Function at 0x10002737c
Capabilities:
Check if file exists
Delete file
Move file
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0x150
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x148], rax
mov rbp, r8
mov qword [rsp + 0x48], r8
mov r13, rdx
mov r12, rcx
lea r9, [0x1001653b8]
mov ebx, 1
mov rcx, qword [0x1001653b8]
cmp rcx, r9
je 0x100027401
test byte [rcx + 0x1c], bl
je 0x100027401
cmp byte [rcx + 0x19], 4
jb 0x100027401
mov edx, 0xea
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001c7b8
mov rcx, qword [0x1001653b8]
lea r9, [0x1001653b8]
or r10, 0xffffffffffffffff
mov qword [rsp + 0x60], r10
mov qword [rsp + 0x50], r10
and qword [rsp + 0x58], 0
xor r14b, r14b
mov dword [rsp + 0x40], r14d
movdqu xmm0, xmmword [0x100001fe0]
movdqu xmmword [rsp + 0x138], xmm0
and dword [rsp + 0x44], 0
lea rdx, [0x100001fe0]
mov r8, qword [r13]
cmp r8, qword [rdx]
jne 0x100027451
mov r8, qword [r13 + 8]
cmp r8, qword [rdx + 8]
jne 0x100027451
xor eax, eax
jmp 0x100027456
sbb eax, eax
sbb eax, r10d
test eax, eax
jne 0x100027493
cmp rcx, r9
je 0x100027486
test byte [rcx + 0x1c], bl
je 0x100027486
cmp byte [rcx + 0x19], 2
jb 0x100027486
mov edx, 0xeb
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001c7b8
mov rcx, qword [0x1001653b8]
mov edi, 0x80070057
mov r12, rbx
jmp 0x100027cc1
test byte [r12 + 0x150], bl
je 0x1000274c1
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, rbp
call fcn.10009b4ec
mov edi, eax
test eax, eax
js 0x100027ca4
mov rbx, qword [rsp + 0x58]
jmp 0x10002756b
lea r8, [rsp + 0x58]
lea rdx, [0x100004ab0]
mov rcx, qword [r12 + 0x248]
call fcn.10009b5b0
mov edi, eax
test eax, eax
js 0x100027ca4
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10002756b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 2
je 0x100027566
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
cmp rcx, r13
je 0x10002754d
mov r12d, 1
test byte [rcx + 0x1c], r12b
je 0x100027553
cmp byte [rcx + 0x19], 2
jb 0x100027553
mov edx, 0xec
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001daa4
mov rcx, qword [0x1001653b8]
jmp 0x100027553
mov r12d, 1
movzx edi, bp
or edi, 0x80070000
test ebp, ebp
cmovle edi, ebp
jmp 0x100027bfe
mov rbp, qword [rsp + 0x48]
cmp dword [r12 + 0x14c], 4
setne al
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov byte [rsp + 0x30], al
and qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80
mov r9d, 2
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rbx
call fcn.10009d520
mov edi, eax
test eax, eax
jns 0x100027611
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
cmp rcx, r13
je 0x100027601
mov r12d, 1
test byte [rcx + 0x1c], r12b
je 0x100027607
cmp byte [rcx + 0x19], 2
jb 0x100027607
mov edx, 0xed
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001daa4
mov r14, qword [rsp + 0x50]
mov rcx, qword [0x1001653b8]
jmp 0x100027bd5
mov r12d, 1
mov r14, qword [rsp + 0x50]
jmp 0x100027bd5
mov edi, 1
test byte [r12 + 0x150], dil
movzx r14d, r14b
cmovne r14d, edi
mov dword [rsp + 0x40], r14d
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8d, [rdi + 0xf]
mov rdx, r13
mov r14, qword [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000276b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
cmp rcx, r13
je 0x100027699
test byte [rcx + 0x1c], dil
je 0x100027699
cmp byte [rcx + 0x19], 2
jb 0x100027699
mov edx, 0xee
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001daa4
mov rcx, qword [0x1001653b8]
movzx edi, bp
or edi, 0x80070000
test ebp, ebp
cmovle edi, ebp
mov r12d, 1
jmp 0x100027bd5
mov r9d, dword [rsp + 0x44]
cmp r9d, 0x10
je 0x10002771c
mov edi, 0x8007045d
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
cmp rcx, r13
je 0x100027bcf
mov r12d, 1
test byte [rcx + 0x1c], r12b
je 0x100027bd5
cmp byte [rcx + 0x19], 2
jb 0x100027bd5
mov edx, 0xef
mov dword [rsp + 0x20], 0x10
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001e8b4
mov rcx, qword [0x1001653b8]
jmp 0x100027bd5
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x1000277a0
call qword [sym.imp.ntdll.dll_RtlGetLastNtStatus]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
cmp rcx, r13
je 0x100027787
mov r12d, 1
test byte [rcx + 0x1c], r12b
je 0x10002778d
cmp byte [rcx + 0x19], 2
jb 0x10002778d
mov edx, 0xf0
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001dd64
mov rcx, qword [0x1001653b8]
jmp 0x10002778d
mov r12d, 1
movzx edi, bp
or edi, 0x80070000
test ebp, ebp
cmovle edi, ebp
jmp 0x100027bd5
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or r14, 0xffffffffffffffff
test byte [r12 + 0x150], dil
jne 0x100027845
mov r8d, edi
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x100027840
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
cmp rcx, r13
je 0x100027822
test byte [rcx + 0x1c], dil
je 0x100027822
cmp byte [rcx + 0x19], 2
jb 0x100027822
mov edx, 0xf1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001e360
mov rcx, qword [0x1001653b8]
movzx edi, bp
or edi, 0x80070000
test ebp, ebp
cmovle edi, ebp
mov r14d, dword [rsp + 0x40]
mov r12d, 1
jmp 0x100027bfe
mov byte [rsp + 0x40], dil
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x30], 0
and qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x2000000
mov r9d, 3
mov r8d, edi
mov edx, 0x80000000
mov rcx, rbp
call fcn.10009d520
mov edi, eax
xor ebx, ebx
cmp eax, ebx
jge 0x1000278d7
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
cmp rcx, r13
je 0x100027b8c
lea r12d, [rbx + 1]
test byte [rcx + 0x1c], r12b
je 0x100027bb3
cmp byte [rcx + 0x19], 2
jb 0x100027bb3
mov edx, 0xf2
mov dword [rsp + 0x20], eax
mov r9, rbp
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001daa4
mov rcx, qword [0x1001653b8]
jmp 0x100027bb3
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x44]
mov r8d, 0x10
lea rdx, [rsp + 0x138]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
jne 0x10002796f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, ebx
cmovle edi, eax
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
cmp rcx, r13
je 0x100027b84
mov r12d, 1
test byte [rcx + 0x1c], r12b
je 0x100027bb3
cmp byte [rcx + 0x19], 2
jb 0x100027bb3
mov edx, 0xf3
mov dword [rsp + 0x20], edi
mov r9, rbp
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001daa4
mov rcx, qword [0x1001653b8]
jmp 0x100027bb3
cmp dword [rsp + 0x44], 0x10
jne 0x100027add
lea rax, [rsp + 0x138]
mov rdx, qword [rax]
cmp rdx, qword [r13]
jne 0x100027999
mov rdx, qword [rax + 8]
cmp rdx, qword [r13 + 8]
jne 0x100027999
mov eax, ebx
jmp 0x10002799e
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x100027add
test byte [r12 + 0x150], 0x80
je 0x100027ac4
cmp byte [r12 + 0x11c], bl
je 0x100027ac4
mov ecx, 0x40
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x50], rax
cmp rax, rbx
je 0x1000279e4
mov rcx, rax
call fcn.100043fcc
mov rbp, rax
jmp 0x1000279e7
mov rbp, rbx
mov rdx, qword [rsp + 0x48]
mov rcx, rbp
call fcn.10001ec50
mov edi, eax
cmp eax, ebx
jl 0x100027ac4
mov r8d, 0x10
mov rdx, r13
mov rcx, rbp
call fcn.10001ef7c
mov edi, eax
cmp eax, ebx
jge 0x100027a6a
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
cmp rcx, r13
je 0x100027b7c
mov r12d, 1
test byte [rcx + 0x1c], r12b
je 0x100027bb3
cmp byte [rcx + 0x19], 2
jb 0x100027bb3
mov edx, 0xf5
mov r9d, eax
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001c7dc
mov rcx, qword [0x1001653b8]
jmp 0x100027bb3
lea rbx, [r12 + 0x308]
mov r12, qword [rbx + 8]
cmp r12, qword [rbx + 0x10]
jb 0x100027a98
lea rdx, [r12 + 1]
mov rcx, rbx
call fcn.100043a28
test al, al
jne 0x100027a98
mov ecx, 0x8007000e
call fcn.100019658
int3
mov rax, qword [rbx]
lea rcx, [rax + r12*8]
test rcx, rcx
je 0x100027aa7
mov qword [rcx], rbp
mov r12d, 1
add qword [rbx + 8], r12
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
jmp 0x100027bb3
mov rcx, qword [0x1001653b8]
mov r12d, 1
lea r13, [0x1001653b8]
jmp 0x100027bb3
mov edi, 0x8007045d
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100027b94
mov r12d, 1
test byte [rcx + 0x1c], r12b
je 0x100027bac
cmp byte [rcx + 0x19], 2
jb 0x100027ba3
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0x70]
call fcn.10009b2bc
mov rbx, rax
mov rdx, r13
lea rcx, [rsp + 0xd4]
call fcn.10009b2bc
mov edx, 0xf4
mov dword [rsp + 0x30], 0x10
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x10
mov r9, rax
lea r8, [0x100003d08]
mov rcx, qword [0x1001653b8]
mov rcx, qword [rcx + 0x10]
call fcn.10001de0c
mov rcx, qword [0x1001653b8]
lea r13, [0x1001653b8]
jmp 0x100027bb3
mov r12d, 1
jmp 0x100027bb3
mov r12d, 1
jmp 0x100027bb3
mov r12d, 1
jmp 0x100027bb3
mov r12d, 1
lea r13, [0x1001653b8]
jmp 0x100027bb3
lea r13, [0x1001653b8]
jmp 0x100027bb3
lea r13, [0x1001653b8]
cmp qword [rsp + 0x60], 0xffffffffffffffff
je 0x100027bf2
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1001653b8]
jmp 0x100027bd5
mov r12d, 1
cmp r14, 0xffffffffffffffff
je 0x100027bf9
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1001653b8]
mov r14d, dword [rsp + 0x40]
jmp 0x100027bfe
mov r14d, dword [rsp + 0x40]
jmp 0x100027bfe
mov r14d, dword [rsp + 0x40]
test edi, edi
jns 0x100027cc1
test r14b, r14b
je 0x100027cc1
cmp rcx, r13
je 0x100027c44
mov ebx, 1
test byte [rcx + 0x1c], bl
je 0x100027c49
cmp byte [rcx + 0x19], 4
jb 0x100027c49
mov edx, 0xf6
mov dword [rsp + 0x20], edi
mov r9, qword [rsp + 0x48]
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001daa4
jmp 0x100027c49
mov ebx, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call fcn.10009d894
test eax, eax
jns 0x100027ca4
mov rcx, qword [0x1001653b8]
cmp rcx, r13
je 0x100027cee
test byte [rcx + 0x1c], bl
je 0x100027cbb
cmp byte [rcx + 0x19], 2
jb 0x100027cb3
mov edx, 0xf7
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x48]
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001daa4
mov rcx, qword [0x1001653b8]
mov r12d, 1
jmp 0x100027cc1
mov rcx, qword [0x1001653b8]
mov r12d, 1
jmp 0x100027cc1
mov r12d, 1
jmp 0x100027cc1
mov r12d, 1
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100027cee
test byte [rcx + 0x1c], r12b
je 0x100027cee
cmp byte [rcx + 0x19], 4
jb 0x100027cee
mov edx, pe_nt_image_headers64
lea r8, [0x100003d08]
mov rcx, qword [rcx + 0x10]
call fcn.10001c7b8
mov eax, edi
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.10014e480
mov rbx, qword [rsp + 0x198]
add rsp, 0x150
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret