Function at 0x10008ea0
Capabilities:
Delete file
Move file
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10040abb
push eax
mov dword fs:[0], esp
sub esp, 0x290
push ebx
mov ebx, ecx
push ebp
xor ebp, ebp
mov eax, dword [ebx + 0x28c]
cmp eax, ebp
jle 0x10008ed1
push eax
call fcn.100078e0
lea ecx, [esp + 0x16c]
mov dword [esp + 8], ebp
call fcn.1000a800
mov eax, dword [ebx + 0x594]
mov dword [esp + 0x2a0], ebp
cmp eax, ebp
jne 0x10008f10
lea ecx, [esp + 0x16c]
mov dword [esp + 0x2a0], 0xffffffff
call fcn.1000a850
xor eax, eax
jmp 0x10009790
push esi
push edi
mov ecx, 0x47
xor eax, eax
lea edi, [esp + 0x58]
mov dword [esp + 0x30], ebp
rep stosd dword es:[edi], eax
lea ecx, [ebx + 0x264]
mov dword [esp + 0x1c], ebp
call fcn.10011f80
mov dword [esp + 0x68], eax
mov ecx, dword [ebx + 0x5a0]
xor eax, eax
mov edx, dword [ebx + 0x6a8]
mov ax, word [ebx + 4]
mov dword [esp + 0x170], ecx
shl eax, 0x10
or al, 3
lea esi, [ebx + 0x6c4]
mov dword [esp + 0x5c], eax
mov eax, dword [ebx + 0x28c]
mov ecx, 0x3f
lea edi, [esp + 0x70]
mov dword [esp + 0x60], ebp
mov dword [esp + 0x58], 1
mov dword [esp + 0x64], eax
mov dword [esp + 0x6c], edx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x2b0]
cmp esi, ebp
jne 0x10008ff2
cmp dword [ebx + 0x590], ebp
jne 0x10009773
mov eax, dword [ebx + 0x6bc]
test eax, eax
je 0x10009773
xor ebp, ebp
mov eax, dword [ebx + 0x6bc]
mov dword [esp + 0x20], ebp
cmp eax, ebp
je 0x10009773
mov esi, dword [esp + 0x2b0]
xor ebp, ebp
cmp dword [ebx + 0x590], ebp
je 0x1000900d
push 0
push 2
mov ecx, ebx
call fcn.10007a00
lea ebp, [ebx + 0x134]
mov dword [esp + 0x20], 0
mov dword [esp + 0x40], ebp
jmp 0x100091b4
lea eax, [ebx + 0x30]
push eax
push esi
call fcn.10036180
add esp, 8
test eax, eax
je 0x10008fad
mov dword [esp + 0x20], 1
jmp 0x10008fc8
cmp dword [esp + 0x20], ebp
je 0x10009134
push esi
call fcn.10012080
add esp, 4
test eax, eax
jne 0x10009773
mov edx, dword [esp + 0x2b0]
or ecx, 0xffffffff
mov edi, edx
lea ebp, [esp + 0x19c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, ebp
push 0x10000080
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 2
push 0
and ecx, 3
push 0
push 0x40000000
rep movsb byte es:[edi], byte [esi]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x198], eax
jne 0x10009082
call fcn.100120a0
jmp 0x10009773
push 0x130
push eax
push ebx
lea ecx, [esp + 0x180]
call fcn.1000a860
lea edi, [ebx + 0x264]
lea ebp, [esp + 0x174]
mov ecx, edi
mov dword [esp + 0x40], ebp
call fcn.10011f80
mov ecx, edi
mov esi, eax
call fcn.10012040
sub esi, eax
mov eax, esi
mov dword [esp + 0x1c], esi
imul eax, dword [ebx + 0x28c]
test eax, eax
jle 0x100090e5
lea ecx, [eax*4]
push ecx
call fcn.100355a6
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
je 0x10009759
mov eax, dword [ebx + 0x28c]
mov edx, dword [esp + 0x30]
mov edi, 1
mov dword [esp + 0x14], edx
cmp eax, edi
jl 0x100091b4
lea eax, [esi*4]
mov esi, edx
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x174]
push esi
push ecx
push edi
mov ecx, ebx
call fcn.10007980
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x28c]
add esi, edx
inc edi
cmp edi, eax
jle 0x1000910d
jmp 0x100091b4
mov edx, dword [ebx + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebp
push 0x10000080
push 3
push ebp
lea esi, [ebx + 0x30]
push ebp
push 0x40000000
push esi
call edi
cmp eax, 0xffffffff
mov dword [ebx + 0x2c], eax
jne 0x10009180
call fcn.100120a0
push ebp
push 0x10000080
push 3
push ebp
push ebp
push 0x80000000
push esi
call edi
mov dword [ebx + 0x2c], eax
jmp 0x10009773
mov eax, dword [ebx + 0x28c]
mov esi, 1
cmp eax, esi
jl 0x100091ad
push esi
mov ecx, ebx
call fcn.100078e0
push 1
push 1
mov ecx, ebx
call fcn.10007a00
mov eax, dword [ebx + 0x28c]
inc esi
cmp esi, eax
jle 0x1000918f
lea ebp, [ebx + 8]
mov dword [esp + 0x40], ebp
mov ecx, ebp
call fcn.1000ad90
mov eax, dword [ebp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push eax
call esi
mov ecx, ebp
mov dword [esp + 0x48], eax
call fcn.1000ab10
mov ecx, dword [ebp + 0x24]
push 1
push 0
push 0
push ecx
call esi
lea esi, [ebx + 0x264]
mov dword [esp + 0x4c], eax
mov ecx, esi
call fcn.10012040
mov edi, eax
test edi, edi
jne 0x10009201
mov dword [esp + 0x28], eax
jmp 0x10009215
lea edx, [edi*4]
push edx
call fcn.100355a6
add esp, 4
mov dword [esp + 0x28], eax
test edi, edi
jle 0x10009226
mov ecx, edi
mov edi, dword [esp + 0x28]
mov eax, 1
rep stosd dword es:[edi], eax
test byte [ebx + 0x6ac], 2
je 0x10009283
push 0x10046660
mov ecx, esi
call fcn.10011fc0
mov edi, eax
cmp edi, 0xffffffff
je 0x10009259
push edi
mov ecx, esi
call fcn.10012050
test eax, eax
je 0x10009259
mov eax, dword [esp + 0x28]
mov dword [eax + edi*4], 0
push 0x1004666c
mov ecx, esi
call fcn.10011fc0
mov edi, eax
cmp edi, 0xffffffff
je 0x10009283
push edi
mov ecx, esi
call fcn.10012050
test eax, eax
je 0x10009283
mov ecx, dword [esp + 0x28]
mov dword [ecx + edi*4], 0
mov eax, dword [ebx + 0x28c]
mov edx, dword [esp + 0x30]
mov esi, 1
mov dword [esp + 0x14], edx
cmp eax, esi
mov dword [esp + 0x24], esi
jl 0x10009384
push esi
mov ecx, ebx
call fcn.10008840
mov edi, eax
test edi, edi
je 0x10009371
mov eax, dword [esp + 0x20]
test eax, eax
je 0x100092fd
mov eax, dword [esp + 0x1c]
test eax, eax
jle 0x100092fd
xor esi, esi
test eax, eax
jle 0x100092fd
mov ebp, dword [esp + 0x14]
push esi
mov ecx, edi
call fcn.1000edf0
mov dword [esp + 0x18], eax
mov eax, dword [ebp]
push eax
push esi
mov ecx, edi
call fcn.1000ee00
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov dword [ebp], ecx
inc esi
add ebp, 4
cmp esi, eax
jl 0x100092ce
mov ebp, dword [esp + 0x40]
mov edx, dword [esp + 0x28]
mov eax, dword [ebp + 0x24]
push edx
push eax
mov ecx, edi
call fcn.1000ef00
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10009352
mov eax, dword [esp + 0x1c]
test eax, eax
jle 0x10009352
xor esi, esi
test eax, eax
jle 0x10009352
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x18]
mov ecx, edi
mov eax, dword [edx]
push eax
push esi
call fcn.1000ee00
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
inc esi
add ecx, 4
cmp esi, eax
mov dword [esp + 0x18], ecx
jl 0x1000932f
mov eax, dword [esp + 0x34]
test eax, eax
je 0x10009737
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x24]
lea eax, [ecx + edx*4]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x28c]
inc esi
cmp esi, eax
mov dword [esp + 0x24], esi
jle 0x100092a2
mov ecx, dword [ebp + 0x24]
push 1
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [esp + 0x34]
mov dword [esp + 0x50], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
lea esi, [ebx + 0x294]
push esi
call fcn.10004160
add esp, 4
mov dword [esp + 0x38], eax
test eax, eax
jbe 0x10009474
mov ecx, dword [ebp + 0x24]
mov edx, dword [esi - 4]
lea edi, [eax + 8]
mov eax, dword [esp + 0x14]
push 0
push edi
push 0
push eax
push ecx
mov dword [esp + 0x50], edx
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_LockFile]
test eax, eax
je 0x10009737
mov edx, dword [esp + 0x14]
mov ecx, dword [ebp + 0x24]
add edx, edi
push 0
mov dword [esp + 0x18], edx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x40]
push 8
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10009422
mov dword [esp + 0x10], eax
call fcn.100120a0
jmp 0x10009460
mov eax, dword [esp + 0x38]
test eax, eax
je 0x10009460
push esi
call fcn.10004120
mov ecx, dword [esp + 0x3c]
add esp, 4
lea edx, [esp + 0x2c]
push 0
push edx
mov edx, dword [ebp + 0x24]
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10009457
mov dword [esp + 0x10], eax
call fcn.100120a0
push esi
call fcn.10004140
add esp, 4
mov eax, dword [esp + 0x14]
mov ecx, dword [ebp + 0x24]
push 0
push edi
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_UnlockFile]
mov eax, dword [esp + 0x18]
add esi, 0xc
inc eax
cmp eax, 0x40
mov dword [esp + 0x18], eax
jl 0x100093ae
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x10009503
xor eax, eax
mov esi, 1
lea ecx, [ebx + 0x264]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x10], esi
call fcn.10011f80
lea edx, [eax + eax*2]
mov ecx, dword [ebp + 0x24]
shl edx, 4
add edx, eax
mov eax, dword [esp + 0x14]
push 0
lea edi, [edx*8 + 8]
push edi
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LockFile]
test eax, eax
je 0x10009737
mov ecx, dword [ebp + 0x24]
lea edx, [esp + 0x2c]
push 0
push edx
lea eax, [esp + 0x40]
push 8
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10009507
xor esi, esi
mov dword [esp + 0x10], esi
call fcn.100120a0
jmp 0x10009575
mov esi, dword [esp + 0x10]
mov edx, dword [ebp + 0x24]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x68]
test eax, eax
mov dword [esp + 0x24], 0
jle 0x10009575
test esi, esi
je 0x10009571
mov eax, dword [esp + 0x24]
lea ecx, [ebx + 0x264]
push eax
call fcn.10011f90
test eax, eax
je 0x1000955e
mov edx, dword [ebp + 0x24]
lea ecx, [esp + 0x2c]
push 0
push ecx
push 0x188
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10009560
xor esi, esi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x68]
inc eax
cmp eax, ecx
mov dword [esp + 0x24], eax
jl 0x1000952b
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x14]
mov ecx, dword [ebp + 0x24]
push 0
push edi
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_UnlockFile]
test esi, esi
je 0x10009737
mov edx, dword [ebp + 0x24]
push 0
push 0
push 0
push edx
mov dword [esp + 0x20], 0
mov dword [esp + 0x54], 0x130
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x100095c0
call fcn.100120a0
jmp 0x10009737
mov eax, dword [ebp + 0x24]
push 0
push 0x130
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LockFile]
test eax, eax
je 0x10009737
mov eax, dword [ebp + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [esp + 0x2c]
push 0
push ecx
lea edx, [esp + 0x60]
push 0x11c
mov esi, 1
push edx
push eax
mov dword [esp + 0x24], esi
call edi
test eax, eax
je 0x1000961f
mov eax, dword [ebp + 0x24]
lea ecx, [esp + 0x2c]
push 0
push ecx
lea edx, [esp + 0x4c]
push 0x14
push edx
push eax
call edi
test eax, eax
jne 0x10009625
xor esi, esi
mov dword [esp + 0x10], esi
mov ecx, dword [ebp + 0x24]
xor edi, edi
push edi
push 0x130
push edi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_UnlockFile]
cmp esi, edi
je 0x10009737
mov edx, dword [ebp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 0x2c]
mov ecx, dword [ebp + 0x24]
cmp eax, ecx
jne 0x10009658
mov dword [ebx + 0x2c], edi
mov ecx, dword [ebx + 0x158]
mov eax, dword [ebp + 0x24]
cmp ecx, eax
jne 0x1000966b
mov dword [ebx + 0x158], edi
cmp dword [ebx + 0x590], edi
je 0x10009699
mov esi, dword [esp + 0x2b0]
push esi
call fcn.10012080
add esp, 4
test eax, eax
je 0x1000968e
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp + 0x28]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp dword [esp + 0x20], edi
jne 0x1000972f
push 0
mov ecx, ebx
call fcn.10007c50
mov esi, eax
xor edi, edi
test esi, esi
mov dword [esp + 0x34], esi
jle 0x100096d6
lea eax, [esi*4]
push eax
call fcn.100355a6
mov edi, eax
add esp, 4
test edi, edi
je 0x100096d6
push edi
mov ecx, ebx
call fcn.10007c50
mov ecx, ebx
call fcn.10006720
mov eax, dword [ebx + 0x6c0]
mov edx, dword [esp + 0x2b0]
xor ecx, ecx
test eax, eax
sete cl
push ecx
push edx
mov ecx, ebx
call fcn.10007e00
test edi, edi
je 0x1000972f
test esi, esi
jle 0x10009726
mov eax, dword [esp + 0x34]
mov esi, edi
mov dword [esp + 0x18], eax
mov ecx, dword [esi]
push 1
push ecx
mov ecx, ebx
call fcn.100097b0
mov eax, dword [esp + 0x18]
add esi, 4
dec eax
mov dword [esp + 0x18], eax
jne 0x1000970c
push edi
call fcn.100350d1
add esp, 4
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x28]
test eax, eax
je 0x10009748
push eax
call fcn.100350d1
add esp, 4
mov eax, dword [esp + 0x30]
test eax, eax
je 0x10009759
push eax
call fcn.100350d1
add esp, 4
test ebp, ebp
je 0x10009773
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x10009773
mov ebp, dword [ebp + 0x24]
test ebp, ebp
je 0x10009773
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x174]
mov dword [esp + 0x2a8], 0xffffffff
call fcn.1000a850
mov eax, dword [esp + 0x10]
pop edi
pop esi
mov ecx, dword [esp + 0x298]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x29c
ret 4