Function at 0x180001710
Capabilities:
Delete file
Get file size
Query environment variable
Read file on windows

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x6c0
mov rax, qword [0x180026008]
xor rax, rsp
mov qword [rsp + 0x690], rax
mov qword [r11 + 0x20], rbp
mov r8d, 0x208
mov qword [r11 - 0x18], r12
xor esi, esi
mov qword [r11 - 0x28], r15
mov r12, rdx
mov r15, rcx
xor edx, edx
lea rcx, [r11 - 0x248]
call fcn.18000a5a0
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call fcn.18000a5a0
xor edx, edx
lea rcx, [rsp + 0x270]
mov r8d, 0x208
call fcn.18000a5a0
mov rcx, qword [0x180027f08]
lea rdx, [rsp + 0x270]
add rcx, 0x18
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edx, 0x53a75901
mov ecx, 0x677c129b
call fcn.180004230
lea rcx, [rsp + 0x270]
call rax
test eax, eax
je 0x18000181c
mov rcx, qword [0x180027ef0]
lea rdx, [rsp + 0x60]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x6b74eeda
mov ecx, 0x677c129b
call fcn.180004230
lea rcx, [rsp + 0x60]
call rax
mov edx, 0x3a8a5f8a
mov ecx, 0x677c129b
call fcn.180004230
lea rcx, [rsp + 0x60]
call rax
mov edx, 0xb6803ef9
mov ecx, 0x677c129b
call fcn.180004230
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x60]
call rax
jmp 0x180001833
lea r8, [rsp + 0x270]
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.18000b574
mov edx, 0x38197ed9
mov qword [rsp + 0x6a8], r14
mov ecx, 0x677c129b
call fcn.180004230
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x480]
call rax
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x480]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x180001a44
mov qword [rsp + 0x6e0], rbx
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x6b8], rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [0x180027f08]
mov r8d, dword [rcx + 0x224]
mov ecx, dword [rcx + 0x220]
add ecx, r8d
cmp ecx, eax
ja 0x180001a2b
mov ebx, r8d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x180001a2b
mov rax, qword [0x180027f08]
mov ebx, esi
mov dword [rsp + 0x40], esi
mov ecx, dword [rax + 0x224]
test ecx, ecx
je 0x180001944
nop dword [rax]
sub ecx, ebx
mov qword [rsp + 0x20], rsi
mov r8d, ecx
lea r9, [rsp + 0x40]
mov rcx, rbp
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov rax, qword [0x180027f08]
je 0x180001944
add ebx, dword [rsp + 0x40]
mov ecx, dword [rax + 0x224]
cmp ebx, ecx
jb 0x180001910
mov r14d, dword [rax + 0x224]
cmp ebx, r14d
jne 0x180001a17
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180027f08]
lea rdx, [rax + 0x228]
lea r9, [rax + 0x238]
test rdx, rdx
je 0x1800019fc
test r9, r9
je 0x1800019fc
test rdi, rdi
je 0x180001a34
mov qword [rsp + 0x30], rdi
mov ebx, r14d
mov qword [rsp + 0x28], rbx
mov r8d, 0x10
mov qword [rsp + 0x20], rdi
call fcn.180004780
test eax, eax
je 0x1800019fc
xorps xmm0, xmm0
lea r8, [rsp + 0x48]
mov edx, ebx
mov rcx, rdi
movups xmmword [rsp + 0x48], xmm0
call fcn.180006040
mov rax, qword [0x180027f08]
mov rcx, qword [rsp + 0x48]
sub rcx, qword [rax + 0x248]
jne 0x1800019e2
mov rcx, qword [rsp + 0x50]
sub rcx, qword [rax + 0x250]
test rcx, rcx
mov eax, esi
sete al
test eax, eax
je 0x180001a01
mov qword [r15], rdi
mov esi, 1
mov dword [r12], r14d
jmp 0x180001a34
test rdi, rdi
je 0x180001a34
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180001a34
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x6e0]
mov rdi, qword [rsp + 0x6b8]
mov rcx, qword [0x180027f08]
mov r15, qword [rsp + 0x6a0]
mov r14, qword [rsp + 0x6a8]
mov r12, qword [rsp + 0x6b0]
cmp dword [rcx + 0x258], 0
mov rbp, qword [rsp + 0x6e8]
je 0x180001a82
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, esi
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.180009470
add rsp, 0x6c0
pop rsi
ret