Function at 0x1000eaa0
Capabilities:
Delete file
Get common file path
Get disk information
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x568
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x564], eax
push ebx
push ebp
mov ebp, dword [esp + 0x574]
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x24], ebp
mov byte [esp + 0x13], bl
cmp byte [0x101e06bc], bl
jne 0x1000eb98
cmp byte [0x101e06bd], bl
jne 0x1000edba
push 0x40e
lea ecx, [esp + 0x166]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x16c], ax
call fcn.100d4cc0
add esp, 0xc
push ebx
push 0x28
lea edx, [esp + 0x168]
push edx
push ebx
mov byte [0x101e06bd], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1000eb8c
push 0xffffffffffffffff
lea eax, [esp + 0x164]
push eax
mov ecx, 0x101e06bc
call fcn.1000e730
test al, al
jne 0x1000eb8c
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x14], eax
xor esi, esi
test al, 1
je 0x1000eb7a
lea ecx, [esi + 0x41]
push ecx
push str._c:_
mov eax, 0x410
lea ebx, [esp + 0x168]
call fcn.1000ede0
add esp, 8
push 3
mov edx, ebx
push edx
mov ecx, 0x101e06bc
call fcn.1000e730
xor ebx, ebx
test al, al
jne 0x1000eb8c
mov eax, dword [esp + 0x14]
shr eax, 1
mov dword [esp + 0x14], eax
je 0x1000eb8c
inc esi
cmp esi, 0x1a
jl 0x1000eb44
cmp byte [0x101e06bc], bl
je 0x1000edba
cmp edi, ebx
je 0x1000edba
cmp ebp, ebx
je 0x1000edba
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push edi
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x1000edba
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push ebp
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x1000edad
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp ecx, ebx
mov dword [esp + 0x14], ebx
mov byte [esp + 0x140], bl
mov dword [esp + 0x141], eax
mov dword [esp + 0x145], eax
mov dword [esp + 0x149], eax
mov dword [esp + 0x14d], eax
mov dword [esp + 0x151], eax
mov dword [esp + 0x155], eax
mov dword [esp + 0x159], eax
mov word [esp + 0x15d], ax
mov byte [esp + 0x15f], al
mov byte [esp + 0x120], bl
mov dword [esp + 0x121], eax
mov dword [esp + 0x125], eax
mov dword [esp + 0x129], eax
mov dword [esp + 0x12d], eax
mov dword [esp + 0x131], eax
mov dword [esp + 0x135], eax
mov dword [esp + 0x139], eax
mov word [esp + 0x13d], ax
mov byte [esp + 0x13f], al
jl 0x1000eda6
mov eax, dword [esp + 0x18]
jg 0x1000eca4
cmp eax, ebx
jbe 0x1000eda6
cmp ecx, ebx
jl 0x1000ecb4
jg 0x1000ecaf
cmp eax, 0x10
jbe 0x1000ecb4
mov eax, 0x10
push ebx
lea ecx, [esp + 0x18]
push ecx
push eax
lea edx, [esp + 0x14c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000eda6
mov eax, dword [esp + 0x14]
cmp eax, ebx
jbe 0x1000eda6
cmp eax, 0x10
jne 0x1000eda6
add dword [esp + 0x18], 0xfffffff0
push 0xec
lea eax, [esp + 0x30]
adc dword [esp + 0x20], 0xffffffff
push ebx
push eax
mov dword [esp + 0x34], ebx
call fcn.100d4cc0
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
push 0x100
push 0x101e06be
mov dword [esp + 0x124], ebx
call fcn.1006c040
add esp, 0xc
push ebx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x128]
push eax
lea ecx, [esp + 0x14c]
push ecx
call fcn.100723d0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, eax
add esp, 0x10
or edx, ecx
jne 0x1000ed6e
mov dl, byte [esp + 0x12f]
cmp dl, 0x10
jg 0x1000eda6
mov ebp, dword [esp + 0x24]
movsx edx, dl
sub dword [esp + 0x14], edx
mov byte [esp + 0x13], 1
mov edx, dword [esp + 0x14]
cmp edx, ebx
jbe 0x1000ed94
push ebx
lea eax, [esp + 0x18]
push eax
push edx
lea ecx, [esp + 0x12c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
cmp ecx, ebx
jg 0x1000ecaf
jl 0x1000eda6
cmp eax, ebx
ja 0x1000eca4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x13], bl
jne 0x1000edc1
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x574]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0x568
ret 4