Function at 0x180003670
Capabilities:
Delete file
Move file
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x180053038]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r15d, r8d
mov r14, rdx
mov rbx, rcx
mov qword [rsp + 0x60], rcx
xor r12d, r12d
mov edi, r12d
mov rcx, qword [rcx + 0x10]
movabs rsi, 0x7ffffffffffffffe
mov rax, rsi
sub rax, rcx
cmp rax, 5
jb 0x1800039f7
mov r9, rbx
cmp qword [rbx + 0x18], 8
jb 0x1800036d5
mov r9, qword [rbx]
mov qword [rsp + 0x30], 5
lea r13, str.__new
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x40]
call fcn.1800088c0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x180003776
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003771
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800039fd
call fcn.180019ff0
movdqa xmm0, xmmword [0x18004bab0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r12w
cmp rbp, 0xffffffffffffffff
jne 0x1800037b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x180055798]
mov r10, qword [rcx]
mov r9d, eax
lea r8d, [rbp + 3]
lea rdx, str.SwapMethod___MoveFileEx:_CreateFileW_failed__d
call qword [r10 + 0x10]
jmp 0x1800038e5
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x68]
mov r8d, r15d
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180003809
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x180055798]
mov rax, qword [rcx]
mov r9d, edi
mov r8d, 2
lea rdx, str.SwapMethod___MoveFileEx:_WriteFile_failed__d
call qword [rax + 0x10]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800038e5
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x10]
mov rax, rsi
sub rax, rcx
cmp rax, 5
jb 0x180003a03
mov r9, rbx
cmp qword [rbx + 0x18], 8
jb 0x180003833
mov r9, qword [rbx]
mov qword [rsp + 0x30], 5
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x40]
call fcn.1800088c0
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18000385d
mov rdx, qword [rbx]
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebp, eax
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1800038be
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800038b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003a09
call fcn.180019ff0
test ebp, ebp
jne 0x1800038e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x180055798]
mov rax, qword [rcx]
mov r9d, edi
lea r8d, [rbp + 2]
lea rdx, str.SwapMethod___MoveFileEx:_MoveFileExW_failed__d
call qword [rax + 0x10]
mov rax, qword [rbx + 0x10]
sub rsi, rax
cmp rsi, 5
jb 0x180003a0f
mov r9, rbx
cmp qword [rbx + 0x18], 8
jb 0x180003903
mov r9, qword [rbx]
mov qword [rsp + 0x30], 5
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x40]
call fcn.1800088c0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x180003976
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003970
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800039eb
call fcn.180019ff0
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x1800039b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1800039ac
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800039f1
mov rcx, r8
call fcn.180019ff0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov eax, edi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180019fd0
mov rbx, qword [rsp + 0xd8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180021034
nop
call fcn.180021034
nop
call fcn.1800034e0
int3
call fcn.180021034
int3
call fcn.1800034e0
int3
call fcn.180021034
int3
call fcn.1800034e0
int3