Function at 0x14009bbd4
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
and qword [rbp + 0x7f], 0
lea r9, str.sppgenmig.dat
and qword [rbp - 0x39], 0
lea r8, str._WINDIR_System32SPPMigration
mov r12, rcx
lea rdx, [0x1403c7c90]
or r15, 0xffffffffffffffff
lea rcx, [rbp + 0x7f]
mov qword [rbp - 0x31], r15
call fcn.140078d44
mov edi, eax
test eax, eax
jns 0x14009bc34
mov ecx, eax
call fcn.140079c40
mov r14, qword [rbp + 0x7f]
jmp 0x14009bf32
mov r14, qword [rbp + 0x7f]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x14009bc65
lea rdx, [0x14043d620]
lea rcx, [0x140418290]
call fcn.1400ee940
shr ebx, 4
not ebx
and ebx, 1
jmp 0x14009bc67
xor ebx, ebx
xor ecx, ecx
call fcn.140079c60
xor ecx, ecx
call fcn.140079c60
test ebx, ebx
je 0x14009bd04
lea r8, [rbp - 0x39]
mov rcx, r14
lea rdx, [rbp + 0x6f]
call fcn.1400a2a30
mov edi, eax
test eax, eax
jns 0x14009bc9f
mov ecx, eax
call fcn.140079c40
jmp 0x14009bf32
mov rsi, qword [0x14043f590]
mov rdi, qword [rbp - 0x39]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x50]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov r9d, dword [rbp + 0x6f]
lea r8, str.msft:Windows_9.0_Validation_PreviousServerProps
mov rax, rbx
mov qword [rsp + 0x20], rdi
mov edx, 1
mov rcx, rsi
call rax
mov edi, eax
test eax, eax
js 0x14009bc93
and qword [rsp + 0x20], 0
mov ecx, 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0004005
call fcn.14005316c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test r14, r14
je 0x14009bd3d
lea rdx, [0x14043b48c]
lea rcx, [0x140415ee8]
call fcn.1400ed270
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r14 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079c60
and qword [rbp + 0x7f], 0
lea r9, str.sppmig.dat
lea r8, str._WINDIR_System32SPPMigration
lea rdx, [0x1403c7c90]
lea rcx, [rbp + 0x7f]
call fcn.140078d44
mov edi, eax
test eax, eax
jns 0x14009bd7b
lea rdx, [0x140438fc0]
lea rcx, [0x14042b0a8]
call fcn.1400eec90
mov ecx, edi
jmp 0x14009bc26
mov r14, qword [rbp + 0x7f]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x14009bd99
shr ebx, 4
not ebx
and ebx, 1
jmp 0x14009bd9b
xor ebx, ebx
xor ecx, ecx
call fcn.140079c60
xor ecx, ecx
call fcn.140079c60
xor edi, edi
test ebx, ebx
je 0x14009bf32
and qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x14009be00
lea rdx, [0x14043e2c0]
lea rcx, [0x140428718]
call fcn.1400ee5fc
mov cl, 1
jmp 0x14009be09
mov r15, rax
mov qword [rbp - 0x31], rax
xor cl, cl
xor eax, eax
test cl, cl
cmove rax, r15
test rax, rax
jne 0x14009be3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14009be27
mov edi, 0x80004005
jmp 0x14009be35
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
jmp 0x14009bc95
lea rdx, [rbp + 0x77]
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_I_RpcBindingInqLocalClientPID]
test eax, eax
je 0x14009be73
mov ecx, eax
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
mov edi, 0x80004005
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovns ecx, edi
mov edi, ecx
jmp 0x14009bc95
call fcn.1400556c8
mov edi, eax
test eax, eax
js 0x14009bc93
lea rcx, [rbp - 0x29]
call fcn.1400538a8
mov rcx, qword [r12]
add rcx, 8
call fcn.14006f734
mov edx, dword [rbp + 0x77]
lea rax, [r15 - 1]
cmp rax, 0xfffffffffffffffd
seta al
xor r8d, r8d
test al, al
cmove r8, r15
call fcn.1400de034
mov ebx, 2
test eax, eax
jns 0x14009bedb
and qword [rsp + 0x28], 0
mov ecx, ebx
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, eax
mov edx, 0xc0004007
call fcn.1400531f8
mov rcx, qword [r12]
lea r8, [0x1403c74d0]
xor r9d, r9d
mov dword [rsp + 0x20], 1
lea rdx, [rbp - 0x29]
call fcn.1400da058
test eax, eax
jns 0x14009bf1c
and qword [rsp + 0x28], 0
mov ecx, ebx
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, eax
mov edx, 0xc0004008
call fcn.1400531f8
mov rcx, qword [r12]
add rcx, 8
call fcn.14007240c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, edi
call fcn.140079c60
lea rcx, [rbp - 0x31]
call fcn.140076840
lea rdx, [0x14043e174]
lea rcx, [0x140420b78]
call fcn.1400eefd4
lea rcx, [rbp - 0x39]
call fcn.14009bf9c
test r14, r14
je 0x14009bf7f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r14 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079c60
mov eax, edi
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret