Function at 0x1000a02f0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x340
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x100142128]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov rsi, rdx
mov rbp, rcx
xor edx, edx
mov r8d, 0x20c
lea rcx, [r11 - 0x248]
call sub.msvcrt.dll_memset
mov edx, 0x105
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x70]
call fcn.10002d07c
nop
lea r8, [0x10000de80]
mov rdx, rax
lea rcx, [rsp + 0xc8]
call fcn.100039e4c
nop
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.10002d1f0
nop
xor r12d, r12d
cmp qword [rsp + 0xe8], 8
jb 0x1000a03ac
mov rcx, qword [rsp + 0xd0]
cmp rcx, r12
je 0x1000a03ac
call sub.msvcrt.dll_free
mov r14d, 7
mov qword [rsp + 0xe8], r14
mov qword [rsp + 0xe0], r12
mov word [rsp + 0xd0], r12w
lea rcx, [rsp + 0x70]
call fcn.10002d0d8
lea r8, [0x100001f74]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x20]
call fcn.100039e4c
nop
mov r8, rbp
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.10004845c
nop
lea r8, [0x10000de90]
mov rdx, rax
lea rcx, [rsp + 0xc8]
call fcn.100039e4c
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.10002d1f0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.10002cd2c
nop
lea rcx, [rsp + 0x70]
call fcn.10002d0d8
nop
cmp qword [rsp + 0xe8], 8
jb 0x1000a0463
mov rcx, qword [rsp + 0xd0]
cmp rcx, r12
je 0x1000a0463
call sub.msvcrt.dll_free
mov qword [rsp + 0xe8], r14
mov qword [rsp + 0xe0], r12
mov word [rsp + 0xd0], r12w
cmp qword [rsp + 0x68], 8
jb 0x1000a0493
mov rcx, qword [rsp + 0x50]
cmp rcx, r12
je 0x1000a0493
call sub.msvcrt.dll_free
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r12
mov word [rsp + 0x50], r12w
cmp qword [rsp + 0x40], 8
jb 0x1000a04ba
mov rcx, qword [rsp + 0x28]
cmp rcx, r12
je 0x1000a04ba
call sub.msvcrt.dll_free
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r12
mov word [rsp + 0x28], r12w
cmp qword [rsi + 0x20], 8
jb 0x1000a04da
lea rdi, [rsi + 8]
mov rcx, qword [rdi]
jmp 0x1000a04e1
lea rdi, [rsi + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1000a0672
mov rdx, rbp
lea rcx, [rsp + 0xf0]
call fcn.10009fea8
mov r8d, eax
lea rdx, [0x10000dea0]
lea rcx, [rsp + 0xa0]
call fcn.10009ef30
mov rbx, rax
lea r8, [0x100001f74]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x70]
call fcn.100039e4c
nop
mov r8, rbp
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.10004845c
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.10004845c
nop
mov rdx, rax
lea rcx, [rsp + 0xc8]
call fcn.10002d1f0
nop
cmp qword [rsp + 0x40], 8
jb 0x1000a057e
mov rcx, qword [rsp + 0x28]
cmp rcx, r12
je 0x1000a057e
call sub.msvcrt.dll_free
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r12
mov word [rsp + 0x28], r12w
cmp qword [rsp + 0x68], 8
jb 0x1000a05a5
mov rcx, qword [rsp + 0x50]
cmp rcx, r12
je 0x1000a05a5
call sub.msvcrt.dll_free
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r12
mov word [rsp + 0x50], r12w
cmp qword [rsp + 0x90], 8
jb 0x1000a05cf
mov rcx, qword [rsp + 0x78]
cmp rcx, r12
je 0x1000a05cf
call sub.msvcrt.dll_free
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x88], r12
mov word [rsp + 0x78], r12w
lea rcx, [rsp + 0xa0]
call fcn.10002d0d8
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1000a0637
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rdx, qword [rsp + 0xd0]
cmp qword [rsi + 0x20], 8
jb 0x1000a065b
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
nop
lea rcx, [rsp + 0xc8]
call fcn.10002d0d8
mov rcx, rsi
call fcn.1000a022c
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.10002d0d8
mov rax, rbx
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.1000c8b30
mov rbx, qword [rsp + 0x380]
add rsp, 0x340
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret