Function at 0x100005d84
Capabilities:
Check if file exists
Copy file
Create process on windows
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa40
mov rax, qword [0x100014100]
xor rax, rsp
mov qword [rsp + 0xa30], rax
mov rdi, rcx
xor esi, esi
mov ebx, esi
mov dword [rsp + 0x60], ebx
mov r12, rsi
mov qword [rsp + 0x78], rsi
mov r13, rsi
mov qword [r11 - 0x9e0], rsi
mov dword [rsp + 0x1f0], esi
mov r14d, 0x204
mov r8, r14
xor edx, edx
lea rcx, [r11 - 0x874]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x820], esi
mov dword [rsp + 0x400], esi
mov r8, r14
xor edx, edx
lea rcx, [rsp + 0x404]
call sub.msvcrt.dll_memset
mov r15d, 0x104
mov r8d, r15d
lea rdx, [rsp + 0x1f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, esi
je 0x100006479
mov r8d, 0x7ffffffe
mov qword [rsp + 0xb0], r8
lea r9, [rsp + 0x1f0]
mov qword [rsp + 0xc0], r9
mov rdx, r15
mov qword [rsp + 0xc8], rdx
lea rax, [rsp + 0x820]
mov qword [rsp + 0xa0], rax
mov r11d, esi
mov rcx, rsi
mov qword [rsp + 0x98], rcx
lea r14d, [rsi + 1]
cmp rdx, rsi
je 0x100005ecb
cmp r8, rsi
je 0x100005ecb
movzx r10d, word [r9]
cmp r10w, si
je 0x100005ecb
mov word [rax], r10w
add rax, 2
mov qword [rsp + 0xa0], rax
add r9, 2
mov qword [rsp + 0xc0], r9
sub rdx, r14
mov qword [rsp + 0xc8], rdx
sub r8, r14
mov qword [rsp + 0xb0], r8
add rcx, r14
mov qword [rsp + 0x98], rcx
jmp 0x100005e78
cmp rdx, rsi
jne 0x100005eed
sub rax, 2
mov qword [rsp + 0xa0], rax
sub rcx, r14
mov qword [rsp + 0x98], rcx
mov r11d, 0x8007007a
mov word [rax], si
cmp r11d, esi
jl 0x100006479
mov edx, 0x5c
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rbx, rax
cmp rax, rsi
je 0x100006457
mov word [rax], si
add rbx, 2
mov qword [rsp + 0x20], rbx
mov r9, rdi
lea r8, [0x100001f28]
mov rdx, r15
lea rcx, [rsp + 0x400]
call fcn.10000c3c4
cmp eax, esi
jl 0x100006475
lea rcx, [0x100001cd0]
call fcn.10000c560
mov r12, rax
mov qword [rsp + 0x78], rax
cmp rax, rsi
je 0x10000646f
mov rdx, rbx
mov rcx, rax
call fcn.10000c7f4
mov r13, rax
mov qword [rsp + 0x88], rax
cmp rax, rsi
je 0x100006469
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100005fa4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.10000d0f4
cmp eax, esi
je 0x100005fb0
mov rcx, r12
call fcn.10000d66c
cmp eax, esi
jne 0x10000602f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call sub.WDSCORE.dll_CurrentIP
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8, r12
lea rdx, [0x100001f68]
mov ecx, 0x30000e9
call fcn.1000092e8
mov rcx, rax
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rbx
lea rax, [0x100001f40]
mov qword [rsp + 0x30], rax
lea rax, [0x100001df0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xc5
xor r9d, r9d
lea r8, [0x100001e78]
mov edx, 0xe0000
call sub.WDSCORE.dll_WdsSetupLogMessageW
mov ebx, dword [rsp + 0x60]
jmp 0x100006479
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rsi
mov dword [rsp + 0xe0], r14d
lea rax, [rsp + 0x400]
mov qword [rsp + 0xe8], rax
mov edx, 0x5c
lea rcx, [rsp + 0x400]
call qword [sym.imp.msvcrt.dll_wcsrchr]
add rax, 2
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0xf8], esi
lea rax, [0x100001fa8]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rsi
mov dword [rsp + 0x110], r14d
lea rax, [0x100001fc0]
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x120], rsi
mov dword [rsp + 0x128], r14d
lea rax, [0x100001fd8]
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], rsi
mov dword [rsp + 0x140], r14d
lea rax, [0x100001ff0]
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], rsi
mov dword [rsp + 0x158], esi
mov r15d, esi
mov dword [rsp + 0x6c], esi
cmp r15d, 6
jae 0x100006304
movsxd rax, r15d
lea rcx, [rax + rax*2]
mov rdx, qword [rsp + rcx*8 + 0xd0]
mov rbx, qword [rsp + rcx*8 + 0xd8]
mov eax, dword [rsp + rcx*8 + 0xe0]
mov dword [rsp + 0x70], eax
cmp rbx, rsi
cmove rbx, rdx
mov r14, rsi
mov qword [rsp + 0xa8], rsi
lea rcx, [rsp + 0x1f0]
call fcn.10000c7f4
mov rdi, rax
mov qword [rsp + 0x90], rax
cmp rax, rsi
je 0x100006180
mov rdx, rbx
mov rcx, r12
call fcn.10000c7f4
mov r14, rax
mov qword [rsp + 0xa8], rax
cmp rax, rsi
je 0x100006180
mov ebx, 1
mov dword [rsp + 0x64], ebx
jmp 0x100006186
mov ebx, esi
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x80], ebx
cmp ebx, esi
je 0x1000062af
mov ebx, 1
mov dword [rsp + 0x68], ebx
cmp dword [rsp + 0x70], esi
jne 0x1000061b7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
cmove ebx, esi
mov dword [rsp + 0x68], ebx
cmp ebx, esi
je 0x1000062ab
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x80], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call sub.WDSCORE.dll_CurrentIP
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
lea rcx, [0x100002010]
lea rdx, [0x100002028]
mov eax, dword [rsp + 0x64]
cmp eax, esi
cmovne rdx, rcx
lea r9, [0x100002038]
cmp r14, rsi
cmovne r9, r14
lea r8, [0x100002038]
mov rcx, qword [rsp + 0x90]
cmp rcx, rsi
cmovne r8, rcx
neg eax
sbb ecx, ecx
and ecx, 0x1000000
add ecx, 0x3000000
mov dword [rsp + 0x28], r11d
mov qword [rsp + 0x20], rdx
lea rdx, [0x100002048]
call fcn.1000092e8
mov rcx, rax
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rbx
lea rax, [0x100001f40]
mov qword [rsp + 0x30], rax
lea rax, [0x100001df0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
lea r8, [0x100001e78]
mov edx, 0xe0000
call sub.WDSCORE.dll_WdsSetupLogMessageW
mov ebx, dword [rsp + 0x64]
mov rdi, qword [rsp + 0x90]
jmp 0x1000062af
mov ebx, dword [rsp + 0x64]
cmp rdi, rsi
je 0x1000062c8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r14, rsi
je 0x1000062ef
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, esi
cmovne r14, rsi
mov qword [rsp + 0xa8], r14
cmp ebx, esi
je 0x100006463
inc r15d
mov dword [rsp + 0x6c], r15d
jmp 0x1000060ff
mov dword [rsp + 0x610], esi
xor edx, edx
mov r8d, 0x204
lea rcx, [rsp + 0x614]
call sub.msvcrt.dll_memset
lea r11, [0x100002080]
mov qword [rsp + 0x28], r11
lea rax, [0x1000020a0]
mov qword [rsp + 0x20], rax
mov r9, r13
lea r8, [0x1000020b0]
mov edx, 0x104
lea rcx, [rsp + 0x610]
call fcn.10000c3c4
cmp eax, esi
jl 0x10000645d
mov ebx, 0x68
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x180]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x180], ebx
lea rax, [rsp + 0x160]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x610]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0xb8], eax
cmp eax, esi
jne 0x100006479
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call sub.WDSCORE.dll_CurrentIP
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x610]
mov r8, r13
lea rdx, [0x1000020c8]
mov ecx, 0x30000ea
call fcn.1000092e8
mov rcx, rax
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rbx
lea rax, [0x100001f40]
mov qword [rsp + 0x30], rax
lea rax, [0x100001df0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x146
xor r9d, r9d
lea r8, [0x100001e78]
mov edx, 0xe0000
call sub.WDSCORE.dll_WdsSetupLogMessageW
mov ebx, dword [rsp + 0x60]
jmp 0x100006479
mov ebx, dword [rsp + 0x60]
jmp 0x100006479
mov ebx, dword [rsp + 0x60]
jmp 0x100006479
mov ebx, dword [rsp + 0x60]
jmp 0x100006479
mov ebx, dword [rsp + 0x60]
jmp 0x100006479
mov ebx, dword [rsp + 0x60]
jmp 0x100006479
mov ebx, dword [rsp + 0x60]
cmp r12, rsi
je 0x100006492
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13, rsi
je 0x1000064ab
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rcx, qword [rsp + 0xa30]
xor rcx, rsp
call fcn.10000f390
lea r11, [rsp + 0xa40]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret