Function at 0x1000f740
Capabilities:
Delete file
Get common file path
Get file size
Read file via mapping
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10152d1f
mov eax, dword fs:[0]
push eax
sub esp, 0x37c
mov eax, dword [0x101ac034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x308], ecx
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x1000f79f
mov byte [ebp - 0x31d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10003e00
mov al, byte [ebp - 0x31d]
jmp 0x1001024e
mov eax, dword [ebp + 8]
push eax
push 0
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
jne 0x1000f802
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcess_fail___d_
push 3
push 0xed
push 0x10164790
push 0x101647e8
call fcn.10146290
add esp, 0x18
mov byte [ebp - 0x316], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10003e00
mov al, byte [ebp - 0x316]
jmp 0x1001024e
mov dword [ebp - 0x36c], 0x14
mov dword [ebp - 0x25c], 0
xor ecx, ecx
mov dword [ebp - 0x258], ecx
mov dword [ebp - 0x254], ecx
mov dword [ebp - 0x250], ecx
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x300], 0
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x33c], 0xa
mov dword [ebp - 0x30c], 0
mov byte [ebp - 0x301], 0
lea edx, [ebp - 0x300]
push edx
mov eax, dword [ebp - 0x36c]
push eax
lea ecx, [ebp - 0x25c]
push ecx
push 0x10
mov edx, dword [ebp - 0x308]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x338], eax
mov ecx, dword [ebp - 0x300]
push ecx
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0
je 0x1000f8e0
lea edx, [ebp - 0x300]
push edx
mov eax, dword [ebp - 0x300]
push eax
mov ecx, dword [ebp - 0x30c]
push ecx
push 0x10
mov edx, dword [ebp - 0x308]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0
jne 0x1000f8e0
mov byte [ebp - 0x301], 1
jmp 0x1000f90c
mov ecx, dword [ebp - 0x33c]
sub ecx, 1
mov dword [ebp - 0x33c], ecx
mov edx, dword [ebp - 0x30c]
push edx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
cmp dword [ebp - 0x33c], 0
jg 0x1000f85f
movzx eax, byte [ebp - 0x301]
test eax, eax
jne 0x1000f945
mov ecx, dword [ebp - 0x324]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x31a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10003e00
mov al, byte [ebp - 0x31a]
jmp 0x1001024e
push 8
lea ecx, [ebp - 0x224]
call fcn.10001860
lea ecx, [ebp - 0x224]
call fcn.10012a80
mov byte [ebp - 4], 1
lea edx, [ebp - 0x224]
push edx
mov ecx, dword [ebp - 0x308]
call fcn.1000f330
mov dword [ebp - 0x2f4], 0
mov byte [ebp - 0x301], 0
cmp dword [ebp - 0x30c], 0
je 0x1000ffac
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x380], 0
xor ecx, ecx
mov dword [ebp - 0x37c], ecx
mov dword [ebp - 0x2f0], 0
mov dword [ebp - 0x330], 0
jmp 0x1000f9d4
mov edx, dword [ebp - 0x330]
add edx, 1
mov dword [ebp - 0x330], edx
mov eax, dword [ebp - 0x340]
mov ecx, dword [ebp - 0x330]
cmp ecx, dword [eax]
jae 0x1000ffac
mov edx, dword [ebp - 0x330]
shl edx, 4
mov eax, dword [ebp - 0x340]
mov ecx, dword [eax + edx + 4]
cmp ecx, dword [ebp + 8]
je 0x1000fa02
jmp 0x1000f9c5
mov edx, dword [ebp - 0x330]
shl edx, 4
mov eax, dword [ebp - 0x340]
movzx ecx, word [eax + edx + 0xa]
mov dword [ebp - 0x354], ecx
push 2
push 0
push 0
lea edx, [ebp - 0x2f0]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov eax, dword [ebp - 0x354]
push eax
mov ecx, dword [ebp - 0x324]
push ecx
mov edx, dword [ebp - 0x308]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
je 0x1000fa5d
jmp 0x1000f9c5
xor ecx, ecx
mov word [ebp - 0x2ec], cx
push 0x5e
push 0
lea edx, [ebp - 0x2ea]
push edx
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x2fc], 0
lea eax, [ebp - 0x2fc]
push eax
push 0x60
lea ecx, [ebp - 0x2ec]
push ecx
push 2
mov edx, dword [ebp - 0x2f0]
push edx
mov eax, dword [ebp - 0x308]
mov ecx, dword [eax + 8]
call ecx
mov edx, dword [ebp - 0x2fc]
push edx
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0
jne 0x1000fad8
mov eax, dword [ebp - 0x2f0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000f9c5
mov ecx, dword [ebp - 0x2fc]
push ecx
push 0
mov edx, dword [ebp - 0x314]
push edx
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2fc]
push eax
mov ecx, dword [ebp - 0x2fc]
push ecx
mov edx, dword [ebp - 0x314]
push edx
push 2
mov eax, dword [ebp - 0x2f0]
push eax
mov ecx, dword [ebp - 0x308]
mov edx, dword [ecx + 8]
call edx
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
je 0x1000fb4a
mov eax, dword [ebp - 0x2f0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x314]
push ecx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
jmp 0x1000f9c5
mov dword [ebp - 0x32c], 0x10164784
mov edx, dword [ebp - 0x32c]
add edx, 2
mov dword [ebp - 0x358], edx
mov eax, dword [ebp - 0x32c]
mov cx, word [eax]
mov word [ebp - 0x346], cx
add dword [ebp - 0x32c], 2
cmp word [ebp - 0x346], 0
jne 0x1000fb63
mov edx, dword [ebp - 0x32c]
sub edx, dword [ebp - 0x358]
sar edx, 1
mov dword [ebp - 0x368], edx
mov eax, dword [ebp - 0x368]
push eax
push str.File
mov ecx, dword [ebp - 0x314]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.MSVCR120.dll_wcsncmp]
add esp, 0xc
test eax, eax
je 0x1000fbdd
mov eax, dword [ebp - 0x2f0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x314]
push ecx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
jmp 0x1000f9c5
mov edx, dword [ebp - 0x314]
push edx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
xor eax, eax
mov word [ebp - 0x230], ax
xor ecx, ecx
mov dword [ebp - 0x22e], ecx
mov word [ebp - 0x22a], cx
mov dword [ebp - 0x2f8], 0
lea edx, [ebp - 0x2f8]
push edx
push 8
lea eax, [ebp - 0x230]
push eax
push 1
mov ecx, dword [ebp - 0x2f0]
push ecx
mov edx, dword [ebp - 0x308]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x328], eax
mov ecx, dword [ebp - 0x2f8]
push ecx
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0
jne 0x1000fc6a
mov edx, dword [ebp - 0x2f0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000f9c5
mov eax, dword [ebp - 0x2f8]
push eax
push 0
mov ecx, dword [ebp - 0x310]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
lea edx, [ebp - 0x2f8]
push edx
mov eax, dword [ebp - 0x2f8]
push eax
mov ecx, dword [ebp - 0x310]
push ecx
push 1
mov edx, dword [ebp - 0x2f0]
push edx
mov eax, dword [ebp - 0x308]
mov ecx, dword [eax + 8]
call ecx
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
je 0x1000fcdc
mov edx, dword [ebp - 0x2f0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x310]
push eax
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
jmp 0x1000f9c5
mov ecx, dword [ebp - 0x310]
movzx edx, word [ecx]
test edx, edx
jne 0x1000fd0b
mov eax, dword [ebp - 0x2f0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x310]
push ecx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
jmp 0x1000f9c5
mov edx, dword [ebp - 0x310]
mov eax, dword [edx + 4]
mov dword [ebp - 0x35c], eax
mov ecx, dword [ebp - 0x35c]
push ecx
lea ecx, [ebp - 0x248]
call fcn.10003d50
mov byte [ebp - 4], 2
push 4
lea ecx, [ebp - 0x21c]
call fcn.10001860
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x224]
call fcn.10012ba0
jmp 0x1000fd5c
lea ecx, [ebp - 0x21c]
call fcn.10012e40
lea eax, [ebp - 0x378]
push eax
lea ecx, [ebp - 0x224]
call fcn.100054d0
push eax
lea ecx, [ebp - 0x21c]
call fcn.10004d70
movzx ecx, al
test ecx, ecx
je 0x1000fe52
lea ecx, [ebp - 0x21c]
call fcn.10012e20
push eax
lea ecx, [ebp - 0x274]
call fcn.10004030
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x21c]
call fcn.10012e20
add eax, 0x18
push eax
lea ecx, [ebp - 0x28c]
call fcn.10004030
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x274]
call fcn.10002000
mov dword [ebp - 0x360], eax
push 0
lea edx, [ebp - 0x274]
push edx
lea ecx, [ebp - 0x248]
call fcn.10012a30
cmp eax, 0xffffffff
je 0x1000fe2f
lea eax, [ebp - 0x28c]
push eax
mov ecx, dword [ebp - 0x360]
push ecx
push 0
lea ecx, [ebp - 0x248]
call fcn.10012a00
push eax
lea ecx, [ebp - 0x248]
call fcn.100035f0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28c]
call fcn.10003e00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x274]
call fcn.10003e00
jmp 0x1000fe52
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28c]
call fcn.10003e00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x274]
call fcn.10003e00
jmp 0x1000fd51
mov edx, dword [ebp - 0x310]
push edx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov eax, dword [ebp - 0x2f0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x384], esp
lea edx, [ebp + 0xc]
push edx
call fcn.10004030
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x374], eax
mov byte [ebp - 4], 5
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x388], esp
lea edx, [ebp - 0x248]
push edx
call fcn.10004030
mov dword [ebp - 0x370], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x308]
call fcn.1000f5e0
mov byte [ebp - 0x318], al
movzx eax, byte [ebp - 0x318]
test eax, eax
je 0x1000ff98
push 2
push 0
push 0
lea ecx, [ebp - 0x2f4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov edx, dword [ebp - 0x354]
push edx
mov eax, dword [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x1000ff80
mov ecx, dword [ebp - 0x30c]
push ecx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov edx, dword [ebp - 0x324]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.DuplicateHandle_fail_
push 3
push 0x185
push 0x10164850
push 0x101648a8
call fcn.10146290
add esp, 0x14
mov byte [ebp - 0x31c], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
call fcn.10003e00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.10010270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10003e00
mov al, byte [ebp - 0x31c]
jmp 0x1001024e
mov byte [ebp - 0x301], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
call fcn.10003e00
jmp 0x1000ffac
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
call fcn.10003e00
jmp 0x1000f9c5
mov eax, dword [ebp - 0x30c]
push eax
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov ecx, dword [ebp - 0x324]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx edx, byte [ebp - 0x301]
test edx, edx
jne 0x10010022
push str.Found_file_fail_
push 3
push 0x193
push 0x10164948
push 0x101648fc
call fcn.10146290
add esp, 0x14
mov byte [ebp - 0x315], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.10010270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10003e00
mov al, byte [ebp - 0x315]
jmp 0x1001024e
mov dword [ebp - 0x344], 0
push 0
mov eax, dword [ebp - 0x2f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x344], eax
lea ecx, [ebp - 0x218]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x218]
push edx
mov ecx, dword [ebp + 0x24]
call fcn.10007da0
push str.historyTmp.db
mov ecx, dword [ebp + 0x24]
call fcn.1000c1f0
mov ecx, dword [ebp + 0x24]
call fcn.10002bf0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 0x24]
call fcn.10002bf0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0xffffffff
jne 0x10010106
mov eax, dword [ebp - 0x2f4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Create_file_fail_
push 3
push 0x1a9
push 0x101649e0
push 0x10164a38
call fcn.10146290
add esp, 0x14
mov byte [ebp - 0x317], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.10010270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10003e00
mov al, byte [ebp - 0x317]
jmp 0x1001024e
push 0
push 0
push 0
push 2
push 0
mov ecx, dword [ebp - 0x2f4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0
jne 0x10010194
mov edx, dword [ebp - 0x2f4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.CreateFileMapping_fail_
push 3
push 0x1b2
push 0x10164a98
push str.CEdgeHelper::MyCopyFile
call fcn.10146290
add esp, 0x14
mov byte [ebp - 0x319], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.10010270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10003e00
mov al, byte [ebp - 0x319]
jmp 0x1001024e
push 0
push 0
push 0
push 4
mov ecx, dword [ebp - 0x334]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
je 0x100101ef
cmp dword [ebp - 0x344], 0
jbe 0x100101ef
mov dword [ebp - 0x228], 0
push 0
lea edx, [ebp - 0x228]
push edx
mov eax, dword [ebp - 0x344]
push eax
mov ecx, dword [ebp - 0x34c]
push ecx
mov edx, dword [ebp - 0x350]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x34c]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0x334]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x350]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2f4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x31b], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.10010270
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10003e00
mov al, byte [ebp - 0x31b]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101506bb
mov esp, ebp
pop ebp
ret 0x20