Function at 0x1000bf8c
Capabilities:
Delete file
Move file
Set file attributes
Write file on windows

Disassembly:
push 0x20
mov eax, 0x1002eb23
call fcn.1001b6e1
mov esi, ecx
mov eax, dword [esi + 0x10]
add eax, dword [esi + 0xc]
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
je 0x1000bfc1
push dword [ebp + 8]
call fcn.1001b19f
pop ecx
mov dword [ebp - 0x1c], eax
jmp 0x1000bfc4
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
and eax, 0x7ff8ffa9
add eax, 0x80070057
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
js 0x1000c0a4
mov edi, str..tmp
push edi
call fcn.1001b19f
pop ecx
mov ecx, dword [ebp - 0x1c]
add eax, ecx
lea eax, [eax + eax + 2]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call ebx
test eax, eax
mov dword [ebp - 0x14], eax
jne 0x1000c01a
mov dword [ebp - 0x10], 0x8007000e
jmp 0x1000c09f
mov eax, dword [ebp - 0x1c]
add eax, eax
push eax
push dword [ebp + 8]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x14]
call fcn.1001c3b0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
add eax, ecx
push edi
push eax
call fcn.1001cbdd
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 8]
xor edi, edi
add esp, 0x14
cmp ecx, edi
je 0x1000c090
add eax, ecx
mov dword [ebp - 0x28], eax
imul eax, dword [ebp - 0x20]
push eax
push edi
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
mov ebx, eax
cmp ebx, edi
mov dword [ebp - 0x18], ebx
je 0x1000c00e
mov eax, dword [esi]
cmp eax, edi
je 0x1000c084
mov edi, dword [esi + 8]
imul edi, dword [ebp - 0x20]
push edi
push eax
push ebx
call fcn.1001c3b0
add esp, 0xc
add edi, ebx
push edi
mov ecx, esi
call fcn.1000b763
jmp 0x1000c09f
mov dword [ebp - 0x28], eax
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x20], ebx
jl 0x1000c1e7
push dword [ebp - 0x28]
mov ecx, esi
push dword [ebp - 0x18]
call fcn.1000ad7c
push 0x10
call fcn.1001b944
pop ecx
mov dword [ebp - 0x2c], eax
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x1000c0dc
push dword [ebp + 8]
mov ecx, eax
call fcn.10010a80
mov edi, eax
jmp 0x1000c0de
xor edi, edi
or dword [ebp - 4], 0xffffffff
cmp edi, ebx
mov dword [ebp - 0x20], edi
je 0x1000c109
mov ecx, edi
call fcn.1000f970
test al, al
jne 0x1000c110
push 1
mov ecx, edi
mov dword [ebp - 0x10], 0x800700a7
call fcn.1000a519
mov dword [ebp - 0x20], ebx
jmp 0x1000c110
mov dword [ebp - 0x10], 0x8007000e
cmp dword [ebp - 0x10], ebx
jl 0x1000c1e7
mov edi, 0x80
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push edi
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x1c], eax
jne 0x1000c15b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1000c158
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jl 0x1000c192
push ebx
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x24]
mov dword [ebp - 0x2c], ebx
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000c192
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1000c18f
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x1000c1af
cmp dword [ebp - 0x10], ebx
jl 0x1000c1a6
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
jl 0x1000c1e7
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0xb
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1000c1e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1000c1e4
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], ebx
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x1000c20e
mov eax, dword [ebp - 0x14]
cmp word [eax], bx
je 0x1000c201
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
je 0x1000c224
call fcn.1000f9f0
mov ecx, dword [ebp - 0x20]
push 1
call fcn.1000a519
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x1000c25a
cmp eax, dword [esi]
je 0x1000c25a
cmp dword [ebp - 0x10], ebx
jl 0x1000c24f
push ebx
mov ecx, esi
call fcn.1000bb43
mov eax, dword [ebp - 0x18]
mov dword [esi], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 8], eax
jmp 0x1000c25a
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov eax, dword [ebp - 0x10]
call fcn.1001b7b9
ret 4