Function at 0x1400a4980
Capabilities:
Delete file
Get file size
Get file system object information
Move file
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x29d0]
mov eax, 0x2ad0
call fcn.1401d0dc0
sub rsp, rax
mov rax, qword [0x140263a80]
xor rax, rsp
mov qword [rbp + 0x29c0], rax
mov rsi, rdx
mov r14, rcx
movzx eax, byte [rdx]
cmp eax, 0xb
ja case.0x1400a49d5.3
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0xa50d8]
add rcx, rdx
jmp rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
xor edi, edi
mov qword [rbp - 0x60], rdi
mov edx, 0x1fd
lea rcx, [rsi + 5]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rdx, rax
lea rcx, [rsi + 7]
lea r8, [rbp - 0x70]
call fcn.1400a5110
mov rsi, qword [rbp - 0x68]
mov r8, rsi
mov rdi, qword [rbp - 0x70]
sub r8, rdi
movabs r15, 0xef2eb71fc4345239
mov rax, r15
imul r8
add rdx, r8
sar rdx, 9
mov rcx, rdx
shr rcx, 0x3f
add rcx, rdx
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x44], eax
mov rcx, qword [r14 + 0x10]
mov rax, qword [rcx]
mov r8d, 4
lea rdx, [rsp + 0x44]
call qword [rax + reloc.WS2_32.dll_htonl]
cmp rdi, rsi
je 0x1400a4a84
mov rbx, rdi
nop word [rax + rax]
mov rcx, qword [r14 + 0x10]
mov rax, qword [rcx]
mov r8d, 0x224
mov rdx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
cmp eax, 0xffffffff
je 0x1400a4ada
add rbx, 0x224
cmp rbx, rsi
jne 0x1400a4a60
test rdi, rdi
je case.0x1400a49d5.3
mov rcx, qword [rbp - 0x60]
sub rcx, rdi
mov rax, r15
imul rcx
add rdx, rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x224
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400a4b38
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a4b38
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rdi, rdi
je case.0x1400a49d5.6
mov rcx, qword [rbp - 0x60]
sub rcx, rdi
mov rax, r15
imul rcx
add rdx, rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x224
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400a4b29
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a4ad3
mov rcx, rdi
call fcn.1401d0398
xor eax, eax
jmp 0x1400a50b2
mov rcx, rdi
call fcn.1401d0398
jmp case.0x1400a49d5.3
xor edx, edx
mov r8d, 0x2b8
lea rcx, [rbp + 0x1c0]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsi + 3]
mov dword [rsp + 0x20], 0x200
mov r9d, 0x2b8
lea r8, [rbp + 0x1c0]
mov edx, 0xffffffff
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rcx, qword [r14 + 0x10]
mov rax, qword [rcx]
mov r8d, 0x104
lea rdx, [rbp + 0x1d0]
call qword [rax + 0x78]
jmp case.0x1400a49d5.3
lea rcx, [rsi + 3]
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [rsp + 0x4c]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x54], eax
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x50], eax
mov rcx, qword [r14 + 0x10]
mov rax, qword [rcx]
lea r8d, [rdi + 8]
lea rdx, [rsp + 0x50]
call qword [rax + reloc.WS2_32.dll_htonl]
xor edx, edx
mov r8d, 0x2800
lea rcx, [rbp + 0x1c0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x44], edi
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x44]
mov r8d, 0x2800
lea rdx, [rbp + 0x1c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [r14 + 0x10]
mov rax, qword [rcx]
mov r8d, dword [rsp + 0x44]
lea rdx, [rbp + 0x1c0]
call qword [rax + reloc.WS2_32.dll_htonl]
cmp eax, 0xffffffff
je 0x1400a4c7f
cmp dword [rsp + 0x44], edi
jne 0x1400a4c30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x1400a49d5.3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400a50b2
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x104
lea rcx, [rsi + 3]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
lea r8, [rax + rax]
lea rdx, [rsi + 3]
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memcpy
xor edi, edi
mov qword [rsp + 0x60], 3
mov qword [rsp + 0x70], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x7a], xmm0
mov dword [rbp - 0x76], edi
mov word [rbp - 0x72], di
mov qword [rsp + 0x58], rdi
lea rax, [rbp - 0x50]
mov qword [rsp + 0x68], rax
mov eax, 0x614
mov word [rsp + 0x78], ax
lea rcx, [rsp + 0x58]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov rcx, qword [r14 + 0x10]
lea r8d, [rdi + 1]
lea rdx, [rsp + 0x40]
test eax, eax
jne 0x1400a4d2d
mov byte [rsp + 0x40], 3
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
cmp eax, 0xffffffff
je case.0x1400a49d5.6
jmp case.0x1400a49d5.3
mov byte [rsp + 0x40], 4
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
cmp eax, 0xffffffff
je case.0x1400a49d5.6
jmp case.0x1400a49d5.3
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x104
lea rcx, [rsi + 3]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
movsxd rdi, eax
lea r8, [rdi + rdi]
lea rdx, [rsi + 3]
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memcpy
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x1c0]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsi + 5]
lea rcx, [rcx + rdi*2]
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
lea r8, [rax + rax]
lea rdx, [rsi + 7]
lea rdx, [rdx + rdi*2]
lea rcx, [rbp + 0x1c0]
call sub.VCRUNTIME140.dll_memcpy
xor edi, edi
mov qword [rsp + 0x60], 4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x7a], xmm0
mov dword [rbp - 0x76], edi
mov word [rbp - 0x72], di
mov qword [rsp + 0x58], rdi
lea rax, [rbp - 0x50]
mov qword [rsp + 0x68], rax
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x70], rax
mov eax, 0x614
mov word [rsp + 0x78], ax
lea rcx, [rsp + 0x58]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov rcx, qword [r14 + 0x10]
lea r8d, [rdi + 1]
lea rdx, [rsp + 0x40]
test eax, eax
je 0x1400a4d14
mov byte [rsp + 0x40], 4
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
cmp eax, 0xffffffff
jne case.0x1400a49d5.3
xor eax, eax
jmp 0x1400a50b2
mov ecx, dword [rsi + 1]
call qword [sym.imp.WS2_32.dll_ntohl]
lea edi, [rax - 2]
lea rbx, [rsi + 7]
mov rsi, qword [0x140269b70]
test rsi, rsi
jne 0x1400a4f46
cmp edi, 0x3f9
ja 0x1400a4e79
mov edx, 0x1fc
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rdx, rax
mov rcx, rbx
call fcn.1400ab430
jmp case.0x1400a49d5.3
movsxd rdi, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, rax
mov qword [0x140269b70], rax
mov eax, 7
nop
movups xmm0, xmmword [rbx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rbx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rbx, [rbx + 0x80]
sub rax, 1
jne 0x1400a4ea0
movups xmm0, xmmword [rbx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rbx + 0x70]
mov qword [rcx + 0x70], rax
movzx eax, byte [rbx + 0x78]
mov byte [rcx + 0x78], al
add dword [0x140269b68], 0x3f9
jmp case.0x1400a49d5.3
mov eax, edi
mov edx, dword [0x140269b68]
sub eax, edx
lea rcx, [rsi + rdx]
cmp eax, 0x3f9
ja 0x1400a4fb4
mov r8d, eax
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov eax, edi
cdq
sub eax, edx
sar eax, 1
movsxd rdx, eax
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rdx, rax
mov rcx, qword [0x140269b70]
call fcn.1400ab430
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [0x140269b70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edi, edi
mov qword [0x140269b70], rdi
mov dword [0x140269b68], edi
jmp case.0x1400a49d5.3
mov eax, 7
nop dword [rax]
movups xmm0, xmmword [rbx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rbx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rbx, [rbx + 0x80]
sub rax, 1
jne 0x1400a4fc0
movups xmm0, xmmword [rbx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rbx + 0x70]
mov qword [rcx + 0x70], rax
movzx eax, byte [rbx + 0x78]
mov byte [rcx + 0x78], al
add edx, 0x3f9
mov dword [0x140269b68], edx
jmp case.0x1400a49d5.3
mov ecx, dword [rsi + 1]
call qword [sym.imp.WS2_32.dll_ntohl]
movsxd rbx, eax
test eax, eax
jle case.0x1400a49d5.3
xor edi, edi
nop word [rax + rax]
movzx ecx, byte [rsi + rdi + 5]
call fcn.1400ab5f0
inc rdi
cmp rdi, rbx
jl 0x1400a5080
jmp case.0x1400a49d5.3
mov rcx, qword [rsi + 1]
mov qword [0x140268323], rcx
lea rdx, [0x140268323]
mov cl, 2
call fcn.1400aa2c0
mov eax, 1
mov rcx, qword [rbp + 0x29c0]
xor rcx, rsp
call fcn.1401d0310
mov rbx, qword [rsp + 0x2b10]
add rsp, 0x2ad0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret