Function at 0x10001d60
Capabilities:
Delete file
Move file
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x218
push ebx
push ebp
push esi
mov esi, dword [esp + 0x228]
push edi
push 0
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
je 0x10001d96
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x218
ret
push 0x1003016c
push esi
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x10001fff
mov ebp, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push esi
call ebp
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
push 2
push 0xfffffffffffffffc
push esi
mov ebx, eax
call ebp
add esp, 0x1c
test eax, eax
push esi
je 0x10001dea
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push 4
lea eax, [esp + 0x1c]
push 1
push eax
call edi
add esp, 0x10
cmp eax, 4
je 0x10001e1a
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret
lea edx, [esp + 0x14]
mov ecx, 0x10030164
mov eax, dword [edx]
mov edx, dword [ecx]
cmp eax, edx
je 0x10001e42
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret
push 2
push 0xfffffffffffffff8
push esi
call ebp
push esi
push 4
lea ecx, [esp + 0x2c]
push 1
push ecx
call edi
add esp, 0x1c
cmp eax, 4
je 0x10001e74
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret
mov edi, dword [esp + 0x18]
cmp edi, ebx
jl 0x10001e93
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, 0xfffffff8
push 2
sub edx, edi
mov ebx, eax
push edx
push esi
call ebp
push esi
push edi
push 1
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x20
cmp eax, edi
je 0x10001ede
test ebx, ebx
je 0x10001ec7
push ebx
call fcn.10010220
add esp, 4
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
test edi, edi
jle 0x10001fff
mov dl, byte [ebx]
xor ecx, ecx
mov cl, byte [ebx + 1]
cmp dl, 6
je 0x10001f10
lea eax, [eax + ecx + 2]
lea ebx, [ebx + ecx + 2]
cmp eax, edi
jge 0x10001fff
jmp 0x10001ef2
mov ebp, dword [ebx + 1]
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
lea edx, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x22c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
mov edx, eax
add esp, 8
test edx, edx
je 0x10001fff
mov edi, str.undo.tmp
or ecx, 0xffffffff
xor eax, eax
push 0x10030154
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x10001fff
push esi
push ebp
lea edx, [ebx + 5]
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
push ebx
call fcn.10010220
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x18
xor esi, esi
mov ebx, dword [esp + 0x22c]
push ebx
call ebp
test eax, eax
jne 0x10001fe7
push 0x3e8
call edi
inc esi
cmp esi, 5
jl 0x10001fcc
lea eax, [esp + 0x1c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x10001fff
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret