Function at 0xf0487ae
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor ebx, ebx
inc ebx
push edi
mov dword [ebp - 8], 0x80
mov dword [ebp - 0xc], ebx
mov eax, dword fs:[0x18]
push dword [ebp + 8]
lea edi, [eax + 0xbf8]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
push 0
lea eax, [ebp - 0x14]
push eax
push edi
call dword [0xf09bd38]
test eax, eax
jl 0xf0489f0
mov edx, dword [ebp + 0xc]
test dl, 8
je 0xf048805
mov eax, 0x80070001
jmp 0xf0489f0
mov ecx, dword [ebp + 0x14]
mov eax, ecx
and eax, 0xf
sub eax, 0
push esi
je 0xf04883d
dec eax
je 0xf04882d
dec eax
jne 0xf0489ea
not cl
movzx esi, cl
and esi, 0x10
or esi, 0x40
shr esi, 4
jmp 0xf048849
and cl, 0x10
neg cl
sbb ecx, ecx
neg ecx
add ecx, 3
mov esi, ecx
jmp 0xf048849
cmp cx, 0x10
jne 0xf0489ea
mov esi, ebx
movzx eax, dx
mov ecx, eax
and ecx, 0x70
je 0xf048888
cmp ecx, 0x10
je 0xf048882
cmp ecx, 0x20
je 0xf04887d
cmp ecx, 0x30
je 0xf048874
cmp ecx, 0x40
jne 0xf0489ea
mov dword [ebp + 8], 3
jmp 0xf04888f
mov dword [ebp + 8], 2
jmp 0xf04888f
mov dword [ebp + 8], ebx
jmp 0xf04888f
and dword [ebp + 8], 0
jmp 0xf04888f
mov dword [ebp + 8], 7
and eax, 0xf
sub eax, 0
mov ecx, 0x80000000
je 0xf0488ae
dec eax
je 0xf048923
dec eax
je 0xf04891c
dec eax
dec eax
jne 0xf0489ea
mov ebx, ecx
test dh, 0x98
jne 0xf0489ea
test dh, 1
je 0xf0488c5
mov dword [ebp - 8], 0x20000080
test dh, 0x40
je 0xf0488cd
or dword [ebp - 8], ecx
push edi
call fcn.0f04640f
mov eax, dword [ebp + 0x10]
and dword [ebp - 0x1c], 0
push 0
and eax, 0x27
or eax, dword [ebp - 8]
mov dword [ebp - 0x20], 0xc
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x18], 1
push ebx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call esi
cmp edi, 0xffffffff
jne 0xf04892a
or eax, 0x80070000
jmp 0xf0489ef
mov ebx, 0xc0000000
jmp 0xf0488b0
mov ebx, 0x40000000
jmp 0xf0488b0
cmp eax, 0xb7
jne 0xf048970
cmp word [ebp + 0x14], 0x12
jne 0xf04897d
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0xf048976
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0xf048967
call esi
mov esi, eax
push edi
or esi, 0x80070000
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0xf0489ef
mov dword [ebp - 0xc], 3
jmp 0xf04897d
test byte [ebp + 0x14], 0x10
je 0xf04897d
mov dword [ebp - 0xc], 2
push 0
lea eax, [ebp - 4]
push eax
push 0
call sym.ntvdm.exe_VDDAllocateDosHandle
mov esi, eax
test si, si
jge 0xf0489a2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movsx eax, si
neg eax
jmp 0xf048912
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
xor ecx, ecx
mov cl, al
and eax, 0x80
shl eax, 5
and ecx, 0x7f
mov word [edx + 2], cx
mov ecx, dword [ebp - 4]
mov byte [ecx + 4], 0
mov ecx, dword [ebp - 4]
mov word [ecx + 5], ax
mov eax, dword [ebp - 4]
or dword [eax + 7], 0xffffffff
mov eax, dword [ebp - 4]
mov cx, word [ebp - 0xc]
mov dword [eax + 0x1d], edi
mov eax, dword [ebp + 0x20]
mov word [eax], cx
mov eax, dword [ebp + 0x1c]
mov word [eax], si
xor eax, eax
jmp 0xf0489ef
mov eax, 0x80070057
pop esi
pop edi
pop ebx
leave
ret 0x1c