Function at 0x1400a4854
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
or qword [rbp - 0x31], 0xffffffffffffffff
lea r9, str.sppgenmig.dat
mov r15, rcx
lea r8, str._WINDIR_System32SPPMigration
xor r12d, r12d
lea rcx, [rbp + 0x7f]
lea rdx, [0x1403d7880]
mov qword [rbp + 0x7f], r12
mov qword [rbp - 0x39], r12
call fcn.140081d18
mov edi, eax
test eax, eax
jns 0x1400a48b2
mov ecx, eax
call fcn.140082a8c
mov r14, qword [rbp + 0x7f]
jmp 0x1400a4b99
mov r14, qword [rbp + 0x7f]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x1400a48d0
shr ebx, 4
not ebx
and ebx, 1
jmp 0x1400a48d3
mov ebx, r12d
xor ecx, ecx
call fcn.140082b34
xor ecx, ecx
call fcn.140082b34
test ebx, ebx
je 0x1400a4982
lea r8, [rbp - 0x39]
mov rcx, r14
lea rdx, [rbp + 0x6f]
call fcn.1400ab92c
mov edi, eax
test eax, eax
jns 0x1400a490b
mov ecx, eax
call fcn.140082a8c
jmp 0x1400a4b99
mov rsi, qword [0x1404517e0]
lea rdx, [0x14044d66c]
lea rcx, [0x140425c58]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x50]
call fcn.1400f6768
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
mov rbx, qword [rbp - 0x39]
call rax
mov r9d, dword [rbp + 0x6f]
lea r8, str.msft:Windows_9.0_Validation_PreviousServerProps
mov rax, rdi
mov qword [rsp + 0x20], rbx
mov edx, 1
mov rcx, rsi
call rax
mov edi, eax
test eax, eax
js 0x1400a48ff
mov ecx, 4
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0004005
call fcn.140058358
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test r14, r14
je 0x1400a49a7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r14 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140082b34
mov qword [rbp + 0x7f], r12
lea r9, str.sppmig.dat
lea r8, str._WINDIR_System32SPPMigration
lea rdx, [0x1403d7880]
lea rcx, [rbp + 0x7f]
call fcn.140081d18
mov edi, eax
test eax, eax
js 0x1400a48a2
mov r14, qword [rbp + 0x7f]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x1400a49ed
shr ebx, 4
not ebx
and ebx, 1
jmp 0x1400a4a03
lea rdx, [0x14044f828]
mov ebx, r12d
lea rcx, [0x140428010]
call fcn.1400f7eec
xor ecx, ecx
call fcn.140082b34
xor ecx, ecx
call fcn.140082b34
mov edi, r12d
test ebx, ebx
je 0x1400a4b99
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400a4b60
lea rdx, [rbp + 0x77]
mov qword [rbp - 0x31], rax
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_I_RpcBindingInqLocalClientPID]
lea rdx, [0x1404504d8]
mov edi, eax
lea rcx, [0x140438308]
call fcn.1400f7b8c
test edi, edi
je 0x1400a4aa6
mov ecx, edi
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmovns edi, eax
mov ecx, edi
jmp 0x1400a4901
call fcn.14005a934
mov edi, eax
test eax, eax
jns 0x1400a4ac6
lea rdx, [0x14045038c]
lea rcx, [0x1404308a8]
call fcn.1400f8590
jmp 0x1400a4a9f
lea rcx, [rbp - 0x29]
call fcn.140058a80
mov rcx, qword [r15]
add rcx, 8
call fcn.140077dac
mov edx, dword [rbp + 0x77]
mov r8, rbx
call fcn.1400e6d74
mov ebx, 2
test eax, eax
jns 0x1400a4b0b
mov ecx, ebx
mov qword [rsp + 0x28], r12
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov r8d, eax
mov edx, 0xc0004007
call fcn.1400583e4
mov rcx, qword [r15]
lea r8, [0x1403d70c0]
xor r9d, r9d
mov dword [rsp + 0x20], 1
lea rdx, [rbp - 0x29]
call fcn.1400e2d80
test eax, eax
jns 0x1400a4b49
mov ecx, ebx
mov qword [rsp + 0x28], r12
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov r8d, eax
mov edx, 0xc0004008
call fcn.1400583e4
mov rcx, qword [r15]
add rcx, 8
call fcn.14007ae68
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400a4b99
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400a4b71
mov edi, 0x80004005
jmp 0x1400a4b7f
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.140082a8c
lea rdx, [0x14044b160]
lea rcx, [0x14043ac18]
call fcn.1400f823c
mov ecx, edi
call fcn.140082b34
lea rcx, [rbp - 0x31]
call fcn.14007f49c
lea rcx, [rbp - 0x39]
call fcn.1400a4bf0
test r14, r14
je 0x1400a4bd3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r14 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140082b34
mov eax, edi
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret