800662a8
lea rdx, [rsp + 0xa8]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbp
mov word [rsp + 0x38], bp
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x1800d1a98]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x1800d1a98]
lea rcx, [rsp + 0x30]
call fcn.18000f510
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.180001590
nop
mov rdx, rax
lea rcx, [rsp + 0xa8]
call fcn.18006601c
mov rdi, rax
lea r8, [0x1800d163a]
lea rdx, str.reason
lea rcx, [rsp + 0x80]
call fcn.1800671b4
mov rcx, rax
mov rdx, rdi
call fcn.1800662a8
nop
cmp qword [rsp + 0x78], 0x10
jb 0x180036aaa
mov rcx, qword [rsp + 0x60]
call fcn.18009a864
mov qword [rsp + 0x78], socket
mov qword [rsp + 0x70], rbp
mov byte [rsp + 0x60], 0
cmp qword [rsp + 0x50], 8
jb 0x180036acf
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x80]
lea rcx, str.t_backup_log
call fcn.18005e04c
nop
lea rcx, [rsp + 0x80]
call fcn.180066210
nop
cmp qword [rsp + 0xf8], 8
jb 0x180036b13
mov rcx, qword [rsp + 0xe0]
call fcn.18009a864
mov qword [rsp + 0xf8], 7
mov qword [rsp + 0xf0], rbp
mov word [rsp + 0xe0], bp
cmp qword [rsp + 0x120], 0x10
jb 0x180036b47
mov rcx, qword [rsp + 0x108]
call fcn.18009a864
xor eax, eax
jmp 0x180036b50
mov eax, 6
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.180099fe0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret