Function at 0x100027408
Capabilities:
Check if file exists
Delete file
Move file
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0x150
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x148], rax
mov rbp, r8
mov qword [rsp + 0x48], r8
mov r13, rdx
mov r12, rcx
lea r9, [0x1001653b8]
mov ebx, 1
mov rcx, qword [0x1001653b8]
cmp rcx, r9
je 0x10002748d
test byte [rcx + 0x1c], bl
je 0x10002748d
cmp byte [rcx + 0x19], 4
jb 0x10002748d
mov edx, 0xea
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001c854
mov rcx, qword [0x1001653b8]
lea r9, [0x1001653b8]
or r10, 0xffffffffffffffff
mov qword [rsp + 0x60], r10
mov qword [rsp + 0x50], r10
and qword [rsp + 0x58], 0
xor r14b, r14b
mov dword [rsp + 0x40], r14d
movdqu xmm0, xmmword [0x10000f0f8]
movdqu xmmword [rsp + 0x138], xmm0
and dword [rsp + 0x44], 0
lea rdx, [0x10000f0f8]
mov r8, qword [r13]
cmp r8, qword [rdx]
jne 0x1000274dd
mov r8, qword [r13 + 8]
cmp r8, qword [rdx + 8]
jne 0x1000274dd
xor eax, eax
jmp 0x1000274e2
sbb eax, eax
sbb eax, r10d
test eax, eax
jne 0x10002751f
cmp rcx, r9
je 0x100027512
test byte [rcx + 0x1c], bl
je 0x100027512
cmp byte [rcx + 0x19], 2
jb 0x100027512
mov edx, 0xeb
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001c854
mov rcx, qword [0x1001653b8]
mov edi, 0x80070057
mov r12, rbx
jmp 0x100027d4d
test byte [r12 + 0x150], bl
je 0x10002754d
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, rbp
call fcn.10009bac4
mov edi, eax
test eax, eax
js 0x100027d30
mov rbx, qword [rsp + 0x58]
jmp 0x1000275f7
lea r8, [rsp + 0x58]
lea rdx, [0x100004a50]
mov rcx, qword [r12 + 0x248]
call fcn.10009bb88
mov edi, eax
test eax, eax
js 0x100027d30
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1000275f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 2
je 0x1000275f2
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
cmp rcx, r13
je 0x1000275d9
mov r12d, 1
test byte [rcx + 0x1c], r12b
je 0x1000275df
cmp byte [rcx + 0x19], 2
jb 0x1000275df
mov edx, 0xec
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001ddb0
mov rcx, qword [0x1001653b8]
jmp 0x1000275df
mov r12d, 1
movzx edi, bp
or edi, 0x80070000
test ebp, ebp
cmovle edi, ebp
jmp 0x100027c8a
mov rbp, qword [rsp + 0x48]
cmp dword [r12 + 0x14c], 4
setne al
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov byte [rsp + 0x30], al
and qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80
mov r9d, 2
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rbx
call fcn.10009daf8
mov edi, eax
test eax, eax
jns 0x10002769d
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
cmp rcx, r13
je 0x10002768d
mov r12d, 1
test byte [rcx + 0x1c], r12b
je 0x100027693
cmp byte [rcx + 0x19], 2
jb 0x100027693
mov edx, 0xed
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001ddb0
mov r14, qword [rsp + 0x50]
mov rcx, qword [0x1001653b8]
jmp 0x100027c61
mov r12d, 1
mov r14, qword [rsp + 0x50]
jmp 0x100027c61
mov edi, 1
test byte [r12 + 0x150], dil
movzx r14d, r14b
cmovne r14d, edi
mov dword [rsp + 0x40], r14d
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8d, [rdi + 0xf]
mov rdx, r13
mov r14, qword [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10002773e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
cmp rcx, r13
je 0x100027725
test byte [rcx + 0x1c], dil
je 0x100027725
cmp byte [rcx + 0x19], 2
jb 0x100027725
mov edx, 0xee
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001ddb0
mov rcx, qword [0x1001653b8]
movzx edi, bp
or edi, 0x80070000
test ebp, ebp
cmovle edi, ebp
mov r12d, 1
jmp 0x100027c61
mov r9d, dword [rsp + 0x44]
cmp r9d, 0x10
je 0x1000277a8
mov edi, 0x8007045d
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
cmp rcx, r13
je 0x100027c5b
mov r12d, 1
test byte [rcx + 0x1c], r12b
je 0x100027c61
cmp byte [rcx + 0x19], 2
jb 0x100027c61
mov edx, 0xef
mov dword [rsp + 0x20], 0x10
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001d914
mov rcx, qword [0x1001653b8]
jmp 0x100027c61
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x10002782c
call qword [sym.imp.ntdll.dll_RtlGetLastNtStatus]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
cmp rcx, r13
je 0x100027813
mov r12d, 1
test byte [rcx + 0x1c], r12b
je 0x100027819
cmp byte [rcx + 0x19], 2
jb 0x100027819
mov edx, 0xf0
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001e4b0
mov rcx, qword [0x1001653b8]
jmp 0x100027819
mov r12d, 1
movzx edi, bp
or edi, 0x80070000
test ebp, ebp
cmovle edi, ebp
jmp 0x100027c61
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or r14, 0xffffffffffffffff
test byte [r12 + 0x150], dil
jne 0x1000278d1
mov r8d, edi
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1000278cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
cmp rcx, r13
je 0x1000278ae
test byte [rcx + 0x1c], dil
je 0x1000278ae
cmp byte [rcx + 0x19], 2
jb 0x1000278ae
mov edx, 0xf1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001e39c
mov rcx, qword [0x1001653b8]
movzx edi, bp
or edi, 0x80070000
test ebp, ebp
cmovle edi, ebp
mov r14d, dword [rsp + 0x40]
mov r12d, 1
jmp 0x100027c8a
mov byte [rsp + 0x40], dil
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x30], 0
and qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x2000000
mov r9d, 3
mov r8d, edi
mov edx, 0x80000000
mov rcx, rbp
call fcn.10009daf8
mov edi, eax
xor ebx, ebx
cmp eax, ebx
jge 0x100027963
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
cmp rcx, r13
je 0x100027c18
lea r12d, [rbx + 1]
test byte [rcx + 0x1c], r12b
je 0x100027c3f
cmp byte [rcx + 0x19], 2
jb 0x100027c3f
mov edx, 0xf2
mov dword [rsp + 0x20], eax
mov r9, rbp
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001ddb0
mov rcx, qword [0x1001653b8]
jmp 0x100027c3f
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x44]
mov r8d, 0x10
lea rdx, [rsp + 0x138]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
jne 0x1000279fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, ebx
cmovle edi, eax
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
cmp rcx, r13
je 0x100027c10
mov r12d, 1
test byte [rcx + 0x1c], r12b
je 0x100027c3f
cmp byte [rcx + 0x19], 2
jb 0x100027c3f
mov edx, 0xf3
mov dword [rsp + 0x20], edi
mov r9, rbp
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001ddb0
mov rcx, qword [0x1001653b8]
jmp 0x100027c3f
cmp dword [rsp + 0x44], 0x10
jne 0x100027b69
lea rax, [rsp + 0x138]
mov rdx, qword [rax]
cmp rdx, qword [r13]
jne 0x100027a25
mov rdx, qword [rax + 8]
cmp rdx, qword [r13 + 8]
jne 0x100027a25
mov eax, ebx
jmp 0x100027a2a
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x100027b69
test byte [r12 + 0x150], 0x80
je 0x100027b50
cmp byte [r12 + 0x11c], bl
je 0x100027b50
mov ecx, 0x40
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x50], rax
cmp rax, rbx
je 0x100027a70
mov rcx, rax
call fcn.10004401c
mov rbp, rax
jmp 0x100027a73
mov rbp, rbx
mov rdx, qword [rsp + 0x48]
mov rcx, rbp
call fcn.10001ecdc
mov edi, eax
cmp eax, ebx
jl 0x100027b50
mov r8d, 0x10
mov rdx, r13
mov rcx, rbp
call fcn.10001f008
mov edi, eax
cmp eax, ebx
jge 0x100027af6
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
cmp rcx, r13
je 0x100027c08
mov r12d, 1
test byte [rcx + 0x1c], r12b
je 0x100027c3f
cmp byte [rcx + 0x19], 2
jb 0x100027c3f
mov edx, 0xf5
mov r9d, eax
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001c878
mov rcx, qword [0x1001653b8]
jmp 0x100027c3f
lea rbx, [r12 + 0x308]
mov r12, qword [rbx + 8]
cmp r12, qword [rbx + 0x10]
jb 0x100027b24
lea rdx, [r12 + 1]
mov rcx, rbx
call fcn.10006a9e0
test al, al
jne 0x100027b24
mov ecx, 0x8007000e
call fcn.1000196c8
int3
mov rax, qword [rbx]
lea rcx, [rax + r12*8]
test rcx, rcx
je 0x100027b33
mov qword [rcx], rbp
mov r12d, 1
add qword [rbx + 8], r12
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
jmp 0x100027c3f
mov rcx, qword [0x1001653b8]
mov r12d, 1
lea r13, [0x1001653b8]
jmp 0x100027c3f
mov edi, 0x8007045d
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100027c20
mov r12d, 1
test byte [rcx + 0x1c], r12b
je 0x100027c38
cmp byte [rcx + 0x19], 2
jb 0x100027c2f
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0x70]
call fcn.10009b894
mov rbx, rax
mov rdx, r13
lea rcx, [rsp + 0xd4]
call fcn.10009b894
mov edx, 0xf4
mov dword [rsp + 0x30], 0x10
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x10
mov r9, rax
lea r8, [0x100003cc8]
mov rcx, qword [0x1001653b8]
mov rcx, qword [rcx + 0x10]
call fcn.10001de48
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
jmp 0x100027c3f
mov r12d, 1
jmp 0x100027c3f
mov r12d, 1
jmp 0x100027c3f
mov r12d, 1
jmp 0x100027c3f
mov r12d, 1
lea r13, [0x1001653b8]
jmp 0x100027c3f
lea r13, [0x1001653b8]
jmp 0x100027c3f
lea r13, [0x1001653b8]
cmp qword [rsp + 0x60], 0xffffffffffffffff
je 0x100027c7e
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1001653b8]
jmp 0x100027c61
mov r12d, 1
cmp r14, 0xffffffffffffffff
je 0x100027c85
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1001653b8]
mov r14d, dword [rsp + 0x40]
jmp 0x100027c8a
mov r14d, dword [rsp + 0x40]
jmp 0x100027c8a
mov r14d, dword [rsp + 0x40]
test edi, edi
jns 0x100027d4d
test r14b, r14b
je 0x100027d4d
cmp rcx, r13
je 0x100027cd0
mov ebx, 1
test byte [rcx + 0x1c], bl
je 0x100027cd5
cmp byte [rcx + 0x19], 4
jb 0x100027cd5
mov edx, 0xf6
mov dword [rsp + 0x20], edi
mov r9, qword [rsp + 0x48]
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001ddb0
jmp 0x100027cd5
mov ebx, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call fcn.10009de6c
test eax, eax
jns 0x100027d30
mov rcx, qword [0x1001653b8]
cmp rcx, r13
je 0x100027d7a
test byte [rcx + 0x1c], bl
je 0x100027d47
cmp byte [rcx + 0x19], 2
jb 0x100027d3f
mov edx, 0xf7
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x48]
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001ddb0
mov rcx, qword [0x1001653b8]
mov r12d, 1
jmp 0x100027d4d
mov rcx, qword [0x1001653b8]
mov r12d, 1
jmp 0x100027d4d
mov r12d, 1
jmp 0x100027d4d
mov r12d, 1
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100027d7a
test byte [rcx + 0x1c], r12b
je 0x100027d7a
cmp byte [rcx + 0x19], 4
jb 0x100027d7a
mov edx, pe_nt_image_headers64
lea r8, [0x100003cc8]
mov rcx, qword [rcx + 0x10]
call fcn.10001c854
mov eax, edi
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.10014e600
mov rbx, qword [rsp + 0x198]
add rsp, 0x150
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret