Function at 0x140232150
Capabilities:
Copy file
Delete file
Get file attributes
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, r8
mov rax, qword [0x14039ce38]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x38]
mov r8b, 1
mov r9b, 1
call fcn.140231320
lea rcx, [rsp + 0x30]
mov rdx, rsi
mov r8b, 1
xor r9d, r9d
call fcn.140231320
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, 0x410
je 0x1402321c1
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x14023248a
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call fcn.14026c9a8
lea rdx, [rsi + rax*2]
mov ecx, 2
xor r14d, r14d
nop word [rax + rax]
lea r8, [rax + r14]
dec r8
js 0x140232354
movzx r8d, word [rdx + r14*2 - 2]
dec r14
add rcx, 0xfffffffffffffffe
cmp r8d, 0x5c
je 0x140232206
cmp r8d, 0x2f
jne 0x1402321e0
lea r12, [rcx + rax*2]
add r14, rax
mov rax, r14
inc rax
mov r15, 0xffffffffffffffff
cmovs r12, r15
mov rcx, r12
call fcn.140258ed0
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call fcn.14025c7b0
mov rcx, rbx
mov rdx, rsi
mov r8, r14
call fcn.14027e5e8
mov dword [rsp + 0x44], 0
lea rdx, [rsp + 0x44]
mov ecx, 4
call fcn.140227870
test al, al
je 0x140232322
mov rcx, rbx
call fcn.14026c9a8
mov r12, rax
lea rax, [rax*2 + 0x12]
add r12, 9
cmovns r15, rax
mov rcx, r15
call fcn.140258ed0
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14025c7b0
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x20], eax
lea r8, [0x140345d20]
mov rcx, r14
mov rdx, r12
mov r9, rbx
call fcn.1402330d0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
je 0x14023231a
mov rcx, rbx
call fcn.140258ec8
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14027156c
test eax, eax
jne 0x140232455
movzx eax, word [rsp + 0x56]
and eax, 0xf000
cmp eax, 0x8000
jne 0x14023244a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140232455
mov rcx, r14
call fcn.140258ec8
lea rcx, [rsp + 0x50]
call qword [sym.imp.RPCRT4.dll_UuidCreateSequential]
cmp eax, 0x720
je 0x140232338
test eax, eax
jne 0x14023234c
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x48]
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
je 0x140232382
mov rcx, rbx
call fcn.140258ec8
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
setne sil
jmp 0x14023248a
mov r15, qword [rsp + 0x48]
test r15, r15
je 0x14023234c
mov rcx, rbx
call fcn.14026c9a8
mov r14, rax
mov rcx, r15
call fcn.14026c9a8
lea rcx, [r14 + rax]
lea r12, [r14 + rax]
inc r12
lea rax, [rcx*2 + 2]
test r12, r12
mov r13, 0xffffffffffffffff
cmovns r13, rax
mov rcx, r13
call fcn.140258ed0
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r13
call fcn.14025c7b0
mov qword [rsp + 0x20], r15
lea r8, str._s_s
mov rcx, r14
mov rdx, r12
mov r9, rbx
call fcn.1402330d0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
jne 0x140232424
mov rcx, r14
call fcn.140258ec8
xor r14d, r14d
mov qword [rsp + 0x50], r15
lea rcx, [rsp + 0x50]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov rcx, rbx
call fcn.140258ec8
test r14, r14
jne 0x1402322e2
jmp 0x140232354
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r14
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne sil
jne 0x140232482
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r14
call fcn.140258ec8
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140232499
call fcn.140258ec8
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1402324a8
call fcn.140258ec8
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140258ea0
mov eax, esi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret