Function at 0x14000ba20
Capabilities:
Copy file
Create directory
Delete file
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2b8
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140037010]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rdx, qword [rdx + 8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
xor ebx, ebx
test eax, eax
je 0x14000ba88
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400192f0
mov eax, ebx
add rsp, 0x2b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs rbx, 0xffffffff00000002
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
lea rcx, [rsp + 0x78]
mov rdx, rsi
xor r8d, r8d
call fcn.14000b410
mov ebp, dword [rsp + 0x7c]
cmp ebp, 0xffffffff
je 0x14000bb00
mov eax, ebp
and eax, 0x10
je 0x14000bb00
lea rdx, [r14 + 0xc8]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000bbe0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14000bb81
mov rcx, qword [rsp + 0x80]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14000bb18
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, 0xffffffff
setne al
xor ebx, ebx
mov qword [rsp + 0x80], 0xffffffffffffffff
cmp ebp, 0xffffffff
je 0x14000bb73
mov ecx, dword [rsp + 0x78]
cmp ecx, 2
je 0x14000bb73
shr ebp, 0xa
and bpl, al
jne 0x14000bb73
cmp ecx, 1
je 0x14000bb73
mov rdx, qword [rdi + 8]
mov rcx, qword [rsi + 8]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x14000bb73
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14000bbc0
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x90], 0
test rcx, rcx
je 0x14000bb9f
call fcn.14000e248
mov rcx, qword [rsp + 0x80]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14000ba62
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000ba62
mov rcx, qword [rsi + 8]
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test ebx, ebx
js 0x14000bb81
test eax, eax
je 0x14000bae7
jmp 0x14000bb81
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
lea rcx, [rsp + 0x58]
mov rdx, rdi
xor r8d, r8d
call fcn.14000b410
mov ecx, 0x20a
call fcn.14000e240
mov rbx, rax
lea rcx, [rax + 2]
mov r8d, 0x208
xor edx, edx
call fcn.14000fe30
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 0
mov word [rbx], 0
mov ecx, 0x20a
call fcn.14000e240
mov rbx, rax
lea rcx, [rax + 2]
mov r8d, 0x208
xor edx, edx
call fcn.14000fe30
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], 0
mov word [rbx], 0
cmp qword [rsp + 0x80], 0xffffffffffffffff
mov ebx, 0x80004005
je 0x14000bcbd
cmp qword [rsp + 0x60], 0xffffffffffffffff
je 0x14000bcbd
mov eax, dword [rsp + 0x5c]
cmp eax, 0xffffffff
je 0x14000bcbd
mov ecx, eax
and ecx, 0x10
je 0x14000bcbd
test eax, 0x400
jne 0x14000bcbd
mov eax, dword [rsp + 0x58]
add eax, 0xffffffff
cmp eax, 2
jb 0x14000bcbd
xor ebx, ebx
test ebp, 0x400
jne 0x14000bcbd
mov eax, dword [rsp + 0x78]
add eax, 0xffffffff
cmp eax, 2
jae 0x14000bd62
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.14000b890
test eax, eax
jns 0x14000bcfc
mov rcx, qword [rsi + 8]
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test ebx, ebx
js 0x14000bcfc
test eax, eax
jne 0x14000bcfc
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x40], 0
test rcx, rcx
je 0x14000bd14
call fcn.14000e248
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x50], 0
test rcx, rcx
je 0x14000bd2c
call fcn.14000e248
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x70], 0
test rcx, rcx
je 0x14000bd44
call fcn.14000e248
mov rcx, qword [rsp + 0x60]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14000bb81
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000bb81
mov rdx, qword [rsi + 8]
lea rbx, [rsp + 0x98]
mov rcx, rbx
call fcn.14000df80
call fcn.140014824
mov dword [rax], 0
mov rcx, rbx
call fcn.14000dff0
xor ebp, ebp
test rax, rax
jne 0x14000bdc2
call fcn.140014824
cmp dword [rax], 0
mov ebx, 0x80004005
cmove ebx, ebp
test ebp, ebp
cmovs ebx, ebp
mov rcx, qword [rsp + 0x98]
cmp rcx, 0xffffffffffffffff
je 0x14000bcbd
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x14000bcbd
mov r15, rax
mov r13, qword [rsp + 0x88]
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
xor ebp, ebp
lea r12, [0x140030406]
lea rbx, [rsp + 0x98]
mov rcx, r15
mov rdx, r12
call fcn.1400173a4
test eax, eax
je 0x14000beb2
mov rcx, r15
lea rdx, [0x140030404]
call fcn.1400173a4
test eax, eax
je 0x14000beb2
test r13, r13
je 0x14000be2f
mov rcx, r15
mov rdx, qword [rsp + 0x30]
call fcn.1400173a4
test eax, eax
je 0x14000beb2
mov r9, qword [rsi + 8]
mov qword [rsp + 0x20], r15
mov edx, 0x105
lea rcx, [rsp + 0x48]
lea r8, [0x14002ff5a]
call fcn.14000b850
cmp qword [rsp + 0x48], 0
je 0x14000be7d
mov r9, qword [rdi + 8]
mov qword [rsp + 0x20], r15
mov edx, 0x105
lea rcx, [rsp + 0x38]
lea r8, [0x14002ff5a]
call fcn.14000b850
cmp qword [rsp + 0x38], 0
jne 0x14000be89
test ebp, ebp
mov eax, 0x8007006f
cmovns ebp, eax
jmp 0x14000beb2
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x38]
mov r8, r14
call fcn.14000ba20
test ebp, ebp
mov ecx, eax
cmovs ecx, ebp
test eax, eax
cmovs ebp, ecx
call fcn.140014824
mov dword [rax], 0
mov rcx, rbx
call fcn.14000dff0
mov r15, rax
test rax, rax
jne 0x14000bdeb
jmp 0x14000bd90