Function at 0x180011af0
Capabilities:
Delete file
Move file
Set file attributes
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rsi, rcx
mov r13d, dword [rcx + 0x10]
add r13d, dword [rcx + 0x14]
xor ebp, ebp
and dword [rsp + 0x90], ebp
xor r15d, r15d
test rdx, rdx
je 0x180011b3c
mov rcx, rdx
call fcn.180025b30
mov r14, rax
jmp 0x180011b3f
xor r14d, r14d
xor r12d, r12d
mov eax, r14d
neg eax
sbb edi, edi
not edi
and edi, 0x80070057
jl 0x180011c37
lea rcx, str..tmp
call fcn.180025b30
add eax, r14d
lea ebx, [rax + rax + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
test rax, rax
jne 0x180011b98
mov edi, 0x8007000e
mov r14d, dword [rsp + 0x90]
jmp 0x180011c3f
mov eax, r14d
lea rbx, [rax + rax]
mov r8, rbx
mov rdx, qword [rsp + 0x98]
mov rcx, r12
call fcn.180028480
lea rcx, [rbx + r12]
lea rdx, str..tmp
call fcn.180027950
mov r11, qword [rsi + 0x28]
test r11d, r11d
je 0x180011c27
mov eax, dword [rsi + 0xc]
lea r14d, [r11 + rax]
mov r15d, r14d
imul r15d, r13d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, r15d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
jne 0x180011bfc
mov edi, 0x8007000e
jmp 0x180011c3f
xor ebx, ebx
mov rdx, qword [rsi]
test rdx, rdx
je 0x180011c18
mov ebx, dword [rsi + 0xc]
imul ebx, r13d
mov r8d, ebx
mov rcx, rax
call fcn.180028480
mov edx, ebx
add rdx, rbp
mov rcx, rsi
call fcn.1800113a8
jmp 0x180011c3f
mov r14d, dword [rsi + 0xc]
mov r15d, r14d
imul r15d, r13d
mov rbp, qword [rsi]
jmp 0x180011c3f
mov r14d, dword [rsp + 0x90]
xor ebx, ebx
test edi, edi
js 0x180011dc9
test rbp, rbp
je 0x180011c6d
test r14d, r14d
je 0x180011c6d
mov r8d, dword [rsi + 0x10]
add r8d, dword [rsi + 0x14]
mov edx, r14d
lea r9, [0x18000ffc4]
mov rcx, rbp
call fcn.180028cc0
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.180026090
mov qword [rsp + 0x90], rax
test rax, rax
je 0x180011c99
mov rdx, qword [rsp + 0x98]
mov rcx, rax
call fcn.180021530
mov rbx, rax
jmp 0x180011c9b
xor ebx, ebx
test rbx, rbx
je 0x180011cc5
mov rcx, rbx
call fcn.1800203b0
test al, al
jne 0x180011cca
mov edi, 0x800700a7
mov rcx, rbx
call fcn.180021840
mov rcx, rbx
call fcn.180025550
xor ebx, ebx
jmp 0x180011cca
mov edi, 0x8007000e
test edi, edi
js 0x180011dc9
mov r13d, 0x80
mov edx, r13d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x180011d28
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x180011d69
and dword [rsp + 0x90], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
mov r8d, r15d
mov rdx, rbp
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180011d69
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
cmp r13, 0xffffffffffffffff
je 0x180011d85
test edi, edi
js 0x180011d7c
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
js 0x180011dc9
mov edx, 0x80
mov r13, qword [rsp + 0x98]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov r8d, SafeArrayGetDim
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x180011dc9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test r12, r12
je 0x180011df3
cmp word [r12], 0
je 0x180011ddf
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x180011e10
mov rcx, rbx
call fcn.180020450
mov rcx, rbx
call fcn.180021840
mov rcx, rbx
call fcn.180025550
test rbp, rbp
je 0x180011e68
cmp rbp, qword [rsi]
je 0x180011e68
test edi, edi
js 0x180011e54
lea rcx, [rsi + 0x18]
call fcn.18001072c
mov rbx, qword [rsi]
test rbx, rbx
je 0x180011e47
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rsi], 0
mov qword [rsi], rbp
mov dword [rsi + 8], r15d
mov dword [rsi + 0xc], r14d
jmp 0x180011e68
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret