Function at 0x18000279c
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x9d0
xor r12d, r12d
mov rax, r9
mov r13, r8
mov r14, rdx
mov rbx, rcx
cmp rdx, r12
je 0x1800028f7
cmp r8, r12
je 0x1800028f7
mov r15, qword [rsp + 0xa30]
cmp r15, r12
je 0x1800028f7
cmp rax, r12
je 0x1800028f7
lea rdi, [r11 - 0x248]
xor eax, eax
mov esi, 0x208
mov rcx, rsi
lea rdx, [r11 - 0x248]
rep stosb byte [rdi], al
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, r12d
je 0x1800028f7
xor eax, eax
lea rdi, [rsp + 0x290]
mov rcx, rsi
rep stosb byte [rdi], al
lea r9, [rsp + 0x290]
lea rdx, str.temp
lea rcx, [rsp + 0x7c0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp eax, r12d
je 0x1800028f7
lea rdx, [rsp + 0x290]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, r12d
je 0x1800028f7
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800028a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1800028f7
cmp eax, 3
je 0x1800028f7
cmp eax, 0x7b
je 0x1800028f7
cmp eax, 0x4cf
je 0x1800028f7
lea r8, [rsp + 0x58]
lea rcx, [rsp + 0x290]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov dword [rsp + 0x34], r12d
neg eax
sbb esi, esi
and esi, dword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, 8
mov r8d, esi
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea rcx, [rsp + 0x290]
mov rbx, rax
cmp rax, r12
jne 0x180002914
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov rbx, qword [rsp + 0xa10]
add rsp, 0x9d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [rsp + 0x34]
mov r9, rax
mov edx, esi
call fcn.180002684
cmp dword [rbx], 0x74965872
mov rbp, rbx
jne 0x1800029bb
lea r8, [rbx + 4]
lea rbp, [rbx + 0x48]
cmp r8, r12
jne 0x180002944
mov eax, r12d
jmp 0x180002957
mov rax, r8
cmp byte [r8], r12b
je 0x180002954
inc rax
cmp byte [rax], r12b
jne 0x18000294c
sub eax, r8d
mov edx, dword [rbx + 0x44]
mov r9d, eax
mov rcx, rbp
call fcn.1800024d4
mov edx, dword [rbx + 0x44]
lea r8, [rsp + 0xa18]
mov r9d, edi
mov rcx, rbp
mov byte [rsp + 0xa1c], 0x25
mov byte [rsp + 0xa1d], 0x2b
mov byte [rsp + 0xa1e], 0x77
mov byte [rsp + 0xa1f], 0x66
mov byte [rsp + 0xa1a], 0x29
mov byte [rsp + 0xa18], 0x23
mov byte [rsp + 0xa19], 0x2a
mov byte [rsp + 0xa1b], 0x28
call fcn.1800024d4
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rsi, qword [rbp + 8]
xor eax, eax
lea ecx, [rax + 0x10]
lea rdi, [rsp + 0x40]
mov qword [rsp + 0x50], rsi
rep stosb byte [rdi], al
mov rax, qword [rbp]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rax
cmp eax, 0xf7e4aa65
je 0x180002a0c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800028f7
xor eax, eax
lea rdi, [rsp + 0x4a0]
mov ecx, 0x208
rep stosb byte [rdi], al
lea r9, [rsp + 0x4a0]
lea rdx, str.____RES32
lea rcx, [rsp + 0x7c0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x4a0]
mov r8d, esi
call fcn.180002710
lea rdx, [rsp + 0x4a0]
lea rcx, [rsp + 0x6b0]
call fcn.180002f14
lea r8, [rsp + 0x58]
lea rcx, [rsp + 0x4a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
neg eax
sbb ecx, ecx
and ecx, dword [rsp + 0x78]
mov edi, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
cmp rax, r12
jne 0x180002abb
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, r12
lea r9, [rsp + 0x38]
lea r8, [rsp + 0xa18]
lea rcx, [rsp + 0x6b0]
mov rdx, rsi
mov dword [rsp + 0xa18], r12d
call fcn.180002f38
cmp eax, r12d
jne 0x180002b24
cmp rbx, r12
je 0x180002afe
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rsi, r12
je 0x180002b17
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rsp + 0x4a0]
jmp 0x1800028f1
mov r12d, dword [rsp + 0xa18]
lea eax, [r12 + r12*4]
shl eax, 2
mov dword [rsp + 0xa18], eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x180002b91
test rbx, rbx
je 0x180002b74
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rsi, rsi
je 0x180002b8d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
xor esi, esi
lea rax, [rsp + 0xa18]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov r8d, r12d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call fcn.180002ea4
test eax, eax
jne 0x180002bfe
test rbx, rbx
je 0x180002bce
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rsi, rsi
je 0x180002be7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rdi, rdi
je 0x180002b17
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
jmp 0x180002b0c
mov eax, dword [rsp + 0xa18]
mov qword [r14], rdi
mov dword [r13], eax
test rsi, rsi
je 0x180002c25
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [rsp + 0x44], 0
je 0x180002e2e
mov edx, 0x208
xor eax, eax
lea rdi, [rsp + 0x80]
mov rcx, rdx
lea r9, [rsp + 0x80]
xor r8d, r8d
rep stosb byte [rdi], al
mov rcx, rdx
lea rdi, [rsp + 0x80]
rep stosb byte [rdi], al
lea rcx, [rsp + 0x7c0]
lea rdx, str.____RES64
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edx, dword [rsp + 0x50]
mov r8d, dword [rsp + 0x4c]
lea rdx, [rdx + rbp + 0x10]
lea rcx, [rsp + 0x80]
call fcn.180002710
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x6b0]
call fcn.180002f14
lea r8, [rsp + 0x58]
lea rcx, [rsp + 0x80]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
neg eax
sbb ecx, ecx
and ecx, dword [rsp + 0x78]
mov edi, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r12d, 8
mov rcx, rax
mov r8, rdi
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x180002d17
test rbx, rbx
je 0x180002d0a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rsp + 0x80]
jmp 0x1800028f1
and dword [rsp + 0xa18], 0
lea r9, [rsp + 0x38]
lea r8, [rsp + 0xa18]
lea rcx, [rsp + 0x6b0]
mov rdx, rax
call fcn.180002f38
test eax, eax
jne 0x180002d64
test rbx, rbx
je 0x180002d59
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
jmp 0x180002cff
mov ebp, dword [rsp + 0xa18]
lea eax, [rbp + rbp*4]
shl eax, 2
mov dword [rsp + 0xa18], eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov edx, r12d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x180002d40
lea rax, [rsp + 0xa18]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov r8d, ebp
mov rdx, rsi
mov qword [rsp + 0x20], rax
call fcn.180002ea4
test eax, eax
jne 0x180002df7
test rbx, rbx
je 0x180002dd5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
jmp 0x180002cff
mov rax, qword [rsp + 0xa28]
mov qword [rax], rdi
mov eax, dword [rsp + 0xa18]
mov dword [r15], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test rbx, rbx
je 0x180002e47
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
jmp 0x1800028f9