Function at 0x10002cae8
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
xor r13d, r13d
mov rdi, rcx
mov r14, r13
mov qword [rax + 0x18], r13
mov r12, r13
mov qword [rax + 0x10], r13
mov qword [rax + 0x20], r13
mov qword [rax + 8], r13
cmp qword [rcx + 0x1d8], r13
jne 0x10002cb38
lea r8, [0x100004b40]
lea rcx, [0x1000046e0]
mov edx, 0x1f41
call fcn.100099ad8
test byte [rdi + 0x150], 4
lea rsi, [0x1001653b8]
je 0x10002cbfe
mov rcx, qword [rdi + 0x1d8]
lea r9, [rsp + 0x90]
xor r8d, r8d
xor edx, edx
call fcn.100122cb4
mov r14, qword [rsp + 0x90]
cmp eax, r13d
mov ebx, eax
jl 0x10002cea8
lea rdx, [rsp + 0x88]
mov rcx, r14
call fcn.10010bcc8
mov r12, qword [rsp + 0x88]
cmp eax, r13d
mov ebx, eax
jl 0x10002ce9a
cmp r12, r13
je 0x10002cbfe
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r13d
jne 0x10002cbfe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002cbea
test byte [rcx + 0x1c], 1
je 0x10002cbea
cmp byte [rcx + 0x19], 2
jb 0x10002cbea
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003d08]
mov edx, 0x169
mov r9, r12
mov dword [rsp + 0x20], eax
call fcn.10001daa4
movzx ebx, di
or ebx, 0x80070000
cmp edi, r13d
cmovle ebx, edi
jmp 0x10002ce9a
mov rcx, qword [rdi + 0x1d8]
lea r9, [rsp + 0x98]
lea rdx, [rdi + 0x130]
xor r8d, r8d
call fcn.100122cb4
mov r15, qword [rsp + 0x98]
cmp eax, r13d
mov ebx, eax
jl 0x10002ce85
test byte [rdi + 0x150], 1
je 0x10002cd25
lea rdx, [rsp + 0x80]
xor r8d, r8d
mov rcx, r15
call fcn.10009b4ec
cmp eax, r13d
mov ebx, eax
jl 0x10002ce6f
mov rbp, qword [rsp + 0x80]
cmp qword [rdi + 0x190], r13
jne 0x10002cc83
lea r8, [0x100004b88]
lea rcx, [0x1000046e0]
mov edx, 0x1f8c
call fcn.100099ad8
mov rcx, qword [rdi + 0x190]
mov rdx, rbp
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, r13d
mov ebx, eax
jl 0x10002ce77
test byte [rdi + 0x150], 1
jne 0x10002cdc8
mov r8d, 1
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, r13d
jne 0x10002cdc8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10002cd11
test byte [rcx + 0x1c], 1
je 0x10002cd11
cmp byte [rcx + 0x19], 2
jb 0x10002cd11
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003d08]
mov edx, 0x16b
mov r9, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r15
call fcn.10001e360
movzx ebx, di
or ebx, 0x80070000
cmp edi, r13d
cmovle ebx, edi
jmp 0x10002ce77
mov rcx, qword [rdi + 0x1d8]
lea r9, [rsp + 0x80]
lea rdx, [rdi + 0x130]
mov r8b, 1
call fcn.100122cb4
cmp eax, r13d
mov ebx, eax
jl 0x10002ce6f
mov rbp, qword [rsp + 0x80]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r13d
jne 0x10002cc62
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 2
je 0x10002cc62
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10002cdb4
test byte [rcx + 0x1c], 1
je 0x10002cdb4
cmp byte [rcx + 0x19], 2
jb 0x10002cdb4
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003d08]
mov edx, 0x16a
mov r9, rbp
mov dword [rsp + 0x20], esi
call fcn.10001daa4
movzx ebx, si
or ebx, 0x80070000
cmp esi, r13d
cmovle ebx, esi
jmp 0x10002ce77
test byte [rdi + 0x150], 0x80
je 0x10002ce77
cmp byte [rdi + 0x11c], r13b
je 0x10002ce77
mov ecx, 0x20
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rsi, rax
cmp rax, r13
je 0x10002ce0c
lea rax, [0x100005ca8]
mov byte [rsi + 8], r13b
mov qword [rsi + 0x18], r13
mov qword [rsi], rax
mov qword [rsi + 0x10], r13
jmp 0x10002ce0f
mov rsi, r13
mov rdx, r15
mov rcx, rsi
call fcn.10001f93c
cmp eax, r13d
mov ebx, eax
jl 0x10002ce77
mov r13, qword [rdi + 0x310]
cmp r13, qword [rdi + 0x318]
jb 0x10002ce50
lea rdx, [r13 + 1]
lea rcx, [rdi + 0x308]
call fcn.100043a28
test al, al
jne 0x10002ce50
mov ecx, 0x8007000e
call fcn.100019658
int3
mov rax, qword [rdi + 0x308]
lea rcx, [rax + r13*8]
xor r13d, r13d
cmp rcx, r13
je 0x10002ce66
mov qword [rcx], rsi
inc qword [rdi + 0x310]
jmp 0x10002ce77
mov rbp, qword [rsp + 0x80]
cmp rbp, r13
je 0x10002ce85
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp r15, r13
je 0x10002ce93
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rsi, [0x1001653b8]
cmp r12, r13
je 0x10002cea8
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp r14, r13
je 0x10002ceb6
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp ebx, r13d
jge 0x10002ceeb
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x10002ceeb
test byte [rcx + 0x1c], 1
je 0x10002ceeb
cmp byte [rcx + 0x19], 2
jb 0x10002ceeb
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003d08]
mov edx, 0x16c
mov r9d, ebx
call fcn.10001c7dc
mov eax, ebx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret