Function at 0x401785
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push rbx
push rbx
push rsi
push rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
and rsp, 0xfffffffffffffff0
push rbp
push rbp
sub rsp, 0x20
cld
xor eax, eax
mov ecx, 7
rep stosq qword [rdi], rax
lea rcx, [rsi + 0x30]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
push r9
push r9
push qword [rsi + 0x18]
push 2
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
add rsp, 0x40
test rax, rax
je 0x4019ad
xchg rbx, rax
lea rcx, [rdi - 0x10]
call qword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
mov r14, qword [rsi + 0x28]
mov r12, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov rcx, rbx
lea rdx, [rsi + 0x800]
mov r8, r12
lea r9, [rdi - 0x18]
xor eax, eax
mov qword [r9], rax
push rax
push rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_WriteFile]
add rsp, 0x30
test rax, rax
je 0x4019ad
dec r13
jne 0x4017f1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_SetFilePointer]
dec r14
jne 0x4017e9
lea rcx, [rdi - 8]
call qword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
mov rax, qword [rdi - 8]
sub rax, qword [rdi - 0x10]
mov qword [rdi - 0x38], rax
lea rcx, [rdi - 0x10]
call qword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
mov r14, qword [rsi + 0x28]
mov r12, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov rcx, rbx
lea rdx, [rdi + 0x7c8]
mov r8, r12
lea r9, [rdi - 0x18]
xor eax, eax
mov qword [r9], rax
push rax
push rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_ReadFile]
add rsp, 0x30
test rax, rax
je 0x4019ad
dec r13
jne 0x401867
mov rcx, rbx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_SetFilePointer]
dec r14
jne 0x40185f
lea rcx, [rdi - 8]
call qword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
mov rax, qword [rdi - 8]
sub rax, qword [rdi - 0x10]
mov qword [rdi - 0x30], rax
lea rcx, [rsi + 0x400]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
push r9
push r9
push qword [rsi + 0x20]
push 2
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
add rsp, 0x40
test rax, rax
je 0x4019ad
xchg rbp, rax
lea rcx, [rdi - 0x10]
call qword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
mov r14, qword [rsi + 0x28]
mov r12, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov rcx, rbx
lea rdx, [rdi + 0x7c8]
mov r8, r12
lea r9, [rdi - 0x18]
xor eax, eax
mov qword [r9], rax
push rax
push rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_ReadFile]
add rsp, 0x30
test rax, rax
je 0x4019ad
mov rcx, rbp
lea rdx, [rdi + 0x7c8]
mov r8, r12
lea r9, [rdi - 0x18]
xor eax, eax
mov qword [r9], rax
push rax
push rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_WriteFile]
add rsp, 0x30
test rax, rax
je 0x4019ad
dec r13
jne 0x401911
mov rcx, rbx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov rcx, rbp
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_SetFilePointer]
dec r14
jne 0x401909
lea rcx, [rdi - 8]
call qword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
mov rax, qword [rdi - 8]
sub rax, qword [rdi - 0x10]
mov qword [rdi - 0x28], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test rax, rax
je 0x4019c5
lea rcx, [rsi + 0x30]
call qword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test rax, rax
je 0x4019e4
lea rcx, [rsi + 0x400]
call qword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov qword [rdi - 0x20], rax
add rsp, 0x20
pop rbp
pop rbp
mov rsp, rbp
pop r15
pop r14
pop r13
pop r12
pop rbp
pop rdi
pop rsi
pop rbx
pop rbx
ret