Function at 0x1001ebc0
Capabilities:
Delete file
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x338
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x334], eax
mov eax, dword [esp + 0x33c]
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x24], ecx
cmp dword [0x101e06b4], ebx
je 0x1001ef56
cmp ecx, ebx
je 0x1001ef56
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push eax
xor ebp, ebp
call esi
mov edi, eax
mov dword [esp + 0x20], edi
cmp edi, 0xffffffff
je 0x1001ef47
lea eax, [esp + 0x18]
push eax
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1001ef3c
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
jl 0x1001ef3c
mov eax, dword [esp + 0x18]
jg 0x1001ec5c
cmp eax, 0x108
jbe 0x1001ef3c
push ebx
add eax, 0xffffff00
push ebx
adc ecx, 0xffffffff
push ecx
push eax
push edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1001ef3c
push 0xff
lea ecx, [esp + 0x245]
push ebx
push ecx
mov byte [esp + 0x24c], bl
call fcn.100d4cc0
push 0xff
lea edx, [esp + 0x151]
push ebx
push edx
mov byte [esp + 0x158], bl
call fcn.100d4cc0
add esp, 0x18
push ebx
lea eax, [esp + 0x18]
push eax
push 0x100
lea ecx, [esp + 0x24c]
push ecx
push edi
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001ef3c
cmp dword [esp + 0x14], 0x100
jne 0x1001ef3c
mov edx, dword [0x101e06b8]
push 3
push edx
lea eax, [esp + 0x148]
push eax
lea ecx, [esp + 0x24c]
push ecx
push 0x100
call fcn.1006d950
mov dword [esp + 0x28], eax
add esp, 0x14
mov ecx, 0x100
lea eax, [esp + 0x140]
call fcn.1001df60
cmp dword [esp + 0x14], 0x100
jne 0x1001ef3c
mov ecx, 0x20
lea eax, [esp + 0x19c]
call fcn.1001df60
push 0xec
lea edx, [esp + 0x30]
push ebx
push edx
mov dword [esp + 0x34], ebx
call fcn.100d4cc0
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1ac]
push 0x100
push ecx
mov dword [esp + 0x130], ebx
call fcn.1006c040
add esp, 0x18
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x24]
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push edx
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x1001ef38
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 0x121], eax
mov dword [esp + 0x125], eax
mov dword [esp + 0x129], eax
mov word [esp + 0x12d], ax
mov byte [esp + 0x12f], al
mov dword [esp + 0x131], eax
mov dword [esp + 0x135], eax
mov dword [esp + 0x139], eax
mov word [esp + 0x13d], ax
mov byte [esp + 0x13f], al
mov eax, dword [esp + 0x18]
add eax, 0xfffffff8
adc ecx, 0xffffffff
mov byte [esp + 0x120], bl
mov byte [esp + 0x130], bl
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
js 0x1001ee27
jg 0x1001ee1e
cmp eax, 0x6400000
jbe 0x1001ee27
mov esi, 0xf00000
xor ebp, ebp
jmp 0x1001ee52
mov esi, eax
add esi, 0xff600000
mov edx, ecx
adc edx, 0xffffffff
cmp edx, ebx
ja 0x1001ee4b
jb 0x1001ee42
cmp esi, 0x5a00000
ja 0x1001ee4b
mov esi, 0xa00000
xor ebp, ebp
jmp 0x1001ee52
mov esi, eax
and esi, 0xfffffff0
mov ebp, ecx
cmp ecx, ebx
jl 0x1001ef2c
jg 0x1001ee64
cmp eax, ebx
jbe 0x1001ef2c
cmp ecx, ebx
jl 0x1001ee74
jg 0x1001ee6f
cmp eax, 0x10
jb 0x1001ee74
mov eax, 0x10
push ebx
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x12c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001ef2c
mov eax, dword [esp + 0x14]
cmp eax, ebx
jbe 0x1001ef2c
cmp eax, 0x10
jne 0x1001eeee
cmp ebp, ebx
jl 0x1001eeee
jg 0x1001eeb1
cmp esi, eax
jb 0x1001eeee
push ebx
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x138]
push edx
lea eax, [esp + 0x12c]
push eax
call fcn.100723d0
add esp, 0x10
push ebx
lea ecx, [esp + 0x18]
push ecx
push 0x10
lea edx, [esp + 0x13c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esi, 0xfffffff0
adc ebp, 0xffffffff
jmp 0x1001ef04
push ebx
lea ecx, [esp + 0x18]
push ecx
push eax
lea edx, [esp + 0x12c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
sbb ecx, ebx
cmp ecx, ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
jg 0x1001ee6f
jl 0x1001ef2c
cmp eax, ebx
ja 0x1001ee64
push edi
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, ebx
jne 0x1001ef52
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, ebp
jmp 0x1001ef58
xor eax, eax
mov ecx, dword [esp + 0x344]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0x338
ret 4