Function at 0x2512bd10
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x26c]
push ebx
push esi
push edi
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0
mov eax, 1
lea edx, [ebp - 0x244]
lea ecx, [ebp - 0x22c]
call fcn.25126f50
call fcn.25127cb0
push eax
test eax, eax
jne 0x2512bf85
push dword [ebp - 0x26c]
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x264], eax
test dword [ebp - 0x264], 0xffffffff
jne 0x2512bda6
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x268]
mov edx, str.Twain.ProcessNative.GlobalLock
mov ax, 1
call fcn.2512d100
jmp 0x2512bf85
push dword [ebp - 0x26c]
call sub.kernel32.dll_GlobalSize
mov edi, eax
test edi, edi
je 0x2512bf85
lea ebx, [ebp - 0x220]
mov al, 0
mov edx, 0x20a
mov cl, al
mov eax, ebx
call fcn.25122150
lea eax, [ebp - 0x220]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
lea eax, [ebp - 0x250]
call fcn.25122560
push 0
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], 0
fild qword [ebp - 0x260]
lea esp, [esp - 4]
fstp dword [esp]
lea eax, [ebp - 0x254]
call fcn.2512d290
mov edx, dword [ebp - 0x254]
mov ecx, 0x25137460
lea eax, [ebp - 0x250]
call fcn.25124d00
mov eax, dword [ebp - 0x250]
lea edx, [ebp - 0x24c]
call fcn.251255b0
mov eax, dword [ebp - 0x24c]
test eax, eax
jne 0x2512be58
mov eax, 0x2513a2f0
push eax
lea eax, [ebp - 0x220]
push eax
call sub.kernel32.dll_lstrcatW
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x220]
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x2512beb9
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x268]
mov edx, str.Twain.ProcessNative.CreateFile
mov ax, 1
call fcn.2512d100
push dword [ebp - 0x26c]
call sub.kernel32.dll_GlobalUnlock
jmp 0x2512bf85
lea esi, [ebp - 0x14]
mov al, 0
mov edx, 0xe
mov cl, al
mov eax, esi
call fcn.25122150
mov word [ebp - 0x14], 0x4d42
mov dword [ebp - 0x12], 0xe
mov word [ebp - 0xe], 0
mov word [ebp - 0xc], 0
mov dword [ebp - 0xa], 0xe
push 0
lea eax, [ebp - 4]
push eax
push 0xe
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_WriteFile
test eax, eax
je 0x2512bf3a
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp - 0x264]
push ebx
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x2512bf59
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x268]
mov edx, 0x251374c0
mov ax, 1
call fcn.2512d100
jmp 0x2512bf59
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x268]
mov edx, 0x25137514
mov ax, 1
call fcn.2512d100
push dword [ebp - 0x26c]
call sub.kernel32.dll_GlobalUnlock
push ebx
call sub.kernel32.dll_CloseHandle
lea eax, [ebp - 0x220]
call fcn.2512bbe0
test al, al
jne 0x2512bf85
lea eax, [ebp - 0x220]
push eax
call sub.kernel32.dll_DeleteFileW
call fcn.251271d0
lea eax, [ebp - 0x254]
call fcn.25122560
lea eax, [ebp - 0x250]
call fcn.25122560
lea eax, [ebp - 0x24c]
call fcn.25125540
pop eax
test eax, eax
je 0x2512bfb5
call fcn.25127300
pop edi
pop esi
pop ebx
leave
ret