Function at 0x10007910
Capabilities:
Copy file
Delete file
Encode data using xor
Get file size
Read file on windows
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x100f254b
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0xd8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10139d00]
xor eax, esp
push eax
lea eax, [esp + 0xf4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x104]
mov dword [esp + 0x1c], eax
xor eax, eax
mov esi, ecx
xor ebx, ebx
push 3
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x44]
push esi
lea eax, [esp + 0x44]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1f], bl
mov dword [esp + 0x44], ecx
call fcn.10001dc0
mov dword [esp + 0xfc], ebx
mov edi, dword [esp + 0x3c]
mov eax, edi
mov dword [esp + 0xd8], 0xf
mov dword [esp + 0xd4], ebx
mov byte [esp + 0xc4], bl
lea ebp, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100079b1
sub eax, ebp
push eax
push edi
lea ecx, [esp + 0xc8]
call fcn.10002570
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x40]
cmp eax, edx
je 0x100079dd
push eax
call fcn.100d1800
add esp, 4
mov eax, dword [esp + 0xc4]
mov ebp, 0x10
cmp dword [esp + 0xd8], ebp
jae 0x100079f9
lea eax, [esp + 0xc4]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call edi
test eax, eax
je 0x10007a26
mov eax, dword [esp + 0xc4]
cmp dword [esp + 0xd8], ebp
jae 0x10007a1d
lea eax, [esp + 0xc4]
push eax
call edi
mov al, byte [eax]
mov byte [esp + 0x17], al
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push 0x80
push 3
push ebx
xor eax, eax
push 1
push SysReAllocString
push esi
mov byte [esp + 0x100], bl
mov dword [esp + 0x101], eax
mov word [esp + 0x105], ax
mov byte [esp + 0x107], al
mov byte [esp + 0xf8], bl
mov dword [esp + 0xf9], eax
mov word [esp + 0xfd], ax
mov byte [esp + 0xff], al
call ebp
mov edi, eax
cmp edi, 0xffffffff
je 0x10007bbe
lea ecx, [esp + 0x34]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edx, dword [esp + 0x1c]
push ebx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, dword [esp + 0x1c]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x40000000
push eax
call ebp
mov ebp, eax
cmp ebp, 0xffffffff
je 0x10007bad
mov ecx, dword [0x101d32fc]
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push ecx
push edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
je 0x10007ba0
mov edx, dword [0x101d32fc]
push ebx
push ebx
push edx
push ebp
call esi
test eax, eax
je 0x10007ba0
mov eax, dword [0x101d32ec]
mov ecx, dword [0x101d32f0]
mov edx, dword [0x101d32f4]
mov dword [esp + 0x24], eax
mov eax, dword [0x101d32f8]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], eax
mov al, byte [esp + 0x17]
mov dword [esp + 0x2c], edx
xor ecx, ecx
nop
xor byte [esp + ecx + 0x24], al
inc ecx
rol al, 1
cmp ecx, 0x10
jl 0x10007b20
mov esi, dword [0x101d3300]
cmp esi, ebx
jbe 0x10007b92
push ebx
lea ecx, [esp + 0x1c]
push ecx
push 8
lea edx, [esp + 0xe8]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10007b92
cmp dword [esp + 0x18], 8
jne 0x10007b92
cmp esi, 8
jbe 0x10007b92
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0x28]
lea ecx, [esp + 0xe0]
call fcn.100077b0
push ebx
lea ecx, [esp + 0x1c]
push ecx
push 8
lea edx, [esp + 0xf0]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, dword [esp + 0x18]
jne 0x10007b36
push ebp
mov esi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10007bb1
mov esi, dword [esp + 0x20]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10007bb1
mov esi, dword [esp + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
jne 0x10007bcd
jmp 0x10007bc2
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0xd8], 0x10
jb 0x10007be7
mov ecx, dword [esp + 0xc4]
push ecx
call fcn.100d072d
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xf4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xd8]
xor ecx, esp
call fcn.100d0738
add esp, 0xec
ret 4