Function at 0x1009e91
Capabilities:
Check if file exists
Create process on windows
Delete file
Get file attributes
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6b0
mov eax, dword [0x101fb10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x200
lea eax, [ebp - 0x508]
push eax
push 0x41d
mov dword [ebp - 0x64c], esi
call fcn.0100684a
lea eax, [ebp - 0x508]
push eax
push 0x856
push esi
call fcn.01006bbf
push esi
call fcn.010096a9
test eax, eax
je 0x100a21b
push ebx
push 0xffffffffffffffff
push 0x10016b4
push 0xffffffffffffffff
push dword [0x1022578]
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringA]
dec eax
dec eax
mov ebx, 0x10019cc
je 0x1009f0e
mov ebx, 0x10019c0
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01006d86
mov edi, eax
push ebx
neg edi
push esi
lea eax, [ebp - 0x108]
sbb edi, edi
push eax
inc edi
call fcn.0101a172
xor esi, esi
cmp edi, esi
jne 0x100a1fc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100a1fc
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, 0x1021508
push ebx
call edi
lea ecx, [ebp - 0x108]
push ecx
mov dword [ebp - 0x654], eax
call edi
mov ecx, dword [ebp - 0x654]
lea edi, [ecx + eax + 0xa]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x650], eax
cmp eax, esi
jne 0x1009f9f
push esi
push 0x10
push esi
push esi
push 0x44c
jmp 0x100a20c
push ebx
lea ecx, [ebp - 0x108]
push ecx
push 0x10019b4
push edi
push eax
call fcn.01006e95
push 0x44
pop edi
push edi
lea eax, [ebp - 0x6b0]
push esi
push eax
call fcn.01010b40
mov ax, word [0x1020b50]
add esp, 0x20
mov dword [ebp - 0x6b0], edi
cmp word [0x1020b58], si
je 0x1009fe1
push 6
pop ecx
jmp 0x1009ff1
cmp ax, si
jne 0x1009fef
cmp word [0x1020b54], si
je 0x100a007
xor ecx, ecx
mov word [ebp - 0x680], cx
mov dword [ebp - 0x684], 1
cmp ax, si
jne 0x100a00b
xor eax, eax
jmp 0x100a010
mov eax, 0x8000000
lea ecx, [ebp - 0x664]
push ecx
lea ecx, [ebp - 0x6b0]
push ecx
push esi
push esi
push eax
push esi
push esi
push esi
push dword [ebp - 0x650]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x100a06b
push dword [ebp - 0x660]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x664]
call fcn.01006686
lea eax, [ebp - 0x66c]
push eax
push dword [ebp - 0x664]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x664]
call edi
jmp 0x100a0ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push 0x200
lea ecx, [ebp - 0x308]
push ecx
push esi
push eax
push esi
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push esi
push 0x10
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x650]
push 0x46c
push dword [ebp - 0x64c]
call fcn.01007006
push dword [ebp - 0x650]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x10019ac
push 0x856
push dword [ebp - 0x64c]
call fcn.01006bbf
lea eax, [ebp - 0x648]
push eax
mov edi, 0x1021814
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, dword [ebp - 0x628]
sub ebx, dword [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
push esi
push 3
push esi
push esi
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x650], eax
cmp eax, 0xffffffff
jne 0x100a11f
push esi
push 0x10
push esi
push edi
push 0x466
jmp 0x100a20c
lea eax, [ebp - 0x654]
push eax
push 1
push ebx
call fcn.0100ffcd
test eax, eax
jl 0x1009f90
push dword [ebp - 0x654]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x654], eax
push esi
cmp eax, esi
je 0x1009f91
lea ecx, [ebp - 0x668]
push ecx
push ebx
push eax
push dword [ebp - 0x650]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100a17b
push esi
push 0x10
push esi
push edi
push 0x467
jmp 0x100a20c
push dword [ebp - 0x650]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x654]
mov ebx, 0x856
push ebx
push dword [ebp - 0x64c]
call fcn.01006bbf
push dword [ebp - 0x654]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x10019ac
push ebx
push dword [ebp - 0x64c]
call fcn.01006bbf
push 0x10231e0
push esi
push 0x10019a0
push 0x10014c4
call fcn.0100693b
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x100a1e1
push 0x1021508
call esi
test dword [0x102258c], 0x10000
jne 0x100a1f4
push 0x1021710
call esi
push edi
call esi
xor eax, eax
inc eax
jmp 0x100a219
push esi
push 0x10
push esi
lea eax, [ebp - 0x108]
push eax
push 0x46d
push dword [ebp - 0x64c]
call fcn.01007006
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01010bbf
leave
ret 4