Function at 0x10010b3bc
Capabilities:
Check if file exists
Delete file
Move file
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rdi, rcx
mov ecx, r8d
mov r15, r9
mov ebx, r8d
mov r13, rdx
call fcn.1000a31e8
or qword [rsp + 0x48], 0xffffffffffffffff
and dword [rsp + 0x40], 0
mov esi, eax
and esi, 1
lea rbp, [0x1001653b8]
lea r12, [0x100002fa0]
je 0x10010b4ea
mov rcx, rdi
mov r14, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10010b45f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10010b45f
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x10010b45f
test byte [rcx + 0x1c], 1
je 0x10010b45f
cmp byte [rcx + 0x19], 3
jb 0x10010b45f
mov rcx, qword [rcx + 0x10]
mov edx, 0x15
mov r9, rdi
mov r8, r12
mov dword [rsp + 0x20], eax
call fcn.10001daa4
lea rcx, [rsp + 0x48]
cmp ebx, 4
mov r9d, 2
mov qword [rsp + 0x38], rcx
setne al
mov rcx, r14
mov byte [rsp + 0x30], al
and qword [rsp + 0x28], 0
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 0x80
call fcn.10009d520
mov ebx, eax
test eax, eax
jns 0x10010b56f
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x10010b4d8
test byte [rcx + 0x1c], 1
je 0x10010b4d8
cmp byte [rcx + 0x19], 2
jb 0x10010b4d8
mov rcx, qword [rcx + 0x10]
mov edx, 0x17
mov r9, r14
mov r8, r12
mov dword [rsp + 0x20], eax
call fcn.10001daa4
mov rcx, qword [0x1001653b8]
mov rdi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x80]
jmp 0x10010b6da
mov rcx, r13
mov r14, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10010b45f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 2
je 0x10010b45f
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
lea r12, [0x100002fa0]
cmp rcx, rbp
je 0x10010b554
test byte [rcx + 0x1c], 1
je 0x10010b554
cmp byte [rcx + 0x19], 2
jb 0x10010b554
mov rcx, qword [rcx + 0x10]
mov edx, 0x16
mov r9, r13
mov r8, r12
mov dword [rsp + 0x20], eax
call fcn.10001daa4
mov rcx, qword [0x1001653b8]
mov r14, qword [rsp + 0x80]
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x10010b6f0
test r15, r15
jne 0x10010b58c
lea r8, [0x1000124d8]
lea rcx, [0x100012498]
mov edx, 0x1b8
call fcn.100099ad8
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r15
and qword [rsp + 0x20], rax
repne scasw ax, word [rdi]
mov rdi, qword [rsp + 0x48]
not rcx
lea r9, [rsp + 0x40]
mov rdx, r15
lea r8d, [rcx + rcx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10010b60a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x10010b5fd
test byte [rcx + 0x1c], 1
je 0x10010b5fd
cmp byte [rcx + 0x19], 2
jb 0x10010b5fd
mov rcx, qword [rcx + 0x10]
mov edx, 0x18
mov r9, r14
mov r8, r12
mov dword [rsp + 0x20], eax
call fcn.10001daa4
mov rcx, qword [0x1001653b8]
mov r14, qword [rsp + 0x80]
jmp 0x10010b6cc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x10010b65d
call qword [sym.imp.ntdll.dll_RtlGetLastNtStatus]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x10010b5fd
test byte [rcx + 0x1c], 1
je 0x10010b5fd
cmp byte [rcx + 0x19], 2
jb 0x10010b5fd
mov rcx, qword [rcx + 0x10]
mov edx, 0x19
mov r9, r14
mov r8, r12
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call fcn.10001dd64
jmp 0x10010b5f6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x80]
or rdi, 0xffffffffffffffff
test esi, esi
jne 0x10010b6e9
lea r8d, [rdi + 0xa]
mov rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x10010b6e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x10010b6cc
test byte [rcx + 0x1c], 1
je 0x10010b6cc
cmp byte [rcx + 0x19], 2
jb 0x10010b6cc
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
lea edx, [rdi + 0x1b]
mov r9, r13
mov r8, r12
mov qword [rsp + 0x20], r14
call fcn.10001e360
mov rcx, qword [0x1001653b8]
movzx ebx, si
or ebx, 0x80070000
test esi, esi
cmovle ebx, esi
cmp rdi, 0xffffffffffffffff
je 0x10010b6f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1001653b8]
test ebx, ebx
jns 0x10010b71d
cmp rcx, rbp
je 0x10010b71d
test byte [rcx + 0x1c], 1
je 0x10010b71d
cmp byte [rcx + 0x19], 2
jb 0x10010b71d
mov rcx, qword [rcx + 0x10]
mov edx, 0x1b
mov r9, r14
mov r8, r12
mov dword [rsp + 0x20], ebx
call fcn.10001daa4
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret