Function at 0x1000ce10
Capabilities:
Check if file exists
Copy file
Create process on windows
Delete file
Get file attributes
Move file
Read file on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ac169
mov eax, dword fs:[0]
push eax
mov eax, 0x1894
call fcn.10021ee0
push ebx
push esi
push edi
lea edi, [ebp - 0x12a0]
mov ecx, 0x4a5
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x100da0f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x100e0038
call fcn.10021e20
movzx eax, byte [0x100de824]
test eax, eax
je 0x1000ce6e
jmp 0x1000d527
push 0x100ad464
push 0x100de800
lea eax, [ebp - 0x30]
push eax
call fcn.1000a450
add esp, 0xc
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.1000ec70
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp esi, esp
call fcn.10021df0
cmp eax, 0xffffffff
je 0x1000cebc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.1000c8a0
jmp 0x1000d527
mov byte [0x100de824], 1
call fcn.1000cd40
movzx eax, al
test eax, eax
je 0x1000cee3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.1000c8a0
jmp 0x1000d527
mov esi, esp
push 0x34
push str.4GB___Large_Address_Aware_patch_missing_
push str.Your_game_executable_is_missing_the_4GB___LAA_patch._This_patch_fixes_vertex_corruption_and_texture_issues_by_increasing_accessible_memory._n_nDo_you_want_T4Me_to_patch_the_games_.exe_for_you___Recommended_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.10021df0
cmp eax, 6
jne 0x1000d4a7
mov esi, esp
push 0x1000
lea eax, [ebp - 0x1038]
push eax
mov edi, esp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp edi, esp
call fcn.10021df0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp esi, esp
call fcn.10021df0
lea eax, [ebp - 0x1038]
push eax
lea ecx, [ebp - 0x105c]
call fcn.1000bad0
mov byte [ebp - 4], 1
push str..new
lea eax, [ebp - 0x105c]
push eax
lea ecx, [ebp - 0x1080]
push ecx
call fcn.1000a380
add esp, 0xc
mov byte [ebp - 4], 2
push str..bak
lea eax, [ebp - 0x105c]
push eax
lea ecx, [ebp - 0x10a4]
push ecx
call fcn.1000a380
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1080]
call fcn.1000ec20
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp esi, esp
call fcn.10021df0
cmp eax, 0xffffffff
je 0x1000cfc5
lea ecx, [ebp - 0x1080]
call fcn.1000ec20
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, esp
call fcn.10021df0
lea ecx, [ebp - 0x10a4]
call fcn.1000ec20
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp esi, esp
call fcn.10021df0
cmp eax, 0xffffffff
je 0x1000d000
lea ecx, [ebp - 0x10a4]
call fcn.1000ec20
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, esp
call fcn.10021df0
mov esi, esp
push 0
lea ecx, [ebp - 0x1080]
call fcn.1000ec20
push eax
lea ecx, [ebp - 0x105c]
call fcn.1000ec20
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp esi, esp
call fcn.10021df0
mov dword [ebp - 0x10b0], eax
push 0x100ad598
lea ecx, [ebp - 0x1080]
call fcn.1000ec20
push eax
lea eax, [ebp - 0x10bc]
push eax
call fcn.1003a0c0
add esp, 0xc
mov dword [ebp - 0x10c8], eax
cmp dword [ebp - 0x10c8], 0
jne 0x1000d36e
push 2
push 0
mov eax, dword [ebp - 0x10bc]
push eax
call fcn.1003b560
add esp, 0xc
lea ecx, [ebp - 0x1899]
call fcn.1000ba30
push eax
mov eax, dword [ebp - 0x10bc]
push eax
call fcn.1003c3d0
add esp, 4
push eax
lea ecx, [ebp - 0x10e0]
call fcn.1000c190
mov byte [ebp - 4], 4
push 0
push 0
mov eax, dword [ebp - 0x10bc]
push eax
call fcn.1003b560
add esp, 0xc
mov eax, dword [ebp - 0x10bc]
push eax
lea ecx, [ebp - 0x10e0]
call fcn.1000f4e0
push eax
push 1
lea ecx, [ebp - 0x10e0]
call fcn.1000edf0
push eax
call fcn.1003abe0
add esp, 0x10
mov esi, eax
lea ecx, [ebp - 0x10e0]
call fcn.1000f4e0
cmp esi, eax
je 0x1000d10b
mov eax, dword [ebp - 0x10bc]
push eax
call fcn.1003a300
add esp, 4
mov dword [ebp - 0x10c8], 1
jmp 0x1000d35f
lea ecx, [ebp - 0x10e0]
call fcn.1000edf0
mov dword [ebp - 0x10ec], eax
lea ecx, [ebp - 0x10e0]
call fcn.1000edf0
mov ecx, dword [ebp - 0x10ec]
add eax, dword [ecx + 0x3c]
mov dword [ebp - 0x10f8], eax
mov eax, dword [ebp - 0x10f8]
movzx ecx, word [eax + 0x16]
or ecx, 0x20
mov edx, dword [ebp - 0x10f8]
mov word [edx + 0x16], cx
lea ecx, [ebp - 0x10e0]
call fcn.1000edf0
mov ecx, dword [ebp - 0x10f8]
sub ecx, eax
mov edx, dword [ebp - 0x10f8]
add edx, 0x58
sub edx, dword [ebp - 0x10f8]
add ecx, edx
mov dword [ebp - 0x1104], ecx
lea ecx, [ebp - 0x10e0]
call fcn.1000f4e0
sub eax, dword [ebp - 0x1104]
sub eax, 4
shr eax, 1
mov dword [ebp - 0x1110], eax
mov eax, dword [ebp - 0x10f8]
add eax, 0x5c
mov dword [ebp - 0x111c], eax
mov eax, dword [ebp - 0x1104]
shr eax, 1
push eax
lea ecx, [ebp - 0x10e0]
call fcn.1000edf0
push eax
push 0
call fcn.1000ecc0
add esp, 0xc
mov dword [ebp - 0x1128], eax
mov eax, dword [ebp - 0x1110]
push eax
mov ecx, dword [ebp - 0x111c]
push ecx
mov edx, dword [ebp - 0x1128]
push edx
call fcn.1000ecc0
add esp, 0xc
mov dword [ebp - 0x1134], eax
lea ecx, [ebp - 0x10e0]
call fcn.1000f4e0
and eax, 1
je 0x1000d223
lea ecx, [ebp - 0x10e0]
call fcn.1000edf0
mov esi, eax
lea ecx, [ebp - 0x10e0]
call fcn.1000f4e0
movsx eax, byte [esi + eax - 1]
add eax, dword [ebp - 0x1134]
mov dword [ebp - 0x1134], eax
lea ecx, [ebp - 0x10e0]
call fcn.1000f4e0
add eax, dword [ebp - 0x1134]
mov ecx, dword [ebp - 0x10f8]
mov dword [ecx + 0x58], eax
push 0
mov eax, dword [ebp - 0x10ec]
mov ecx, dword [eax + 0x3c]
push ecx
mov edx, dword [ebp - 0x10bc]
push edx
call fcn.1003b560
add esp, 0xc
mov eax, dword [ebp - 0x10bc]
push eax
push 1
push 0xf8
mov ecx, dword [ebp - 0x10f8]
push ecx
call fcn.1003cb30
add esp, 0x10
mov dword [ebp - 0x1140], eax
mov eax, dword [ebp - 0x10bc]
push eax
call fcn.1003a300
add esp, 4
cmp dword [ebp - 0x1140], 1
je 0x1000d2a2
mov dword [ebp - 0x10c8], 2
jmp 0x1000d35f
mov esi, esp
push 1
lea ecx, [ebp - 0x10a4]
call fcn.1000ec20
push eax
lea ecx, [ebp - 0x105c]
call fcn.1000ec20
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
cmp esi, esp
call fcn.10021df0
mov dword [ebp - 0x114c], eax
lea ecx, [ebp - 0x105c]
call fcn.1000ec20
mov esi, esp
push eax
lea ecx, [ebp - 0x1080]
call fcn.1000ec20
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp esi, esp
call fcn.10021df0
mov dword [ebp - 0x1158], eax
cmp dword [ebp - 0x114c], 0
jne 0x1000d313
mov dword [ebp - 0x10c8], 3
jmp 0x1000d326
cmp dword [ebp - 0x1158], 0
jne 0x1000d326
mov dword [ebp - 0x10c8], 4
cmp dword [ebp - 0x114c], 0
je 0x1000d35f
cmp dword [ebp - 0x1158], 0
jne 0x1000d35f
lea ecx, [ebp - 0x105c]
call fcn.1000ec20
mov esi, esp
push eax
lea ecx, [ebp - 0x10a4]
call fcn.1000ec20
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp esi, esp
call fcn.10021df0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10e0]
call fcn.1000c950
cmp dword [ebp - 0x10c8], 0
jne 0x1000d43e
mov esi, esp
push 0
push str.4GB___Large_Address_Aware_patch_successful_
push str.T4Me_has_successfully_patched_the_games_.exe_and_also_created_a_backup_copy._n_nPress_OK_to_relaunch_the_game_for_the_patch_to_take_effect_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.10021df0
push str.CoDWaW.exe
push 0x100de800
lea eax, [ebp - 0x117c]
push eax
call fcn.1000a450
add esp, 0xc
mov esi, esp
push 0xa
push 0
push 0
lea ecx, [ebp - 0x117c]
call fcn.1000ec70
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp esi, esp
call fcn.10021df0
cmp eax, 0x20
jle 0x1000d431
push 0
call fcn.100398d0
lea ecx, [ebp - 0x117c]
call fcn.1000c8a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10a4]
call fcn.1000c7f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1080]
call fcn.1000c7f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x105c]
call fcn.1000c7f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.1000c8a0
jmp 0x1000d527
lea ecx, [ebp - 0x117c]
call fcn.1000c8a0
jmp 0x1000d478
mov eax, dword [ebp - 0x10c8]
push eax
push str.T4Me_failed_to_patch_the_games_.exe__error__d__n_nYou_can_manually_patch_it_yourself_by_using_the__NTCore_4GB_Patch__tool___an_internet_search_should_help_find_it_
lea ecx, [ebp - 0x1284]
push ecx
call fcn.1000b730
add esp, 0xc
mov esi, esp
push 0x30
push str.4GB___Large_Address_Aware_patch_failed...
lea eax, [ebp - 0x1284]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.10021df0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10a4]
call fcn.1000c7f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1080]
call fcn.1000c7f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x105c]
call fcn.1000c7f0
jmp 0x1000d518
mov esi, esp
push 0x34
push str.Stop_Patch_Notifications
push str.T4Me_has_not_patched_the_games_.exe__would_you_like_to_stop_future_reminders_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.10021df0
cmp eax, 6
jne 0x1000d518
mov esi, esp
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x30]
call fcn.1000ec70
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp esi, esp
call fcn.10021df0
mov dword [ebp - 0x1290], eax
cmp dword [ebp - 0x1290], 0xffffffff
je 0x1000d518
mov esi, esp
mov eax, dword [ebp - 0x1290]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10021df0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.1000c8a0
push edx
mov ecx, ebp
push eax
lea edx, [0x1000d564]
call fcn.10021d90
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10021e60
add esp, 0x18a0
cmp ebp, esp
call fcn.10021df0
mov esp, ebp
pop ebp
ret