Function at 0x14009caf8
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
and qword [rbp + 0x7f], 0
lea r9, str.sppgenmig.dat
and qword [rbp - 0x31], 0
lea r8, str._WINDIR_System32SPPMigration
mov r12, rcx
lea rdx, [0x1403bec70]
or r15, 0xffffffffffffffff
lea rcx, [rbp + 0x7f]
mov qword [rbp - 0x39], r15
call fcn.140079c18
mov esi, eax
test eax, eax
jns 0x14009cb58
mov ecx, eax
call fcn.14007ab24
mov r14, qword [rbp + 0x7f]
jmp 0x14009ce51
mov r14, qword [rbp + 0x7f]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rdx, [0x1404311a8]
mov ebx, eax
lea rcx, [0x140422f58]
call fcn.1400ed82c
cmp ebx, 0xffffffff
je 0x14009cb9c
shr ebx, 4
lea rdx, [0x140435a44]
not ebx
lea rcx, [0x14040f450]
and ebx, 1
call fcn.1400ed4d4
jmp 0x14009cb9e
xor ebx, ebx
xor ecx, ecx
call fcn.14007ab44
xor ecx, ecx
call fcn.14007ab44
test ebx, ebx
je 0x14009cc35
lea r8, [rbp - 0x31]
mov rcx, r14
lea rdx, [rbp + 0x6f]
call fcn.1400a357c
mov esi, eax
test eax, eax
jns 0x14009cbd6
mov ecx, eax
call fcn.14007ab24
jmp 0x14009ce51
mov rsi, qword [0x140437a10]
mov rbx, qword [rbp - 0x31]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x50]
mov rcx, rdi
call qword [0x1403b8660]
mov r9d, dword [rbp + 0x6f]
lea r8, str.msft:Windows_9.0_Validation_PreviousServerProps
mov edx, 1
mov qword [rsp + 0x20], rbx
mov rcx, rsi
call rdi
mov esi, eax
test eax, eax
js 0x14009cbca
and qword [rsp + 0x20], 0
mov ecx, 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0004005
call fcn.1400542dc
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test r14, r14
je 0x14009cc5b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r14 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ab44
and qword [rbp + 0x7f], 0
lea r9, str.sppmig.dat
lea r8, str._WINDIR_System32SPPMigration
lea rdx, [0x1403bec70]
lea rcx, [rbp + 0x7f]
call fcn.140079c18
mov esi, eax
test eax, eax
js 0x14009cb48
mov r14, qword [rbp + 0x7f]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x14009cca1
shr ebx, 4
not ebx
and ebx, 1
jmp 0x14009cca3
xor ebx, ebx
xor ecx, ecx
call fcn.14007ab44
xor ecx, ecx
call fcn.14007ab44
xor esi, esi
test ebx, ebx
je 0x14009ce51
and qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x14009ccf9
mov qword [rbp - 0x39], r15
mov cl, 1
jmp 0x14009cd02
mov r15, rax
mov qword [rbp - 0x39], rax
xor cl, cl
xor eax, eax
test cl, cl
cmove rax, r15
test rax, rax
jne 0x14009cd35
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14009cd20
mov esi, 0x80004005
jmp 0x14009cd2e
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, esi
jmp 0x14009cbcc
lea rdx, [rbp + 0x77]
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_I_RpcBindingInqLocalClientPID]
test eax, eax
je 0x14009cd6c
mov ecx, eax
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
mov esi, 0x80004005
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovns ecx, esi
mov esi, ecx
jmp 0x14009cbcc
call fcn.140056838
mov esi, eax
test eax, eax
js 0x14009cbca
lea rcx, [rbp - 0x29]
call fcn.140054a5c
mov rcx, qword [r12]
add rcx, 8
call fcn.1400703bc
mov edx, dword [rbp + 0x77]
lea rax, [r15 - 1]
cmp rax, 0xfffffffffffffffd
seta al
xor r8d, r8d
test al, al
cmove r8, r15
call fcn.1400dc3a4
mov ebx, 2
test eax, eax
jns 0x14009cdd4
and qword [rsp + 0x28], 0
mov ecx, ebx
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, eax
mov edx, 0xc0004007
call fcn.140054368
lea rdx, [0x140433760]
lea rcx, [0x14040cf4c]
call fcn.1400ebd6c
mov rcx, qword [r12]
lea r8, [0x1403be4b0]
xor r9d, r9d
mov dword [rsp + 0x20], 1
lea rdx, [rbp - 0x29]
call fcn.1400d8790
test eax, eax
jns 0x14009ce28
and qword [rsp + 0x28], 0
mov ecx, ebx
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, eax
mov edx, 0xc0004008
call fcn.140054368
mov rbx, qword [r12]
lea rdx, [0x1404365ac]
lea rcx, [0x140418218]
call fcn.1400edb90
lea rcx, [rbx + 8]
call fcn.14007329c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, esi
call fcn.14007ab44
lea rcx, [rbp - 0x39]
call fcn.1400773f8
lea rcx, [rbp - 0x31]
call fcn.14009cebc
test r14, r14
je 0x14009cea1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea rdx, [0x140436708]
mov rdi, rax
lea rcx, [0x1404203a8]
call fcn.1400ed188
lea r8, [r14 - 4]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ab44
mov eax, esi
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret