Function at 0x1000a5f0
Capabilities:
Copy file
Delete file
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x68
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x6c]
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x28], eax
mov byte [esp + 0x16], bl
cmp eax, ebx
je 0x1000a8e9
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
xor eax, eax
push str..keypass
push esi
mov byte [esp + 0x5c], bl
mov dword [esp + 0x5d], eax
mov dword [esp + 0x61], eax
mov dword [esp + 0x65], eax
mov dword [esp + 0x69], eax
mov dword [esp + 0x6d], eax
mov dword [esp + 0x71], eax
mov dword [esp + 0x75], eax
mov word [esp + 0x79], ax
mov byte [esp + 0x7b], al
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov byte [esp + 0x1f], bl
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push eax
call ebp
test eax, eax
je 0x1000a68c
push str..DATAWAIT
push esi
call edi
push eax
call ebp
test eax, eax
jne 0x1000a8e9
mov byte [esp + 0x17], 1
push 0x20
lea eax, [esp + 0x58]
push str.CA7605124E23306E3A5FD8AA607A1D61
push eax
call fcn.100d0e10
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 0xc
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push esi
call edi
mov dword [esp + 0x30], eax
cmp eax, 0xffffffff
je 0x1000a8c4
lea ecx, [esp + 0x18]
push ecx
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp byte [esp + 0x17], bl
je 0x1000a6ed
cmp dword [esp + 0x1c], ebx
jl 0x1000a708
mov eax, 0x25800
jmp 0x1000a6f8
cmp dword [esp + 0x1c], ebx
jl 0x1000a708
mov eax, 0x500000
jg 0x1000a700
cmp dword [esp + 0x18], eax
jbe 0x1000a708
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
push 0x20
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
cmp ebp, ebx
je 0x1000a8b3
mov edx, dword [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x28]
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x28]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x40000000
push ecx
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x1000a8ac
call fcn.1006e7a0
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
mov esi, eax
mov dword [esp + 0x24], ebx
jl 0x1000a89c
mov eax, dword [esp + 0x18]
jg 0x1000a784
cmp eax, ebx
jbe 0x1000a89c
jmp 0x1000a784
mov eax, dword [esp + 0x18]
cmp ecx, ebx
jl 0x1000a794
jg 0x1000a78f
cmp eax, 0x10
jbe 0x1000a794
mov eax, 0x10
push ebx
lea edx, [esp + 0x28]
push edx
push eax
mov eax, dword [esp + 0x3c]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000a89c
mov ecx, dword [esp + 0x24]
cmp ecx, ebx
jbe 0x1000a89c
xor eax, eax
sub dword [esp + 0x18], ecx
push ebx
lea ecx, [esp + 0x38]
sbb dword [esp + 0x20], ebx
push ecx
lea edx, [esp + 0x5c]
push edx
push ebx
mov byte [esp + 0x54], bl
mov dword [esp + 0x55], eax
mov dword [esp + 0x59], eax
mov dword [esp + 0x5d], eax
mov word [esp + 0x61], ax
mov byte [esp + 0x63], al
mov dword [esp + 0x3c], ebx
call fcn.1006f740
push eax
push esi
call fcn.1006ef70
mov eax, dword [esp + 0x3c]
push eax
push ebp
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x68]
push edx
push esi
call fcn.1006f250
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x74]
push ecx
push esi
call fcn.1006f350
mov eax, dword [esp + 0x5c]
add esp, 0x38
push ebx
lea edx, [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x50]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp byte [esp + 0x17], bl
je 0x1000a86a
cmp byte [esp + 0x43], 0xff
mov eax, 0xf
jne 0x1000a860
lea esp, [esp]
sub eax, 1
mov byte [esp + eax + 0x35], bl
js 0x1000a89c
cmp byte [esp + eax + 0x34], 0xff
je 0x1000a850
inc byte [esp + eax + 0x34]
lea eax, [esp + eax + 0x34]
jmp 0x1000a87d
mov edx, dword [esp + 0x24]
push edx
lea eax, [esp + 0x38]
push ebp
push eax
call fcn.100d0e10
add esp, 0xc
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
mov byte [esp + 0x16], 1
jg 0x1000a780
jl 0x1000a89c
mov eax, dword [esp + 0x18]
cmp eax, ebx
ja 0x1000a784
push esi
call fcn.1006f2d0
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x16], bl
jne 0x1000a8cf
mov edx, dword [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
movzx eax, byte [esp + 0x16]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.100d0738
add esp, 0x68
ret 4
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.100d0738
add esp, 0x68
ret 4