Function at 0x10010b84c
Capabilities:
Check if file exists
Delete file
Move file
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rdi, rcx
mov ecx, r8d
mov r15, r9
mov ebx, r8d
mov r13, rdx
call fcn.1000a35bc
or qword [rsp + 0x48], 0xffffffffffffffff
and dword [rsp + 0x40], 0
mov esi, eax
and esi, 1
lea rbp, [0x1001653b8]
lea r12, [0x100002f60]
je 0x10010b97a
mov rcx, rdi
mov r14, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10010b8ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10010b8ef
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x10010b8ef
test byte [rcx + 0x1c], 1
je 0x10010b8ef
cmp byte [rcx + 0x19], 3
jb 0x10010b8ef
mov rcx, qword [rcx + 0x10]
mov edx, 0x15
mov r9, rdi
mov r8, r12
mov dword [rsp + 0x20], eax
call fcn.10001ddb0
lea rcx, [rsp + 0x48]
cmp ebx, 4
mov r9d, 2
mov qword [rsp + 0x38], rcx
setne al
mov rcx, r14
mov byte [rsp + 0x30], al
and qword [rsp + 0x28], 0
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 0x80
call fcn.10009daf8
mov ebx, eax
test eax, eax
jns 0x10010b9ff
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x10010b968
test byte [rcx + 0x1c], 1
je 0x10010b968
cmp byte [rcx + 0x19], 2
jb 0x10010b968
mov rcx, qword [rcx + 0x10]
mov edx, 0x17
mov r9, r14
mov r8, r12
mov dword [rsp + 0x20], eax
call fcn.10001ddb0
mov rcx, qword [0x1001653b8]
mov rdi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x80]
jmp 0x10010bb6a
mov rcx, r13
mov r14, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10010b8ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 2
je 0x10010b8ef
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
lea r12, [0x100002f60]
cmp rcx, rbp
je 0x10010b9e4
test byte [rcx + 0x1c], 1
je 0x10010b9e4
cmp byte [rcx + 0x19], 2
jb 0x10010b9e4
mov rcx, qword [rcx + 0x10]
mov edx, 0x16
mov r9, r13
mov r8, r12
mov dword [rsp + 0x20], eax
call fcn.10001ddb0
mov rcx, qword [0x1001653b8]
mov r14, qword [rsp + 0x80]
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x10010bb80
test r15, r15
jne 0x10010ba1c
lea r8, [0x1000124a8]
lea rcx, [0x100012468]
mov edx, 0x1b8
call fcn.10009a050
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r15
and qword [rsp + 0x20], rax
repne scasw ax, word [rdi]
mov rdi, qword [rsp + 0x48]
not rcx
lea r9, [rsp + 0x40]
mov rdx, r15
lea r8d, [rcx + rcx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10010ba9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x10010ba8d
test byte [rcx + 0x1c], 1
je 0x10010ba8d
cmp byte [rcx + 0x19], 2
jb 0x10010ba8d
mov rcx, qword [rcx + 0x10]
mov edx, 0x18
mov r9, r14
mov r8, r12
mov dword [rsp + 0x20], eax
call fcn.10001ddb0
mov rcx, qword [0x1001653b8]
mov r14, qword [rsp + 0x80]
jmp 0x10010bb5c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x10010baed
call qword [sym.imp.ntdll.dll_RtlGetLastNtStatus]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x10010ba8d
test byte [rcx + 0x1c], 1
je 0x10010ba8d
cmp byte [rcx + 0x19], 2
jb 0x10010ba8d
mov rcx, qword [rcx + 0x10]
mov edx, 0x19
mov r9, r14
mov r8, r12
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call fcn.10001e4b0
jmp 0x10010ba86
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x80]
or rdi, 0xffffffffffffffff
test esi, esi
jne 0x10010bb79
lea r8d, [rdi + 0xa]
mov rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x10010bb79
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x10010bb5c
test byte [rcx + 0x1c], 1
je 0x10010bb5c
cmp byte [rcx + 0x19], 2
jb 0x10010bb5c
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
lea edx, [rdi + 0x1b]
mov r9, r13
mov r8, r12
mov qword [rsp + 0x20], r14
call fcn.10001e39c
mov rcx, qword [0x1001653b8]
movzx ebx, si
or ebx, 0x80070000
test esi, esi
cmovle ebx, esi
cmp rdi, 0xffffffffffffffff
je 0x10010bb80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1001653b8]
test ebx, ebx
jns 0x10010bbad
cmp rcx, rbp
je 0x10010bbad
test byte [rcx + 0x1c], 1
je 0x10010bbad
cmp byte [rcx + 0x19], 2
jb 0x10010bbad
mov rcx, qword [rcx + 0x10]
mov edx, 0x1b
mov r9, r14
mov r8, r12
mov dword [rsp + 0x20], ebx
call fcn.10001ddb0
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret