Function at 0x14009d854
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov r12, rcx
lea rdx, [0x14045a460]
xor r13d, r13d
lea rcx, [0x14042cd58]
mov qword [rbp + 0x7f], r13
call fcn.1400f3318
lea r9, str.sppgenmig.dat
mov qword [rbp - 0x39], r13
lea r8, str._WINDIR_System32SPPMigration
mov edi, r13d
lea rdx, [0x1403da720]
or rbx, 0xffffffffffffffff
lea rcx, [rbp + 0x7f]
call fcn.140079e68
mov esi, eax
test eax, eax
jns 0x14009d8df
mov ecx, eax
call fcn.14007ac40
lea rdx, [0x14045abb8]
lea rcx, [0x14042d3e8]
call fcn.1400f3d28
mov r15, qword [rbp + 0x7f]
jmp 0x14009dc26
mov r15, qword [rbp + 0x7f]
lea rdx, [0x140453b40]
lea rcx, [0x14043f6e8]
call fcn.1400f43c8
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
je 0x14009d910
shr esi, 4
not esi
and esi, 1
jmp 0x14009d913
mov esi, r13d
xor ecx, ecx
call fcn.14007ace8
xor ecx, ecx
call fcn.14007ace8
test esi, esi
je 0x14009d9d2
lea rdx, [0x140457a98]
lea rcx, [0x14042a5b4]
call fcn.1400f3670
lea r8, [rbp - 0x39]
mov rcx, r15
lea rdx, [rbp + 0x6f]
call fcn.1400a4e44
mov esi, eax
test eax, eax
jns 0x14009d962
mov ecx, eax
call fcn.14007ac40
mov rdi, qword [rbp - 0x39]
jmp 0x14009dc26
mov r14, qword [0x14045c9f0]
mov rdi, qword [rbp - 0x39]
mov rax, qword [r14]
mov rsi, qword [rax + 0x50]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov r9d, dword [rbp + 0x6f]
lea r8, str.msft:Windows_9.0_Validation_PreviousServerProps
mov rax, rsi
mov qword [rsp + 0x20], rdi
mov edx, 1
mov rcx, r14
call rax
mov esi, eax
test eax, eax
jns 0x14009d9af
mov ecx, eax
call fcn.14007ac40
jmp 0x14009dc26
mov ecx, 4
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0004005
call fcn.14004eeb8
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test r15, r15
je 0x14009da0a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r15 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
lea rdx, [0x14045b4c0]
lea rcx, [0x1404405a8]
call fcn.1400f4dac
mov qword [rbp + 0x7f], r13
lea r9, str.sppmig.dat
lea r8, str._WINDIR_System32SPPMigration
lea rdx, [0x1403da720]
lea rcx, [rbp + 0x7f]
call fcn.140079e68
mov esi, eax
test eax, eax
jns 0x14009da3a
mov ecx, eax
call fcn.14007ac40
jmp 0x14009d8d6
mov r15, qword [rbp + 0x7f]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14d, eax
cmp eax, 0xffffffff
je 0x14009da6f
shr r14d, 4
lea rdx, [0x14045b360]
not r14d
lea rcx, [0x140436ee8]
and r14d, 1
call fcn.1400f39cc
jmp 0x14009da72
mov r14d, r13d
xor ecx, ecx
call fcn.14007ace8
lea rdx, [0x14045a160]
lea rcx, [0x140441348]
call fcn.1400f4080
xor ecx, ecx
call fcn.14007ace8
mov esi, r13d
test r14d, r14d
je 0x14009dc26
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rdx, [0x140454c38]
mov r14, rax
lea rcx, [0x140443644]
lea rsi, [rax + 1]
call fcn.1400f50fc
test rsi, 0xfffffffffffffffe
jne 0x14009db2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
test eax, eax
jne 0x14009daff
mov esi, 0x80004005
jmp 0x14009db23
lea rdx, [0x140458d50]
lea rcx, [0x14042b6d8]
call fcn.1400f4a68
movzx esi, r14w
or esi, 0x80070000
test r14d, r14d
cmovle esi, r14d
mov ecx, esi
jmp 0x14009d9a5
lea rdx, [rbp + 0x77]
xor ecx, ecx
mov rbx, r14
call qword [sym.imp.RPCRT4.dll_I_RpcBindingInqLocalClientPID]
test eax, eax
je 0x14009db64
mov ecx, eax
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
mov esi, 0x80004005
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovns ecx, esi
mov esi, ecx
jmp 0x14009d9a5
call fcn.140051558
mov esi, eax
test eax, eax
js 0x14009d9a3
lea rcx, [rbp - 0x29]
call fcn.14004f568
mov rcx, qword [r12]
add rcx, 8
call fcn.1400705c0
mov edx, dword [rbp + 0x77]
mov r8, rbx
call fcn.1400e1968
test eax, eax
jns 0x14009dbb7
mov ecx, 2
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov r8d, eax
mov edx, 0xc0004007
call fcn.14004ef44
mov rcx, qword [r12]
lea r8, [0x1403d9f60]
xor r9d, r9d
mov dword [rsp + 0x20], 1
lea rdx, [rbp - 0x29]
call fcn.1400dd2a0
lea rdx, [0x140457900]
mov r14d, eax
lea rcx, [0x140433bb8]
call fcn.1400f4710
test r14d, r14d
jns 0x14009dc10
mov ecx, 2
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov r8d, r14d
mov edx, 0xc0004008
call fcn.14004ef44
mov rcx, qword [r12]
add rcx, 8
call fcn.1400734c0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, esi
call fcn.14007ace8
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14009dc40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x14009dc59
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r15, r15
je 0x14009dc7a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r15 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
lea rdx, [0x140452454]
lea rcx, [0x1404352a8]
call fcn.1400f39cc
mov rbx, qword [rsp + 0xe0]
mov eax, esi
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret