Function at 0x180011cb0
Capabilities:
Delete file
Move file
Set file attributes
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rsi, rcx
mov r13d, dword [rcx + 0x10]
add r13d, dword [rcx + 0x14]
xor ebp, ebp
and dword [rsp + 0x90], ebp
xor r15d, r15d
test rdx, rdx
je 0x180011cfc
mov rcx, rdx
call fcn.1800257a0
mov r14, rax
jmp 0x180011cff
xor r14d, r14d
xor r12d, r12d
mov eax, r14d
neg eax
sbb edi, edi
not edi
and edi, 0x80070057
jl 0x180011df7
lea rcx, str..tmp
call fcn.1800257a0
add eax, r14d
lea ebx, [rax + rax + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
test rax, rax
jne 0x180011d58
mov edi, 0x8007000e
mov r14d, dword [rsp + 0x90]
jmp 0x180011dff
mov eax, r14d
lea rbx, [rax + rax]
mov r8, rbx
mov rdx, qword [rsp + 0x98]
mov rcx, r12
call fcn.1800280c0
lea rcx, [rbx + r12]
lea rdx, str..tmp
call fcn.180028c90
mov r11, qword [rsi + 0x28]
test r11d, r11d
je 0x180011de7
mov eax, dword [rsi + 0xc]
lea r14d, [r11 + rax]
mov r15d, r14d
imul r15d, r13d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, r15d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
jne 0x180011dbc
mov edi, 0x8007000e
jmp 0x180011dff
xor ebx, ebx
mov rdx, qword [rsi]
test rdx, rdx
je 0x180011dd8
mov ebx, dword [rsi + 0xc]
imul ebx, r13d
mov r8d, ebx
mov rcx, rax
call fcn.1800280c0
mov edx, ebx
add rdx, rbp
mov rcx, rsi
call fcn.1800115f0
jmp 0x180011dff
mov r14d, dword [rsi + 0xc]
mov r15d, r14d
imul r15d, r13d
mov rbp, qword [rsi]
jmp 0x180011dff
mov r14d, dword [rsp + 0x90]
xor ebx, ebx
test edi, edi
js 0x180011f89
test rbp, rbp
je 0x180011e2d
test r14d, r14d
je 0x180011e2d
mov r8d, dword [rsi + 0x10]
add r8d, dword [rsi + 0x14]
mov edx, r14d
lea r9, [0x180010280]
mov rcx, rbp
call fcn.180028900
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.180026510
mov qword [rsp + 0x90], rax
test rax, rax
je 0x180011e59
mov rdx, qword [rsp + 0x98]
mov rcx, rax
call fcn.18001e590
mov rbx, rax
jmp 0x180011e5b
xor ebx, ebx
test rbx, rbx
je 0x180011e85
mov rcx, rbx
call fcn.18001cf10
test al, al
jne 0x180011e8a
mov edi, 0x800700a7
mov rcx, rbx
call fcn.18001e8a0
mov rcx, rbx
call fcn.1800251c0
xor ebx, ebx
jmp 0x180011e8a
mov edi, 0x8007000e
test edi, edi
js 0x180011f89
mov r13d, 0x80
mov edx, r13d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x180011ee8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x180011f29
and dword [rsp + 0x90], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
mov r8d, r15d
mov rdx, rbp
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180011f29
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
cmp r13, 0xffffffffffffffff
je 0x180011f45
test edi, edi
js 0x180011f3c
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
js 0x180011f89
mov edx, 0x80
mov r13, qword [rsp + 0x98]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov r8d, SafeArrayGetDim
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x180011f89
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test r12, r12
je 0x180011fb3
cmp word [r12], 0
je 0x180011f9f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x180011fd0
mov rcx, rbx
call fcn.18001cfb0
mov rcx, rbx
call fcn.18001e8a0
mov rcx, rbx
call fcn.1800251c0
test rbp, rbp
je 0x180012028
cmp rbp, qword [rsi]
je 0x180012028
test edi, edi
js 0x180012014
lea rcx, [rsi + 0x18]
call fcn.180010984
mov rbx, qword [rsi]
test rbx, rbx
je 0x180012007
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rsi], 0
mov qword [rsi], rbp
mov dword [rsi + 8], r15d
mov dword [rsi + 0xc], r14d
jmp 0x180012028
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret