Function at 0x1000f270
Capabilities:
Delete file
Get common file path
Get file size
Read file via mapping
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014ebef
mov eax, dword fs:[0]
push eax
sub esp, 0x37c
mov eax, dword [0x101a5034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x308], ecx
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x1000f2cf
mov byte [ebp - 0x31d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10002d10
mov al, byte [ebp - 0x31d]
jmp 0x1000fd7e
mov eax, dword [ebp + 8]
push eax
push 0
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
jne 0x1000f332
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcess_fail___d_
push 3
push 0xed
push 0x1015f7d0
push 0x1015f828
call fcn.10142a80
add esp, 0x18
mov byte [ebp - 0x316], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10002d10
mov al, byte [ebp - 0x316]
jmp 0x1000fd7e
mov dword [ebp - 0x36c], 0x14
mov dword [ebp - 0x25c], 0
xor ecx, ecx
mov dword [ebp - 0x258], ecx
mov dword [ebp - 0x254], ecx
mov dword [ebp - 0x250], ecx
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x300], 0
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x33c], 0xa
mov dword [ebp - 0x30c], 0
mov byte [ebp - 0x301], 0
lea edx, [ebp - 0x300]
push edx
mov eax, dword [ebp - 0x36c]
push eax
lea ecx, [ebp - 0x25c]
push ecx
push 0x10
mov edx, dword [ebp - 0x308]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x338], eax
mov ecx, dword [ebp - 0x300]
push ecx
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0
je 0x1000f410
lea edx, [ebp - 0x300]
push edx
mov eax, dword [ebp - 0x300]
push eax
mov ecx, dword [ebp - 0x30c]
push ecx
push 0x10
mov edx, dword [ebp - 0x308]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0
jne 0x1000f410
mov byte [ebp - 0x301], 1
jmp 0x1000f43c
mov ecx, dword [ebp - 0x33c]
sub ecx, 1
mov dword [ebp - 0x33c], ecx
mov edx, dword [ebp - 0x30c]
push edx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
cmp dword [ebp - 0x33c], 0
jg 0x1000f38f
movzx eax, byte [ebp - 0x301]
test eax, eax
jne 0x1000f475
mov ecx, dword [ebp - 0x324]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x31a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10002d10
mov al, byte [ebp - 0x31a]
jmp 0x1000fd7e
push 8
lea ecx, [ebp - 0x224]
call fcn.10001980
lea ecx, [ebp - 0x224]
call fcn.100125b0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x224]
push edx
mov ecx, dword [ebp - 0x308]
call fcn.1000ee60
mov dword [ebp - 0x2f4], 0
mov byte [ebp - 0x301], 0
cmp dword [ebp - 0x30c], 0
je 0x1000fadc
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x380], 0
xor ecx, ecx
mov dword [ebp - 0x37c], ecx
mov dword [ebp - 0x2f0], 0
mov dword [ebp - 0x330], 0
jmp 0x1000f504
mov edx, dword [ebp - 0x330]
add edx, 1
mov dword [ebp - 0x330], edx
mov eax, dword [ebp - 0x340]
mov ecx, dword [ebp - 0x330]
cmp ecx, dword [eax]
jae 0x1000fadc
mov edx, dword [ebp - 0x330]
shl edx, 4
mov eax, dword [ebp - 0x340]
mov ecx, dword [eax + edx + 4]
cmp ecx, dword [ebp + 8]
je 0x1000f532
jmp 0x1000f4f5
mov edx, dword [ebp - 0x330]
shl edx, 4
mov eax, dword [ebp - 0x340]
movzx ecx, word [eax + edx + 0xa]
mov dword [ebp - 0x354], ecx
push 2
push 0
push 0
lea edx, [ebp - 0x2f0]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov eax, dword [ebp - 0x354]
push eax
mov ecx, dword [ebp - 0x324]
push ecx
mov edx, dword [ebp - 0x308]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
je 0x1000f58d
jmp 0x1000f4f5
xor ecx, ecx
mov word [ebp - 0x2ec], cx
push 0x5e
push 0
lea edx, [ebp - 0x2ea]
push edx
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x2fc], 0
lea eax, [ebp - 0x2fc]
push eax
push 0x60
lea ecx, [ebp - 0x2ec]
push ecx
push 2
mov edx, dword [ebp - 0x2f0]
push edx
mov eax, dword [ebp - 0x308]
mov ecx, dword [eax + 8]
call ecx
mov edx, dword [ebp - 0x2fc]
push edx
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0
jne 0x1000f608
mov eax, dword [ebp - 0x2f0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000f4f5
mov ecx, dword [ebp - 0x2fc]
push ecx
push 0
mov edx, dword [ebp - 0x314]
push edx
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2fc]
push eax
mov ecx, dword [ebp - 0x2fc]
push ecx
mov edx, dword [ebp - 0x314]
push edx
push 2
mov eax, dword [ebp - 0x2f0]
push eax
mov ecx, dword [ebp - 0x308]
mov edx, dword [ecx + 8]
call edx
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
je 0x1000f67a
mov eax, dword [ebp - 0x2f0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x314]
push ecx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
jmp 0x1000f4f5
mov dword [ebp - 0x32c], 0x1015f7c4
mov edx, dword [ebp - 0x32c]
add edx, 2
mov dword [ebp - 0x358], edx
mov eax, dword [ebp - 0x32c]
mov cx, word [eax]
mov word [ebp - 0x346], cx
add dword [ebp - 0x32c], 2
cmp word [ebp - 0x346], 0
jne 0x1000f693
mov edx, dword [ebp - 0x32c]
sub edx, dword [ebp - 0x358]
sar edx, 1
mov dword [ebp - 0x368], edx
mov eax, dword [ebp - 0x368]
push eax
push str.File
mov ecx, dword [ebp - 0x314]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.MSVCR120.dll_wcsncmp]
add esp, 0xc
test eax, eax
je 0x1000f70d
mov eax, dword [ebp - 0x2f0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x314]
push ecx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
jmp 0x1000f4f5
mov edx, dword [ebp - 0x314]
push edx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
xor eax, eax
mov word [ebp - 0x230], ax
xor ecx, ecx
mov dword [ebp - 0x22e], ecx
mov word [ebp - 0x22a], cx
mov dword [ebp - 0x2f8], 0
lea edx, [ebp - 0x2f8]
push edx
push 8
lea eax, [ebp - 0x230]
push eax
push 1
mov ecx, dword [ebp - 0x2f0]
push ecx
mov edx, dword [ebp - 0x308]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x328], eax
mov ecx, dword [ebp - 0x2f8]
push ecx
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0
jne 0x1000f79a
mov edx, dword [ebp - 0x2f0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000f4f5
mov eax, dword [ebp - 0x2f8]
push eax
push 0
mov ecx, dword [ebp - 0x310]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
lea edx, [ebp - 0x2f8]
push edx
mov eax, dword [ebp - 0x2f8]
push eax
mov ecx, dword [ebp - 0x310]
push ecx
push 1
mov edx, dword [ebp - 0x2f0]
push edx
mov eax, dword [ebp - 0x308]
mov ecx, dword [eax + 8]
call ecx
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
je 0x1000f80c
mov edx, dword [ebp - 0x2f0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x310]
push eax
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
jmp 0x1000f4f5
mov ecx, dword [ebp - 0x310]
movzx edx, word [ecx]
test edx, edx
jne 0x1000f83b
mov eax, dword [ebp - 0x2f0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x310]
push ecx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
jmp 0x1000f4f5
mov edx, dword [ebp - 0x310]
mov eax, dword [edx + 4]
mov dword [ebp - 0x35c], eax
mov ecx, dword [ebp - 0x35c]
push ecx
lea ecx, [ebp - 0x248]
call fcn.10002c60
mov byte [ebp - 4], 2
push 4
lea ecx, [ebp - 0x21c]
call fcn.10001980
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x224]
call fcn.100126d0
jmp 0x1000f88c
lea ecx, [ebp - 0x21c]
call fcn.10012970
lea eax, [ebp - 0x378]
push eax
lea ecx, [ebp - 0x224]
call fcn.10004530
push eax
lea ecx, [ebp - 0x21c]
call fcn.10003dd0
movzx ecx, al
test ecx, ecx
je 0x1000f982
lea ecx, [ebp - 0x21c]
call fcn.10012950
push eax
lea ecx, [ebp - 0x274]
call fcn.10003060
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x21c]
call fcn.10012950
add eax, 0x18
push eax
lea ecx, [ebp - 0x28c]
call fcn.10003060
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x274]
call fcn.10002460
mov dword [ebp - 0x360], eax
push 0
lea edx, [ebp - 0x274]
push edx
lea ecx, [ebp - 0x248]
call fcn.10012560
cmp eax, 0xffffffff
je 0x1000f95f
lea eax, [ebp - 0x28c]
push eax
mov ecx, dword [ebp - 0x360]
push ecx
push 0
lea ecx, [ebp - 0x248]
call fcn.10012530
push eax
lea ecx, [ebp - 0x248]
call fcn.100023a0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28c]
call fcn.10002d10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x274]
call fcn.10002d10
jmp 0x1000f982
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28c]
call fcn.10002d10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x274]
call fcn.10002d10
jmp 0x1000f881
mov edx, dword [ebp - 0x310]
push edx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov eax, dword [ebp - 0x2f0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x384], esp
lea edx, [ebp + 0xc]
push edx
call fcn.10003060
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x374], eax
mov byte [ebp - 4], 5
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x388], esp
lea edx, [ebp - 0x248]
push edx
call fcn.10003060
mov dword [ebp - 0x370], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x308]
call fcn.1000f110
mov byte [ebp - 0x318], al
movzx eax, byte [ebp - 0x318]
test eax, eax
je 0x1000fac8
push 2
push 0
push 0
lea ecx, [ebp - 0x2f4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov edx, dword [ebp - 0x354]
push edx
mov eax, dword [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x1000fab0
mov ecx, dword [ebp - 0x30c]
push ecx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov edx, dword [ebp - 0x324]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.DuplicateHandle_fail_
push 3
push 0x185
push 0x1015f890
push 0x1015f8e8
call fcn.10142a80
add esp, 0x14
mov byte [ebp - 0x31c], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
call fcn.10002d10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.1000fda0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10002d10
mov al, byte [ebp - 0x31c]
jmp 0x1000fd7e
mov byte [ebp - 0x301], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
call fcn.10002d10
jmp 0x1000fadc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
call fcn.10002d10
jmp 0x1000f4f5
mov eax, dword [ebp - 0x30c]
push eax
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov ecx, dword [ebp - 0x324]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx edx, byte [ebp - 0x301]
test edx, edx
jne 0x1000fb52
push str.Found_file_fail_
push 3
push 0x193
push 0x1015f988
push 0x1015f93c
call fcn.10142a80
add esp, 0x14
mov byte [ebp - 0x315], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.1000fda0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10002d10
mov al, byte [ebp - 0x315]
jmp 0x1000fd7e
mov dword [ebp - 0x344], 0
push 0
mov eax, dword [ebp - 0x2f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x344], eax
lea ecx, [ebp - 0x218]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x218]
push edx
mov ecx, dword [ebp + 0x24]
call fcn.10006e00
push str.historyTmp.db
mov ecx, dword [ebp + 0x24]
call fcn.1000b470
mov ecx, dword [ebp + 0x24]
call fcn.10001960
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 0x24]
call fcn.10001960
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0xffffffff
jne 0x1000fc36
mov eax, dword [ebp - 0x2f4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Create_file_fail_
push 3
push 0x1a9
push 0x1015fa20
push 0x1015fa78
call fcn.10142a80
add esp, 0x14
mov byte [ebp - 0x317], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.1000fda0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10002d10
mov al, byte [ebp - 0x317]
jmp 0x1000fd7e
push 0
push 0
push 0
push 2
push 0
mov ecx, dword [ebp - 0x2f4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0
jne 0x1000fcc4
mov edx, dword [ebp - 0x2f4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.CreateFileMapping_fail_
push 3
push 0x1b2
push 0x1015fad8
push str.CEdgeHelper::MyCopyFile
call fcn.10142a80
add esp, 0x14
mov byte [ebp - 0x319], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.1000fda0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10002d10
mov al, byte [ebp - 0x319]
jmp 0x1000fd7e
push 0
push 0
push 0
push 4
mov ecx, dword [ebp - 0x334]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
je 0x1000fd1f
cmp dword [ebp - 0x344], 0
jbe 0x1000fd1f
mov dword [ebp - 0x228], 0
push 0
lea edx, [ebp - 0x228]
push edx
mov eax, dword [ebp - 0x344]
push eax
mov ecx, dword [ebp - 0x34c]
push ecx
mov edx, dword [ebp - 0x350]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x34c]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0x334]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x350]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2f4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x31b], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.1000fda0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10002d10
mov al, byte [ebp - 0x31b]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c66b
mov esp, ebp
pop ebp
ret 0x20