Function at 0x18001ca70
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x340]
sub rsp, 0x440
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x490], rbx
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rbp + 0x330], rax
mov r13, r9
mov r15d, r8d
mov rbx, rdx
mov r14, rcx
xor esi, esi
mov r12d, esi
test rcx, rcx
je 0x18001ce15
test rdx, rdx
je 0x18001ce15
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, eax
test r15d, r15d
je 0x18001cae9
cmp eax, 0xffffffff
jne 0x18001ce15
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.18002b2f0
nop
lea rdx, str._2tmp
lea rcx, [rsp + 0x20]
call fcn.180027ea0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor r8d, r8d
mov rdx, qword [rsp + 0x20]
mov rcx, r14
call fcn.180015b00
mov r12d, eax
test eax, eax
je 0x18001ce0b
test r13, r13
je 0x18001cb56
mov rdx, qword [rsp + 0x20]
mov rcx, r14
call r13
mov r12d, eax
test eax, eax
jne 0x18001cb56
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
jmp 0x18001ce0b
cmp edi, 0xffffffff
je 0x18001cb6f
test dil, 1
je 0x18001cb6f
and edi, 0xfffffffe
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov r13d, dword [rbp + 0x3a0]
cmp r13d, 2
je 0x18001ccf0
mov r8d, 1
mov rdx, rbx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov r12d, eax
test eax, eax
jne 0x18001cce2
cmp edi, 0xffffffff
je 0x18001ccd1
mov byte [rsp + 0x30], al
xor edx, edx
mov r8d, 0x1ff
lea rcx, [rsp + 0x31]
call fcn.180043ef0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, eax
mov r8, rbx
lea rdx, str._s.bak_08X
lea rcx, [rsp + 0x30]
call fcn.180043b88
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x18001cc42
nop dword [rax + rax]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, eax
mov r8, rbx
lea rdx, str._s.bak_08X
lea rcx, [rsp + 0x30]
call fcn.180043b88
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc esi
cmp esi, 0xa
jge 0x18001cc31
cmp eax, 0xffffffff
jne 0x18001cbf0
jmp 0x18001cc42
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
jmp 0x18001ce0b
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov r8d, 1
mov rdx, rbx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov r12d, eax
test eax, eax
je 0x18001cc75
mov rcx, rbx
call fcn.18000fa20
jmp 0x18001cc95
test r13d, r13d
je 0x18001ccb2
mov r8d, 5
mov rdx, rbx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov r12d, eax
test eax, eax
je 0x18001ccb2
mov rcx, qword [rsp + 0x20]
call fcn.18000fa20
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x18001cccc
mov rdx, rbx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
jmp 0x18001ce0b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
jmp 0x18001ce0b
mov rcx, rbx
call fcn.18000fa20
nop
jmp 0x18001ce0b
mov byte [rbp + 0x130], 0
xor edx, edx
mov r8d, 0x1ff
lea rcx, [rbp + 0x131]
call fcn.180043ef0
cmp edi, 0xffffffff
je 0x18001cdb3
test dil, 0x10
je 0x18001cdb3
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, eax
mov r8, rbx
lea rdx, str._s.bak_08X
lea rcx, [rbp + 0x130]
call fcn.180043b88
lea rcx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x18001cda3
nop
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, eax
mov r8, rbx
lea rdx, str._s.bak_08X
lea rcx, [rbp + 0x130]
call fcn.180043b88
lea rcx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc esi
cmp esi, 0xa
jge 0x18001cd95
cmp eax, 0xffffffff
jne 0x18001cd50
jmp 0x18001cda3
lea rcx, [rsp + 0x20]
call fcn.180027bd0
xor eax, eax
jmp 0x18001ce18
lea rdx, [rbp + 0x130]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov r8d, 5
mov rdx, rbx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov r12d, eax
test eax, eax
jne 0x18001cdeb
mov rdx, rbx
lea rcx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x18001ce09
mov rcx, qword [rsp + 0x20]
call fcn.18000fa20
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
nop
jmp 0x18001ce0b
lea rcx, [rsp + 0x20]
call fcn.180027bd0
mov eax, r12d
mov rcx, qword [rbp + 0x330]
xor rcx, rsp
call fcn.180043ec0
mov rbx, qword [rsp + 0x490]
add rsp, 0x440
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret