Function at 0x1400526a0
Capabilities:
Check if file exists
Create process on windows
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push rsi
push rbx
sub rsp, 0xc8
mov rax, qword [0x1401b7cc0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
cmp byte [rcx], 0
jne 0x14005270b
mov ebx, edx
mov rsi, rcx
call fcn.1400529f0
test al, al
je 0x140052726
test bl, bl
je 0x1400526ff
mov rcx, rsi
call fcn.140050490
test al, al
je 0x1400526ff
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400b6210
mov rcx, rsi
add rsp, 0xc8
pop rbx
pop rsi
jmp fcn.140057e50
mov rcx, rsi
call fcn.14004de30
mov byte [rsi + 1], 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400b6210
nop
add rsp, 0xc8
pop rbx
pop rsi
ret
movabs rax, 0xb3344fb012cbd29e
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x70], rax
movabs rcx, 0xd255ef6ffc1f96a8
lea rax, [rcx + 0x34f0]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x78], rax
movabs rdx, 0x826f6fc27db9a0db
mov qword [rsp + 0x80], rdx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov r8, qword [rsp + 0x30]
movaps xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [r8]
movaps xmmword [rsp + 0x70], xmm0
movabs r8, 0xf10a1ce20fcccf82
mov qword [rsp + 0x80], r8
mov r8, qword [rsp + 0x80]
mov qword [rsp + 0x30], r8
movabs r8, 0xa134874f9270ffdb
mov qword [rsp + 0x80], r8
mov r8, qword [rsp + 0x80]
mov qword [rsp + 0x38], r8
movabs r8, 0x2728cef92fa35d9d
mov qword [rsp + 0x80], r8
mov r8, qword [rsp + 0x80]
mov qword [rsp + 0x40], r8
movabs r8, 0xa31c5fa0fcee62ee
mov qword [rsp + 0x80], r8
mov r8, qword [rsp + 0x80]
mov qword [rsp + 0x48], r8
movabs r8, 0xef0168f9bc5887ff
mov qword [rsp + 0x80], r8
mov r8, qword [rsp + 0x80]
mov qword [rsp + 0x50], r8
movabs r8, 0x5f931f2736398d53
mov qword [rsp + 0x80], r8
mov r8, qword [rsp + 0x80]
mov qword [rsp + 0x58], r8
movabs r8, 0x34fbce0134616c7d
mov qword [rsp + 0x80], r8
mov r8, qword [rsp + 0x80]
mov qword [rsp + 0x60], r8
movabs r8, 0x6984f009be253256
mov qword [rsp + 0x80], r8
mov r9, qword [rsp + 0x80]
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x80], rdx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x88], rcx
movabs rcx, 0x434dbc905fdb38bd
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x90], rcx
movabs rcx, 0xc66f3ec5909e42c2
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x98], rcx
movabs rcx, 0x836f1f96d83df5df
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0xa0], rcx
movabs rcx, 0x7ff67753165dec3c
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0xa8], rcx
movabs rcx, 0x34d5bc6450000311
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0x28], r8
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movaps xmm0, xmmword [rsp + 0x30]
movaps xmm1, xmmword [rsp + 0x40]
movaps xmm2, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rax]
movaps xmm3, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x30], xmm0
xorps xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x40], xmm1
xorps xmm2, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x50], xmm2
xorps xmm3, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x60], xmm3
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x70]
xor ecx, ecx
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.14005bcb0
xor ecx, ecx
call fcn.14013491c
int3