Function at 0x14009ac70
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
and qword [rbp + 0x7f], 0
lea r9, str.sppgenmig.dat
and qword [rbp - 0x39], 0
lea r8, str._WINDIR_System32SPPMigration
mov r12, rcx
lea rdx, [0x1403b5c20]
or r15, 0xffffffffffffffff
lea rcx, [rbp + 0x7f]
mov qword [rbp - 0x31], r15
call fcn.140078210
mov edi, eax
test eax, eax
jns 0x14009acd0
mov ecx, eax
call fcn.1400790f8
mov r14, qword [rbp + 0x7f]
jmp 0x14009afc8
mov r14, qword [rbp + 0x7f]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x14009ad01
lea rdx, [0x14042cb1c]
lea rcx, [0x140406450]
call fcn.1400ea158
shr ebx, 4
not ebx
and ebx, 1
jmp 0x14009ad03
xor ebx, ebx
xor ecx, ecx
call fcn.140079118
xor ecx, ecx
call fcn.140079118
test ebx, ebx
je 0x14009ad9a
lea r8, [rbp - 0x39]
mov rcx, r14
lea rdx, [rbp + 0x6f]
call fcn.1400a14b4
mov edi, eax
test eax, eax
jns 0x14009ad3b
mov ecx, eax
call fcn.1400790f8
jmp 0x14009afc8
mov rsi, qword [0x14042eb20]
mov rbx, qword [rbp - 0x39]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x50]
mov rcx, rdi
call qword [0x1403af620]
mov r9d, dword [rbp + 0x6f]
lea r8, str.msft:Windows_9.0_Validation_PreviousServerProps
mov edx, 1
mov qword [rsp + 0x20], rbx
mov rcx, rsi
call rdi
mov edi, eax
test eax, eax
js 0x14009ad2f
and qword [rsp + 0x20], 0
mov ecx, 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0004005
call fcn.140052eec
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test r14, r14
je 0x14009add3
lea rdx, [0x14042a7e8]
lea rcx, [0x140403f4c]
call fcn.1400e8a6c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r14 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079118
and qword [rbp + 0x7f], 0
lea r9, str.sppmig.dat
lea r8, str._WINDIR_System32SPPMigration
lea rdx, [0x1403b5c20]
lea rcx, [rbp + 0x7f]
call fcn.140078210
mov edi, eax
test eax, eax
jns 0x14009ae11
lea rdx, [0x1404281f0]
lea rcx, [0x14041a128]
call fcn.1400ea4ac
mov ecx, edi
jmp 0x14009acc2
mov r14, qword [rbp + 0x7f]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x14009ae2f
shr ebx, 4
not ebx
and ebx, 1
jmp 0x14009ae31
xor ebx, ebx
xor ecx, ecx
call fcn.140079118
xor ecx, ecx
call fcn.140079118
xor edi, edi
test ebx, ebx
je 0x14009afc8
and qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x14009ae96
lea rdx, [0x14042d810]
lea rcx, [0x140417588]
call fcn.1400e9e10
mov cl, 1
jmp 0x14009ae9f
mov r15, rax
mov qword [rbp - 0x31], rax
xor cl, cl
xor eax, eax
test cl, cl
cmove rax, r15
test rax, rax
jne 0x14009aed2
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14009aebd
mov edi, 0x80004005
jmp 0x14009aecb
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
jmp 0x14009ad31
lea rdx, [rbp + 0x77]
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_I_RpcBindingInqLocalClientPID]
test eax, eax
je 0x14009af09
mov ecx, eax
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
mov edi, 0x80004005
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovns ecx, edi
mov edi, ecx
jmp 0x14009ad31
call fcn.140055428
mov edi, eax
test eax, eax
js 0x14009ad2f
lea rcx, [rbp - 0x29]
call fcn.140053664
mov rcx, qword [r12]
add rcx, 8
call fcn.14006ec14
mov edx, dword [rbp + 0x77]
lea rax, [r15 - 1]
cmp rax, 0xfffffffffffffffd
seta al
xor r8d, r8d
test al, al
cmove r8, r15
call fcn.1400d98e0
mov ebx, 2
test eax, eax
jns 0x14009af71
and qword [rsp + 0x28], 0
mov ecx, ebx
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, eax
mov edx, 0xc0004007
call fcn.140052f78
mov rcx, qword [r12]
lea r8, [0x1403b5460]
xor r9d, r9d
mov dword [rsp + 0x20], 1
lea rdx, [rbp - 0x29]
call fcn.1400d5cf0
test eax, eax
jns 0x14009afb2
and qword [rsp + 0x28], 0
mov ecx, ebx
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, eax
mov edx, 0xc0004008
call fcn.140052f78
mov rcx, qword [r12]
add rcx, 8
call fcn.1400719a0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, edi
call fcn.140079118
lea rcx, [rbp - 0x31]
call fcn.140075ab4
lea rdx, [0x14042d6b4]
lea rcx, [0x14040f238]
call fcn.1400ea7f4
lea rcx, [rbp - 0x39]
call fcn.14009b030
test r14, r14
je 0x14009b015
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r14 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079118
mov eax, edi
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret