Function at 0x10002cb74
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
xor r13d, r13d
mov rdi, rcx
mov r14, r13
mov qword [rax + 0x18], r13
mov r12, r13
mov qword [rax + 0x10], r13
mov qword [rax + 0x20], r13
mov qword [rax + 8], r13
cmp qword [rcx + 0x1d8], r13
jne 0x10002cbc4
lea r8, [0x100004ae0]
lea rcx, [0x100004680]
mov edx, 0x1f41
call fcn.10009a050
test byte [rdi + 0x150], 4
lea rsi, [0x1001653b8]
je 0x10002cc8a
mov rcx, qword [rdi + 0x1d8]
lea r9, [rsp + 0x90]
xor r8d, r8d
xor edx, edx
call fcn.100122d58
mov r14, qword [rsp + 0x90]
cmp eax, r13d
mov ebx, eax
jl 0x10002cf34
lea rdx, [rsp + 0x88]
mov rcx, r14
call fcn.10010c158
mov r12, qword [rsp + 0x88]
cmp eax, r13d
mov ebx, eax
jl 0x10002cf26
cmp r12, r13
je 0x10002cc8a
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r13d
jne 0x10002cc8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002cc76
test byte [rcx + 0x1c], 1
je 0x10002cc76
cmp byte [rcx + 0x19], 2
jb 0x10002cc76
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x169
mov r9, r12
mov dword [rsp + 0x20], eax
call fcn.10001ddb0
movzx ebx, di
or ebx, 0x80070000
cmp edi, r13d
cmovle ebx, edi
jmp 0x10002cf26
mov rcx, qword [rdi + 0x1d8]
lea r9, [rsp + 0x98]
lea rdx, [rdi + 0x130]
xor r8d, r8d
call fcn.100122d58
mov r15, qword [rsp + 0x98]
cmp eax, r13d
mov ebx, eax
jl 0x10002cf11
test byte [rdi + 0x150], 1
je 0x10002cdb1
lea rdx, [rsp + 0x80]
xor r8d, r8d
mov rcx, r15
call fcn.10009bac4
cmp eax, r13d
mov ebx, eax
jl 0x10002cefb
mov rbp, qword [rsp + 0x80]
cmp qword [rdi + 0x190], r13
jne 0x10002cd0f
lea r8, [0x100004b28]
lea rcx, [0x100004680]
mov edx, 0x1f8c
call fcn.10009a050
mov rcx, qword [rdi + 0x190]
mov rdx, rbp
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, r13d
mov ebx, eax
jl 0x10002cf03
test byte [rdi + 0x150], 1
jne 0x10002ce54
mov r8d, 1
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, r13d
jne 0x10002ce54
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10002cd9d
test byte [rcx + 0x1c], 1
je 0x10002cd9d
cmp byte [rcx + 0x19], 2
jb 0x10002cd9d
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x16b
mov r9, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r15
call fcn.10001e39c
movzx ebx, di
or ebx, 0x80070000
cmp edi, r13d
cmovle ebx, edi
jmp 0x10002cf03
mov rcx, qword [rdi + 0x1d8]
lea r9, [rsp + 0x80]
lea rdx, [rdi + 0x130]
mov r8b, 1
call fcn.100122d58
cmp eax, r13d
mov ebx, eax
jl 0x10002cefb
mov rbp, qword [rsp + 0x80]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r13d
jne 0x10002ccee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 2
je 0x10002ccee
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10002ce40
test byte [rcx + 0x1c], 1
je 0x10002ce40
cmp byte [rcx + 0x19], 2
jb 0x10002ce40
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x16a
mov r9, rbp
mov dword [rsp + 0x20], esi
call fcn.10001ddb0
movzx ebx, si
or ebx, 0x80070000
cmp esi, r13d
cmovle ebx, esi
jmp 0x10002cf03
test byte [rdi + 0x150], 0x80
je 0x10002cf03
cmp byte [rdi + 0x11c], r13b
je 0x10002cf03
mov ecx, 0x20
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rsi, rax
cmp rax, r13
je 0x10002ce98
lea rax, [0x100005c38]
mov byte [rsi + 8], r13b
mov qword [rsi + 0x18], r13
mov qword [rsi], rax
mov qword [rsi + 0x10], r13
jmp 0x10002ce9b
mov rsi, r13
mov rdx, r15
mov rcx, rsi
call fcn.10001f9c8
cmp eax, r13d
mov ebx, eax
jl 0x10002cf03
mov r13, qword [rdi + 0x310]
cmp r13, qword [rdi + 0x318]
jb 0x10002cedc
lea rdx, [r13 + 1]
lea rcx, [rdi + 0x308]
call fcn.10006a9e0
test al, al
jne 0x10002cedc
mov ecx, 0x8007000e
call fcn.1000196c8
int3
mov rax, qword [rdi + 0x308]
lea rcx, [rax + r13*8]
xor r13d, r13d
cmp rcx, r13
je 0x10002cef2
mov qword [rcx], rsi
inc qword [rdi + 0x310]
jmp 0x10002cf03
mov rbp, qword [rsp + 0x80]
cmp rbp, r13
je 0x10002cf11
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp r15, r13
je 0x10002cf1f
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rsi, [0x1001653b8]
cmp r12, r13
je 0x10002cf34
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp r14, r13
je 0x10002cf42
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp ebx, r13d
jge 0x10002cf77
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002cf77
test byte [rcx + 0x1c], 1
je 0x10002cf77
cmp byte [rcx + 0x19], 2
jb 0x10002cf77
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x16c
mov r9d, ebx
call fcn.10001c878
mov eax, ebx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret