Function at 0x1400325c8
Capabilities:
Check if file exists
Delete file
Move file
Read file on windows
Write file on windows

Disassembly:
push rbp
push rbx
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov r14, r8
mov qword [rsp + 0x50], r8
mov rbx, rdx
mov qword [rsp + 0x68], rdx
mov r15, rcx
lea r9, [0x14017d3a8]
mov r12d, 1
mov rcx, qword [0x14017d3a8]
cmp rcx, r9
je 0x140032652
test byte [rcx + 0x1c], r12b
je 0x140032652
cmp byte [rcx + 0x19], 4
jb 0x140032652
mov edx, 0xfe
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001dd24
mov rcx, qword [0x14017d3a8]
lea r9, [0x14017d3a8]
or r10, 0xffffffffffffffff
mov qword [rsp + 0x60], r10
mov qword [rsp + 0x58], r10
and qword [rsp + 0x48], 0
xor r13b, r13b
mov dword [rsp + 0x40], r13d
movups xmm0, xmmword [0x14000ab48]
movdqu xmmword [rsp + 0x78], xmm0
and dword [rsp + 0x44], 0
lea rdx, [0x14000ab48]
mov r8, qword [rbx]
cmp r8, qword [rdx]
jne 0x14003269d
mov r8, qword [rbx + 8]
cmp r8, qword [rdx + 8]
jne 0x14003269d
xor eax, eax
jmp 0x1400326a2
sbb eax, eax
sbb eax, r10d
test eax, eax
jne 0x1400326dd
cmp rcx, r9
je 0x1400326d3
test byte [rcx + 0x1c], r12b
je 0x1400326d3
cmp byte [rcx + 0x19], 2
jb 0x1400326d3
mov edx, 0xff
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001dd24
mov rcx, qword [0x14017d3a8]
mov edi, 0x80070057
jmp 0x140032e27
test byte [r15 + 0x154], r12b
je 0x14003270a
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, r14
call fcn.1400a99e4
mov edi, eax
test eax, eax
js 0x140032e00
mov r12, qword [rsp + 0x48]
jmp 0x1400327ab
lea r8, [rsp + 0x48]
lea rdx, [0x140004028]
mov rcx, qword [r15 + 0x248]
call fcn.1400a9ab8
mov edi, eax
test eax, eax
js 0x140032e00
mov r12, qword [rsp + 0x48]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400327ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 2
je 0x1400327a6
mov rcx, qword [0x14017d3a8]
lea r14, [0x14017d3a8]
mov r15d, 1
cmp rcx, r14
je 0x140032793
test byte [rcx + 0x1c], r15b
je 0x140032793
cmp byte [rcx + 0x19], 2
jb 0x140032793
mov edx, 0x100
mov dword [rsp + 0x20], eax
mov r9, r12
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ecbc
mov rcx, qword [0x14017d3a8]
movzx edi, bx
or edi, 0x80070000
test ebx, ebx
cmovle edi, ebx
jmp 0x140032d75
mov rbx, qword [rsp + 0x68]
cmp dword [r15 + reloc.ADVAPI32.dll_TraceEvent], 4
setne al
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x28], al
mov dword [rsp + 0x20], 0x80
mov r9d, 2
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, r12
call fcn.1400ad8cc
mov edi, eax
test eax, eax
jns 0x140032844
mov rcx, qword [0x14017d3a8]
lea r14, [0x14017d3a8]
mov r15d, 1
cmp rcx, r14
je 0x14003283a
test byte [rcx + 0x1c], r15b
je 0x14003283a
cmp byte [rcx + 0x19], 2
jb 0x14003283a
mov edx, 0x101
mov dword [rsp + 0x20], eax
mov r9, r12
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ecbc
mov r13, qword [rsp + 0x58]
mov rcx, qword [0x14017d3a8]
jmp 0x140032d5a
mov r13, qword [rsp + 0x58]
jmp 0x140032d5a
mov edi, 1
test byte [r15 + 0x154], dil
movzx r13d, r13b
cmovne r13d, edi
mov dword [rsp + 0x40], r13d
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8d, [rdi + 0xf]
mov rdx, rbx
mov r13, qword [rsp + 0x58]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400328de
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x14017d3a8]
lea r14, [0x14017d3a8]
cmp rcx, r14
je 0x1400328cb
test byte [rcx + 0x1c], dil
je 0x1400328cb
cmp byte [rcx + 0x19], 2
jb 0x1400328cb
mov edx, 0x102
mov dword [rsp + 0x20], eax
mov r9, r12
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ecbc
mov rcx, qword [0x14017d3a8]
movzx edi, bx
or edi, 0x80070000
test ebx, ebx
cmovle edi, ebx
jmp 0x140032d54
mov r9d, dword [rsp + 0x44]
cmp r9d, 0x10
je 0x140032941
mov edi, 0x8007045d
mov rcx, qword [0x14017d3a8]
lea r14, [0x14017d3a8]
cmp rcx, r14
je 0x140032d54
mov r15d, 1
test byte [rcx + 0x1c], r15b
je 0x140032d5a
cmp byte [rcx + 0x19], 2
jb 0x140032d5a
mov edx, 0x103
mov dword [rsp + 0x20], CoRevokeClassObject
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.1400285b4
jmp 0x14003282e
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x1400329bd
call qword [sym.imp.ntdll.dll_RtlGetLastNtStatus]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x14017d3a8]
lea r14, [0x14017d3a8]
mov r15d, 1
cmp rcx, r14
je 0x1400329aa
test byte [rcx + 0x1c], r15b
je 0x1400329aa
cmp byte [rcx + 0x19], 2
jb 0x1400329aa
mov edx, 0x104
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
mov r9, r12
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.140028d10
mov rcx, qword [0x14017d3a8]
movzx edi, bx
or edi, 0x80070000
test ebx, ebx
cmovle edi, ebx
jmp 0x140032d5a
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or r13, 0xffffffffffffffff
test byte [r15 + 0x154], dil
jne 0x140032a5e
mov r8d, edi
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140032a59
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x140032a39
test byte [rcx + 0x1c], dil
je 0x140032a39
cmp byte [rcx + 0x19], 2
jb 0x140032a39
mov edx, 0x105
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r14
mov r9, r12
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.140028ec8
mov rcx, qword [0x14017d3a8]
movzx edi, bx
or edi, 0x80070000
test ebx, ebx
cmovle edi, ebx
mov r15d, 1
lea r14, [0x14017d3a8]
jmp 0x140032d70
mov byte [rsp + 0x40], dil
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], reloc.ADVAPI32.dll_TraceEvent
mov r9d, 3
mov r8d, edi
mov edx, 0x80000000
mov rcx, r14
call fcn.1400ad8cc
mov edi, eax
test eax, eax
jns 0x140032aea
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
mov r15d, 1
cmp rcx, rax
je 0x140032d35
test byte [rcx + 0x1c], r15b
je 0x140032d35
cmp byte [rcx + 0x19], 2
jb 0x140032d35
mov edx, 0x106
mov dword [rsp + 0x20], edi
mov r9, r14
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ecbc
mov rcx, qword [0x14017d3a8]
jmp 0x140032d35
and dword [rsp + 0x44], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, CoRevokeClassObject
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140032b63
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
mov r15d, 1
cmp rcx, rax
je 0x140032d35
test byte [rcx + 0x1c], r15b
je 0x140032d35
cmp byte [rcx + 0x19], 2
jb 0x140032d35
mov edx, 0x107
jmp 0x140032ac7
cmp dword [rsp + 0x44], 0x10
jne 0x140032cb3
lea rax, [rsp + 0x78]
mov rdx, qword [rax]
cmp rdx, qword [rbx]
jne 0x140032b89
mov rdx, qword [rax + 8]
cmp rdx, qword [rbx + 8]
jne 0x140032b89
xor eax, eax
jmp 0x140032b8e
sbb eax, eax
sbb eax, reloc.ADVAPI32.dll_TraceEvent
test eax, eax
jne 0x140032cb3
test byte [r15 + 0x154], 0x80
je 0x140032ca1
cmp byte [r15 + 0x114], al
je 0x140032ca1
lea ecx, [rax + 0x40]
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140032bd1
mov rcx, rax
call fcn.140052668
mov r14, rax
jmp 0x140032bd4
xor r14d, r14d
mov rdx, qword [rsp + 0x50]
mov rcx, r14
call fcn.140029a6c
mov edi, eax
test eax, eax
js 0x140032ca1
mov r8d, CoRevokeClassObject
mov rdx, rbx
mov rcx, r14
call fcn.140029d98
mov edi, eax
test eax, eax
jns 0x140032c57
mov rcx, qword [0x14017d3a8]
lea r14, [0x14017d3a8]
mov r15d, 1
cmp rcx, r14
je 0x140032d3c
test byte [rcx + 0x1c], r15b
je 0x140032d3c
cmp byte [rcx + 0x19], 2
jb 0x140032d3c
mov edx, 0x109
mov r9d, eax
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001de24
mov rcx, qword [0x14017d3a8]
jmp 0x140032d3c
lea rbx, [r15 + 0x308]
mov r15, qword [rbx + 8]
cmp r15, qword [rbx + 0x10]
jb 0x140032c83
lea rdx, [r15 + 1]
mov rcx, rbx
call fcn.14008b270
test al, al
jne 0x140032c83
mov ecx, 0x8007000e
call fcn.14001ad98
int3
mov rax, qword [rbx]
lea rcx, [rax + r15*8]
test rcx, rcx
je 0x140032c92
mov qword [rcx], r14
mov r15d, 1
add qword [rbx + 8], r15
jmp 0x140032ade
mov rcx, qword [0x14017d3a8]
mov r15d, 1
jmp 0x140032d35
mov edi, 0x8007045d
mov rcx, qword [0x14017d3a8]
lea r14, [0x14017d3a8]
mov r15d, 1
cmp rcx, r14
je 0x140032d3c
test byte [rcx + 0x1c], r15b
je 0x140032d3c
cmp byte [rcx + 0x19], 2
jb 0x140032d3c
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x70]
call fcn.1400a9700
mov rbx, rax
mov rdx, qword [rsp + 0x68]
lea rcx, [rbp]
call fcn.1400a9700
mov edx, 0x108
mov dword [rsp + 0x30], CoRevokeClassObject
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], CoRevokeClassObject
mov r9, rax
lea r8, [0x140003c28]
mov rcx, qword [0x14017d3a8]
mov rcx, qword [rcx + 0x10]
call fcn.140028db4
jmp 0x140032c4b
lea r14, [0x14017d3a8]
cmp qword [rsp + 0x60], 0xffffffffffffffff
je 0x140032d70
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14003282e
mov r15d, 1
cmp r13, 0xffffffffffffffff
je 0x140032d70
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14017d3a8]
mov r13d, dword [rsp + 0x40]
test edi, edi
jns 0x140032e0c
test r13b, r13b
je 0x140032e0c
cmp rcx, r14
je 0x140032db5
test byte [rcx + 0x1c], r15b
je 0x140032db5
cmp byte [rcx + 0x19], 4
jb 0x140032db5
mov edx, 0x10a
mov dword [rsp + 0x20], edi
mov r9, qword [rsp + 0x50]
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ecbc
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.1400adc28
test eax, eax
jns 0x140032e05
mov rcx, qword [0x14017d3a8]
cmp rcx, r14
je 0x140032e0c
test byte [rcx + 0x1c], r15b
je 0x140032e0c
cmp byte [rcx + 0x19], 2
jb 0x140032e0c
mov edx, 0x10b
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x50]
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ecbc
jmp 0x140032e05
mov r12, qword [rsp + 0x48]
mov rcx, qword [0x14017d3a8]
test r12, r12
je 0x140032e21
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
mov r12d, 1
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x140032e54
test byte [rcx + 0x1c], r12b
je 0x140032e54
cmp byte [rcx + 0x19], 4
jb 0x140032e54
mov edx, 0x10c
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001dd24
mov eax, edi
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.140168920
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret