Function at 0x10005cd7
Capabilities:
Delete file
Get file size
Read file on windows
Timestomp file
Write file on windows

Disassembly:
mov eax, 0x1000d38c
call fcn.10007e9c
sub esp, 0x700
lea ecx, [ebp - 0x490]
call fcn.100068c8
and dword [ebp - 4], 0
and dword [ebp - 0x2c], 0
mov ecx, 0x100119f8
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x490]
call fcn.100069be
push 0x10010c30
push str.VENM
lea ecx, [ebp - 0x490]
call fcn.10006997
push 1
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x490]
call fcn.10006d8c
test eax, eax
je 0x10005d40
cmp dword [ebp - 0x5c], 8
jae 0x10005d47
mov dword [ebp - 0x5c], 8
lea ecx, [ebp - 0x4a8]
call fcn.10001000
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.10001000
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x54]
call fcn.10001000
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.10001000
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x44]
call fcn.10001000
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3c]
call fcn.10001000
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6c]
call fcn.10001000
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x64]
call fcn.10001000
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x28]
call fcn.10001000
mov byte [ebp - 4], 9
push 0x100119c0
lea ecx, [ebp - 0x4a8]
call fcn.10001549
push 0x10010c40
lea ecx, [ebp - 0x4c]
call fcn.10001581
push str.l.arx
lea ecx, [ebp - 0x4c]
call fcn.100017f8
push str.who
lea ecx, [ebp - 0x54]
call fcn.10001581
push str.has.arx
lea ecx, [ebp - 0x54]
call fcn.100017f8
push 0x10010c5c
lea ecx, [ebp - 0x14]
call fcn.10001581
push 0x10010c60
lea ecx, [ebp - 0x14]
call fcn.100017f8
mov dword [ebp - 0x58], 1
jmp 0x10005e24
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x5c]
ja 0x1000680c
and dword [ebp - 0x4b8], 0
cmp dword [ebp - 0x58], 6
je 0x10005e43
cmp dword [ebp - 0x58], 7
jne 0x10005e4d
mov dword [ebp - 0x4b8], 1
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x58]
call fcn.100056fa
add esp, 0xc
test eax, eax
jne 0x10005e66
jmp 0x10005e1d
mov eax, dword [ebp - 0x58]
add eax, 0xe
push eax
push 0x10010c64
lea eax, [ebp - 0x44]
push eax
call fcn.1000198b
add esp, 0xc
push str..dat
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x630]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x6a0], eax
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0x6a4], eax
mov byte [ebp - 4], 0xa
push dword [ebp - 0x6a4]
lea eax, [ebp - 0x638]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x6ac], eax
mov byte [ebp - 4], 0xb
push dword [ebp - 0x6ac]
lea eax, [ebp - 0x640]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x6b0], eax
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x6b4], eax
mov byte [ebp - 4], 0xc
push dword [ebp - 0x6b4]
lea ecx, [ebp - 0x3c]
call fcn.10001549
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x640]
call fcn.100010fa
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x638]
call fcn.100010fa
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x630]
call fcn.100010fa
lea eax, [ebp - 0x5f8]
push eax
lea ecx, [ebp - 0x3c]
call fcn.10001bf8
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 0xffffffff
jne 0x10005f72
jmp 0x10005e1d
push dword [ebp - 0x5fc]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x10010c70
lea ecx, [ebp - 0x60c]
call fcn.1000109e
mov byte [ebp - 4], 0xd
push str.ad.exe
lea ecx, [ebp - 0x60c]
call fcn.100017f8
lea eax, [ebp - 0x5f8]
push eax
lea eax, [ebp - 0x60c]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x648]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x6b8], eax
mov eax, dword [ebp - 0x6b8]
mov dword [ebp - 0x6bc], eax
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x6bc]
call fcn.10001bf8
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x5fc], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x648]
call fcn.100010fa
cmp dword [ebp - 0x5fc], 0xffffffff
jne 0x1000601d
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x60c]
call fcn.100010fa
jmp 0x10005e1d
push dword [ebp - 0x5fc]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea ecx, [ebp - 0x3c]
call fcn.10001bf8
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0xffffffff
jne 0x1000606d
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x60c]
call fcn.100010fa
jmp 0x10005e1d
push 0
push dword [ebp - 0x494]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
call fcn.10007040
pop ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x100060e8
push 0
lea eax, [ebp - 0x4a0]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x2c]
push dword [ebp - 0x494]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100060bb
cmp dword [ebp - 0x4a0], 0x400
jae 0x100060e8
push dword [ebp - 0x2c]
call fcn.10006ff8
pop ecx
and dword [ebp - 0x2c], 0
push dword [ebp - 0x494]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x60c]
call fcn.100010fa
jmp 0x10005e1d
push dword [ebp - 0x494]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 0xc]
xor eax, 0x6b
mov byte [ebp - 0x4b4], al
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 8]
mov dword [ebp - 0x604], eax
push 0x6b
lea eax, [ebp - 0x4b0]
push eax
call fcn.10005347
pop ecx
pop ecx
push 0x6b
lea eax, [ebp - 0x4ac]
push eax
call fcn.10005347
pop ecx
pop ecx
push 0x6b
lea eax, [ebp - 0x604]
push eax
call fcn.10005347
pop ecx
pop ecx
and dword [ebp - 0x600], 0
mov dword [ebp - 0x58], 0xd
jmp 0x1000616e
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x18]
jae 0x100061a5
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x58]
mov al, byte [eax]
xor al, byte [ebp - 0x4b4]
mov ecx, dword [ebp - 0x2c]
add ecx, dword [ebp - 0x58]
mov byte [ecx], al
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x58]
movzx eax, byte [eax]
mov ecx, dword [ebp - 0x600]
add ecx, eax
mov dword [ebp - 0x600], ecx
jmp 0x10006167
mov eax, dword [ebp - 0x600]
cmp eax, dword [ebp - 0x604]
jne 0x100061cf
mov eax, dword [ebp - 0x4b0]
add eax, 0xd
cmp eax, dword [ebp - 0x18]
jne 0x100061cf
mov eax, dword [ebp - 0x58]
add eax, 0xe
cmp eax, dword [ebp - 0x4ac]
je 0x100061f0
push dword [ebp - 0x2c]
call fcn.10006ff8
pop ecx
and dword [ebp - 0x2c], 0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x60c]
call fcn.100010fa
jmp 0x10005e1d
mov eax, dword [0x10011aac]
and eax, 0x10
test eax, eax
je 0x1000620b
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x18]
mov ecx, dword [0x1001009c]
mov dword [eax - 0x30], ecx
cmp dword [ebp - 0x4b8], 0
je 0x10006263
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x650]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp - 0x6c0]
mov dword [ebp - 0x6c4], eax
mov byte [ebp - 4], 0xf
push dword [ebp - 0x6c4]
lea ecx, [ebp - 0x28]
call fcn.10001549
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x650]
call fcn.100010fa
jmp 0x100062ec
lea eax, [ebp - 0x4c]
push eax
push 0x10010c7c
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x658]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x6c8], eax
mov eax, dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], eax
mov byte [ebp - 4], 0x10
push dword [ebp - 0x6cc]
lea eax, [ebp - 0x660]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x6d0], eax
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0x6d4], eax
mov byte [ebp - 4], 0x11
push dword [ebp - 0x6d4]
lea ecx, [ebp - 0x28]
call fcn.10001549
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x660]
call fcn.100010fa
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x658]
call fcn.100010fa
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea ecx, [ebp - 0x28]
call fcn.10001bf8
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0xffffffff
je 0x10006355
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x49c]
push eax
push dword [ebp - 0x494]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x10006349
mov dword [ebp - 0x30], 0x1c48792
mov dword [ebp - 0x34], 0x8aed3500
push dword [ebp - 0x494]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x664], esp
lea eax, [ebp - 0x28]
push eax
call fcn.1000104f
call fcn.100031d5
pop ecx
pop ecx
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea ecx, [ebp - 0x28]
call fcn.10001bf8
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0xffffffff
je 0x1000644f
push 0
push 0
push 0
push dword [ebp - 0x494]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x4a0]
push eax
push dword [ebp - 0x4b0]
mov eax, dword [ebp - 0x2c]
add eax, 0xd
push eax
push dword [ebp - 0x494]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x494]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [ebp - 0x494]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x58], 5
jne 0x1000644f
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x66c]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x6d8], eax
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x6dc], eax
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x6dc]
call fcn.10001bf8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x66c]
call fcn.100010fa
push dword [ebp - 0x2c]
call fcn.10006ff8
pop ecx
cmp dword [ebp - 0x4b8], 0
jne 0x100067f8
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
push str..lsp
lea eax, [ebp - 0x6c]
push eax
push str._support_
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x674]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x6e0], eax
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0x6e4], eax
mov byte [ebp - 4], 0x13
push dword [ebp - 0x6e4]
lea eax, [ebp - 0x67c]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x6ec], eax
mov byte [ebp - 4], 0x14
push dword [ebp - 0x6ec]
lea eax, [ebp - 0x684]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x6f0], eax
mov eax, dword [ebp - 0x6f0]
mov dword [ebp - 0x6f4], eax
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x6f4]
call fcn.10001bf8
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x494], eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x684]
call fcn.100010fa
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x67c]
call fcn.100010fa
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x674]
call fcn.100010fa
cmp dword [ebp - 0x494], 0xffffffff
je 0x100067f8
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x49c]
push eax
push dword [ebp - 0x494]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push 0
push dword [ebp - 0x494]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x61c], eax
mov eax, dword [ebp - 0x61c]
inc eax
push eax
call fcn.10007040
pop ecx
mov dword [ebp - 0x610], eax
push 0
lea eax, [ebp - 0x4a0]
push eax
push dword [ebp - 0x61c]
push dword [ebp - 0x610]
push dword [ebp - 0x494]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x610]
add eax, dword [ebp - 0x61c]
and byte [eax], 0
push dword [ebp - 0x610]
lea ecx, [ebp - 0x624]
call fcn.1000109e
mov byte [ebp - 4], 0x16
push dword [ebp - 0x610]
call fcn.10006ff8
pop ecx
push str._r_n_arxl
lea ecx, [ebp - 0x618]
call fcn.1000109e
mov byte [ebp - 4], 0x17
push str.oad_
lea ecx, [ebp - 0x618]
call fcn.100017f8
push 0x10010cac
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x68c]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x6f8], eax
mov eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x6fc], eax
mov byte [ebp - 4], 0x18
push dword [ebp - 0x6fc]
lea ecx, [ebp - 0x618]
call fcn.100017d9
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x68c]
call fcn.100010fa
lea ecx, [ebp - 0x618]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x624]
call fcn.100014ae
test eax, eax
jge 0x100067da
push str._r_n_if__not
lea ecx, [ebp - 0x624]
call fcn.100014ae
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 0
jge 0x100066de
push 2
push 0
push 0
push dword [ebp - 0x494]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x4a0]
push eax
lea ecx, [ebp - 0x618]
call fcn.10001409
push eax
lea ecx, [ebp - 0x618]
call fcn.10001bf8
push eax
push dword [ebp - 0x494]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x100067c2
push dword [ebp - 0x628]
lea eax, [ebp - 0x694]
push eax
lea ecx, [ebp - 0x624]
call fcn.10001830
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x700]
mov dword [ebp - 0x704], eax
mov byte [ebp - 4], 0x19
push dword [ebp - 0x704]
lea ecx, [ebp - 0x624]
call fcn.10001549
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x694]
call fcn.100010fa
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x69c]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x708], eax
mov eax, dword [ebp - 0x708]
mov dword [ebp - 0x70c], eax
mov byte [ebp - 4], 0x1a
push dword [ebp - 0x70c]
lea ecx, [ebp - 0x624]
call fcn.10001549
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x69c]
call fcn.100010fa
push 0
push 0
push dword [ebp - 0x628]
push dword [ebp - 0x494]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x4a0]
push eax
lea ecx, [ebp - 0x624]
call fcn.10001409
push eax
lea ecx, [ebp - 0x624]
call fcn.10001bf8
push eax
push dword [ebp - 0x494]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x494]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x618]
call fcn.100010fa
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x624]
call fcn.100010fa
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x60c]
call fcn.100010fa
jmp 0x10005e1d
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x28]
call fcn.100010fa
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x64]
call fcn.100010fa
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6c]
call fcn.100010fa
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3c]
call fcn.100010fa
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x44]
call fcn.100010fa
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.100010fa
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x54]
call fcn.100010fa
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.100010fa
and byte [ebp - 4], 0
lea ecx, [ebp - 0x4a8]
call fcn.100010fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x490]
call fcn.10006944
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret