Function at 0x10006150
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x34
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x44]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
push eax
mov dword [esp + 0x44], ebp
mov dword [esp + 0x38], esi
call edi
mov ebx, eax
mov dword [esp + 0x14], ebx
cmp ebx, 0xffffffff
je 0x100063a3
push esi
push 0x80
push 2
push esi
push 1
push 0x40000000
push ebp
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x10006398
xor ebp, ebp
push edi
mov esi, ebx
mov dword [esp + 0x1c], ebp
mov byte [esp + 0x17], 0
call fcn.10006030
add esp, 4
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], eax
mov ecx, eax
cmp eax, 0x1a
jbe 0x100061e7
nop
shr ecx, 1
cmp ecx, 0x1a
ja 0x100061e0
mov esi, 0x1a
sub esi, ecx
test eax, eax
jbe 0x10006384
mov bl, byte [esp + 0x13]
lea ebx, [ebx]
mov edx, dword [esp + 0x14]
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea ecx, [esp + 0x38]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10006380
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10006380
cmp eax, 1
jne 0x100063c5
cmp byte [esp + 0x13], 0
jne 0x10006241
mov byte [esp + 0x13], al
mov al, byte [esp + 0x2c]
cmp al, 0x30
jl 0x1000624d
cmp al, 0x39
jle 0x10006263
cmp al, 0x61
jl 0x10006255
cmp al, 0x7a
jle 0x10006263
mov cl, al
sub cl, 0x41
cmp cl, 0x19
ja 0x1000632c
movsx edx, al
push edx
call fcn.100d208e
add esp, 4
sub eax, 0
je 0x10006286
sub eax, 1
je 0x10006282
sub eax, 1
jne 0x100062b0
mov bl, 0x61
jmp 0x100062b4
mov bl, 0x41
jmp 0x100062b4
xor bl, bl
mov dl, byte [esp + 0x2c]
mov eax, dword [0x101ddcb8]
mov ecx, eax
sar ecx, 1
sub eax, ecx
sub eax, 1
js 0x1000632c
cmp dl, byte [ecx + eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789GuBlZEpxPFqDAtjNh7c6mKs4Iy9Mrfw2UYvn3ei5HTgaO1dCbz8QXLJk0RVoW]
je 0x10006322
sub eax, 1
jns 0x100062a0
jmp 0x1000632c
test bl, bl
je 0x10006288
movsx eax, byte [esp + 0x2c]
movzx ecx, bl
sub eax, ecx
xor edx, edx
add eax, esi
mov ecx, 0x1a
div ecx
mov eax, ebp
add dl, bl
mov byte [esp + 0x2c], dl
xor edx, edx
div dword [0x101ddcbc]
cmp bl, 0x41
jne 0x100062ed
movsx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz13579GuBlZEpxPFqDAtjNhcmKsIyMrfwUYvneiHTgaOdCbzQXLJkRVoW]
push edx
call fcn.100d2456
jmp 0x100062fa
movsx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz13579GuBlZEpxPFqDAtjNhcmKsIyMrfwUYvneiHTgaOdCbzQXLJkRVoW]
push eax
call fcn.100d2597
movsx ecx, al
movsx eax, byte [esp + 0x30]
sub eax, ecx
cdq
mov ecx, 0x1a
idiv ecx
add esp, 4
mov eax, edx
add eax, ecx
cdq
idiv ecx
add dl, bl
mov byte [esp + 0x2c], dl
inc ebp
jmp 0x1000628c
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789GuBlZEpxPFqDAtjNh7c6mKs4Iy9Mrfw2UYvn3ei5HTgaO1dCbz8QXLJk0RVoW]
mov byte [esp + 0x2c], dl
mov ecx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x1c]
push eax
push ecx
lea edx, [esp + 0x38]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub dword [esp + 0x20], 1
jne 0x10006375
mov esi, dword [esp + 0x14]
push edi
call fcn.10006030
add esp, 4
xor ebp, ebp
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], eax
cmp eax, 0x1a
jbe 0x1000636e
shr eax, 1
cmp eax, 0x1a
ja 0x10006367
mov esi, 0x1a
sub esi, eax
cmp dword [esp + 0x20], 0
ja 0x10006200
mov ebx, dword [esp + 0x14]
movzx ecx, byte [esp + 0x13]
push edi
mov dword [esp + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x100063ae
mov edx, dword [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x3c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0x34
ret 8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov eax, dword [esp + 0x14]
push eax
call edi
mov esi, dword [esp + 0x1c]
jmp 0x100063a3