Function at 0x1001b320
Capabilities:
Delete file
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x2d8
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x2d4], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2e4]
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x16], 0
mov byte [esp + 0x17], 0
test ebx, ebx
jne 0x1001b35a
xor al, al
jmp 0x1001b6fa
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push ebx
call esi
test eax, eax
je 0x1001b395
push ebx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov edi, eax
xor esi, esi
mov eax, dword [esi + 0x101b05c0]
push edi
push eax
call ebx
test eax, eax
je 0x1001b38c
add esi, 4
cmp esi, 0x6c
jb 0x1001b374
jmp 0x1001b391
mov byte [esp + 0x17], 1
mov ebx, dword [esp + 0x28]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [esp + 0x20], edi
cmp edi, 0xffffffff
je 0x1001b6ef
lea ecx, [esp + 0x18]
xor esi, esi
push ecx
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
add dword [esp + 0x18], 0xffffff6f
adc dword [esp + 0x1c], 0xffffffff
cmp byte [esp + 0x17], 0
jne 0x1001b413
cmp dword [esp + 0x1c], esi
jl 0x1001b40b
jg 0x1001b401
cmp dword [esp + 0x18], 0x5f5e100
jb 0x1001b40b
mov dword [esp + 0x2c], 5
jmp 0x1001b413
mov dword [esp + 0x2c], 2
push 0x91
lea edx, [esp + 0x14d]
push esi
push edx
mov byte [esp + 0x154], 0
call fcn.100d4cc0
push 0xff
lea eax, [esp + 0x1f1]
push esi
push eax
mov byte [esp + 0x1f8], 0
call fcn.100d4cc0
add esp, 0x18
push 2
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0xffffff6f
push edi
call esi
push 0
lea ecx, [esp + 0x28]
push ecx
push 0x91
lea edx, [esp + 0x154]
push edx
push edi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x24], 0x91
jne 0x1001b52c
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push str._HardWareID_:_
call edi
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
push eax
push str._HardWareID_:_
lea eax, [esp + 0x150]
push eax
call ebp
test eax, eax
jne 0x1001b528
push 0x40
lea ecx, [esp + 0x15a]
push ecx
lea edx, [esp + 0x1e8]
push edx
call fcn.100d0e10
add esp, 0xc
push str.__PUBLIC_:_
call edi
push eax
push str.__PUBLIC_:_
lea eax, [esp + 0x19e]
push eax
call ebp
test eax, eax
jne 0x1001b528
push 0x20
lea ecx, [esp + 0x1a8]
push ecx
lea edx, [esp + 0x228]
push edx
call fcn.100d0e10
push 0x40
lea eax, [esp + 0x250]
push 0x1012a4e0
push eax
call fcn.100d0e10
push 0x60
lea ecx, [esp + 0x29c]
push str.gf_i8z0fk__ds_9Ld_a_v_g_i8zfk_ds_9Ld_a_v_gf_i8zfk__ds_9Ld_a_v_gf_i8z0fk__
push ecx
call fcn.100d0e10
add esp, 0x24
mov bl, 1
mov edi, dword [esp + 0x20]
push 0
push 0
push 0
push edi
call esi
test bl, bl
je 0x1001b6dd
cmp dword [esp + 0x1c], 0
jl 0x1001b6dd
jg 0x1001b555
cmp dword [esp + 0x18], 0
jbe 0x1001b6dd
mov edx, dword [esp + 0x28]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x1001b6dd
push 0x20
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x1001b6d6
xor eax, eax
push 0xec
mov dword [esp + 0x12d], eax
mov dword [esp + 0x131], eax
mov dword [esp + 0x135], eax
mov dword [esp + 0x139], eax
mov dword [esp + 0x13d], eax
mov dword [esp + 0x141], eax
mov dword [esp + 0x145], eax
mov word [esp + 0x149], ax
mov byte [esp + 0x14b], al
lea eax, [esp + 0x38]
push ebx
push eax
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x134], bl
mov dword [esp + 0x3c], ebx
call fcn.100d4cc0
add esp, 0xc
mov dword [esp + 0x120], ebx
mov edi, edi
cmp dword [esp + 0x1c], 0
mov eax, dword [esp + 0x18]
jl 0x1001b617
jg 0x1001b612
cmp eax, 0x10
jb 0x1001b617
mov eax, 0x10
push 0
lea ecx, [esp + 0x28]
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001b6cf
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
xor bl, bl
sub eax, ecx
sbb edx, 0
mov dword [esp + 0x18], eax
or eax, edx
mov dword [esp + 0x1c], edx
jne 0x1001b650
mov bl, 1
cmp byte [esp + 0x17], 0
jne 0x1001b665
mov eax, dword [esp + 0x20]
xor edx, edx
div dword [esp + 0x2c]
test edx, edx
jne 0x1001b6ad
cmp ecx, 0x10
jne 0x1001b6ad
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x1e4]
push 0x100
push eax
call fcn.1006c040
push 0
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x13c]
push edx
push esi
call fcn.100723d0
push 0x10
lea eax, [esp + 0x148]
push eax
push esi
call fcn.100d0e10
mov ecx, dword [esp + 0x4c]
add esp, 0x28
push 0
lea edx, [esp + 0x28]
push edx
push ecx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test bl, bl
jne 0x1001b6ca
inc dword [esp + 0x20]
jmp 0x1001b600
mov byte [esp + 0x16], 1
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x16], 0
jne 0x1001b6f6
mov ebx, dword [esp + 0x28]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, byte [esp + 0x16]
mov ecx, dword [esp + 0x2e4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0x2d8
ret 4