Function at 0x1401c2cd4
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
mov rdi, r9
and qword [rax + 8], rbx
mov r12d, r8d
and dword [rcx], ebx
mov rbp, rdx
mov qword [rax + 0x10], rbx
mov r14, rcx
test rdx, rdx
je 0x1401c2d7a
lea rdx, [rax + 0x10]
mov rcx, rbp
call fcn.14007ab14
mov esi, eax
test eax, eax
jns 0x1401c2d2b
mov ecx, eax
call fcn.14007ac40
mov rbx, qword [rsp + 0x78]
jmp 0x1401c2fe1
mov rbx, qword [rsp + 0x78]
lea r8, str..bak
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1401c513c
mov esi, eax
test eax, eax
jns 0x1401c2d56
mov ecx, eax
call fcn.14007ac40
jmp 0x1401c2fe1
mov r15, qword [rsp + 0x70]
test rdi, rdi
je 0x1401c2d6d
mov rax, qword [rdi]
mov qword [r14 + 0x28], rax
mov rax, qword [rdi + 8]
jmp 0x1401c2d74
and qword [r14 + 0x28], 0
xor eax, eax
mov qword [r14 + 0x30], rax
jmp 0x1401c2d82
mov rbp, qword [rcx + 0x10]
mov r15, qword [rcx + 0x18]
test r12d, r12d
je 0x1401c2d97
mov rdx, rbp
call fcn.1401bcb98
mov rdx, r15
call fcn.1401bcb98
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or r12d, 0xffffffff
cmp eax, r12d
jne 0x1401c2ddc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1401c2e22
test eax, eax
jne 0x1401c2dbf
mov esi, 0x80004005
jmp 0x1401c2dd5
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x1401c3006
mov ecx, esi
jmp 0x1401c2d4c
mov rdx, rbp
call fcn.1401bcb98
xor r8d, r8d
mov rdx, rbp
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1401c2e22
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1401c2e08
mov esi, 0x80004005
jmp 0x1401c2e16
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, esi
call fcn.14007ac40
jmp 0x1401c2fdd
mov r9, rbp
mov edx, 0x80000000
mov r8d, 3
mov rcx, r14
call fcn.1401c3cc0
mov esi, eax
test eax, eax
jns 0x1401c2e45
mov ecx, eax
call fcn.14007ac40
mov ecx, esi
call fcn.14007ace8
cmp esi, 0x80070002
jne 0x1401c2f50
xor esi, esi
xor r9d, r9d
and qword [rsp + 0x30], rsi
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov rcx, r15
mov dword [rsp + 0x20], 1
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x1401c2ebe
or rdi, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1401c2ea7
mov esi, 0x80004005
jmp 0x1401c2eb5
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, esi
call fcn.14007ac40
jmp 0x1401c2edb
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, r12d
je 0x1401c2edb
bts eax, 0xd
mov rcx, r15
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, esi
call fcn.14007ace8
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1401c2ef5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
js 0x1401c2dd5
mov r9, rbp
mov edx, 0xc0000000
mov r8d, 4
mov rcx, r14
call fcn.1401c3cc0
mov esi, eax
test eax, eax
jns 0x1401c2f20
mov ecx, eax
call fcn.14007ac40
mov ecx, esi
call fcn.14007ace8
test esi, esi
js 0x1401c2dd5
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, r12d
je 0x1401c2f4c
bts eax, 0xd
mov rcx, rbp
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
jmp 0x1401c2f5d
test esi, esi
js 0x1401c2dd5
mov eax, 1
mov dword [r14 + 0x20], eax
test rbx, rbx
je 0x1401c3006
mov rdi, qword [r14 + 0x10]
mov rbp, rbx
xor ebx, ebx
test rdi, rdi
je 0x1401c2f94
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
xor eax, eax
test rbp, rbp
cmovne rax, rbp
mov rbp, qword [rsp + 0x70]
and qword [rsp + 0x70], rbx
mov qword [r14 + 0x10], rax
mov rdi, qword [r14 + 0x18]
test rdi, rdi
je 0x1401c2fd0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
xor eax, eax
test rbp, rbp
cmovne rax, rbp
mov qword [r14 + 0x18], rax
test esi, esi
jns 0x1401c3006
cmp dword [0x14045d71c], 0
jne 0x1401c3006
xor r9d, r9d
mov r8d, esi
mov rcx, r14
lea edx, [r9 + 3]
call fcn.1401bcc14
mov dword [0x14045d71c], 1
mov ecx, esi
call fcn.14007ace8
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x1401c303c
lea rdi, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
and qword [rsp + 0x70], 0
test rbx, rbx
je 0x1401c305d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
lea r11, [rsp + 0x40]
mov eax, esi
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret