Function at 0x2512d420
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x120]
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], rdx
mov qword [rbp - 0x18], r8
mov dword [rbp - 0x20], r9d
mov qword [rbp - 0xd0], 0
mov qword [rbp - 0xc8], 0
mov qword [rbp - 0xc0], 0
nop
cmp qword [0x251377d0], 0xffffffffffffffff
jne 0x2512d976
lea rax, [rbp - 0x90]
mov r8d, 0
movabs rdx, 0x2a
mov rcx, rax
call fcn.25121c80
mov dword [rsp + 0x20], 1
lea rax, [rbp - 0x90]
mov qword [rsp + 0x28], rax
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
mov r9d, 0x101
mov r8d, 2
call qword [rbp + 0x30]
test ax, ax
je 0x2512d4dc
call sub.kernel32.dll_GetLastError
mov dword [rbp - 0x28], eax
mov r8d, eax
lea rdx, str.Twain.ProcessMemory.DSM_Entry
mov ecx, 1
call fcn.2512e3b0
jmp 0x2512db0f
mov ax, word [rbp - 0x6a]
mov word [0x251377e0], ax
test ax, ax
jl 0x2512d51a
test ax, ax
je 0x2512d4ff
sub ax, 1
je 0x2512d508
sub ax, 1
je 0x2512d511
jmp 0x2512d51a
mov dword [rbp - 0x48], 0x30
jmp 0x2512d521
mov dword [rbp - 0x48], 0x428
jmp 0x2512d521
mov dword [rbp - 0x48], 0x28
jmp 0x2512d521
mov dword [rbp - 0x48], 0x428
mov edx, dword [rbp - 0x48]
lea rcx, [rbp - 0x60]
call fcn.25127560
mov edx, dword [rbp - 0x48]
mov rcx, qword [rbp - 0x60]
mov r8d, 0
call fcn.25121c80
mov rax, qword [rbp - 0x60]
mov dword [rax], 0x28
mov rdx, qword [rbp - 0x60]
mov eax, dword [rbp - 0x88]
mov dword [rdx + 4], eax
mov rax, qword [rbp - 0x60]
mov edx, dword [rbp - 0x84]
mov dword [rax + 8], edx
mov rax, qword [rbp - 0x60]
mov word [rax + 0xc], 1
mov rdx, qword [rbp - 0x60]
mov ax, word [rbp - 0x6e]
mov word [rdx + 0xe], ax
mov rax, qword [rbp - 0x60]
mov dword [rax + 0x10], 0
movsxd rdx, dword [rbp - 0x88]
movsx rax, word [rbp - 0x6e]
imul rax, rdx
lea rax, [rax + 0x1f]
mov rdx, rax
sar rdx, 0x3f
and rdx, 0x1f
add rax, rdx
sar rax, 5
shl rax, 2
movsxd rdx, dword [rbp - 0x84]
imul rdx, rax
movsxd rax, dword [rbp - 0x48]
lea rax, [rdx + rax]
mov rdx, qword [rbp - 0x60]
mov dword [rdx + 0x14], eax
mov rax, qword [rbp - 0x60]
mov dword [rax + 0x18], 0
mov rax, qword [rbp - 0x60]
mov dword [rax + 0x1c], 0
mov ax, word [0x251377e0]
test ax, ax
jl 0x2512d72c
test ax, ax
je 0x2512d60c
sub ax, 1
je 0x2512d6aa
sub ax, 1
je 0x2512d71f
jmp 0x2512d72c
mov rax, qword [rbp - 0x60]
mov dword [rax + 0x20], 2
mov rax, qword [rbp - 0x60]
mov dword [rax + 0x24], 0
mov dword [rbp - 0xa0], 0
sub dword [rbp - 0xa0], 1
nop
nop
add dword [rbp - 0xa0], 1
mov edx, dword [rbp - 0xa0]
imul eax, edx, 0xff
mov rcx, qword [rbp - 0x60]
and edx, 0xffffffff
mov byte [rcx + rdx*4 + 0x2a], al
mov edx, dword [rbp - 0xa0]
imul eax, edx, 0xff
mov rcx, qword [rbp - 0x60]
and edx, 0xffffffff
mov byte [rcx + rdx*4 + 0x29], al
mov edx, dword [rbp - 0xa0]
imul eax, edx, 0xff
mov rcx, qword [rbp - 0x60]
and edx, 0xffffffff
mov byte [rcx + rdx*4 + 0x28], al
mov rax, qword [rbp - 0x60]
mov edx, dword [rbp - 0xa0]
mov byte [rax + rdx*4 + 0x2b], 0
cmp dword [rbp - 0xa0], 1
jl 0x2512d638
jmp 0x2512d79a
mov rax, qword [rbp - 0x60]
mov dword [rax + 0x20], 0x100
mov dword [rbp - 0xa0], 0
sub dword [rbp - 0xa0], 1
nop
add dword [rbp - 0xa0], 1
mov rcx, qword [rbp - 0x60]
mov edx, dword [rbp - 0xa0]
mov eax, edx
mov byte [rcx + rax*4 + 0x2a], dl
mov rcx, qword [rbp - 0x60]
mov edx, dword [rbp - 0xa0]
mov eax, edx
mov byte [rcx + rax*4 + 0x29], dl
mov rcx, qword [rbp - 0x60]
mov edx, dword [rbp - 0xa0]
mov eax, edx
mov byte [rcx + rax*4 + 0x28], dl
mov rdx, qword [rbp - 0x60]
mov eax, dword [rbp - 0xa0]
mov byte [rdx + rax*4 + 0x2b], 0
cmp dword [rbp - 0xa0], 0xff
jl 0x2512d6c8
jmp 0x2512d79a
mov rax, qword [rbp - 0x60]
mov dword [rax + 0x20], 0
jmp 0x2512d79a
mov rax, qword [rbp - 0x60]
mov dword [rax + 0x20], 0x100
mov dword [rbp - 0xa0], 0
sub dword [rbp - 0xa0], 1
add dword [rbp - 0xa0], 1
mov rcx, qword [rbp - 0x60]
mov edx, dword [rbp - 0xa0]
mov eax, edx
mov byte [rcx + rax*4 + 0x2a], dl
mov rcx, qword [rbp - 0x60]
mov edx, dword [rbp - 0xa0]
mov eax, edx
mov byte [rcx + rax*4 + 0x29], dl
mov rcx, qword [rbp - 0x60]
mov edx, dword [rbp - 0xa0]
mov eax, edx
mov byte [rcx + rax*4 + 0x28], dl
mov rdx, qword [rbp - 0x60]
mov eax, dword [rbp - 0xa0]
mov byte [rdx + rax*4 + 0x2b], 0
cmp dword [rbp - 0xa0], 0xff
jl 0x2512d748
lea rcx, [0x25140ee0]
mov r8d, 0
movabs rdx, 0x20a
call fcn.25121c80
lea rdx, [0x25140ee0]
mov ecx, 0x104
call sub.kernel32.dll_GetTempPathW
lea rcx, [rbp - 0xc8]
call fcn.25123d90
call sub.kernel32.dll_GetTickCount
and eax, 0xffffffff
cvtsi2ss xmm1, rax
lea rcx, [rbp - 0xd0]
call fcn.2512e570
mov rdx, qword [rbp - 0xd0]
lea r8, [0x2513a5c0]
lea rcx, [rbp - 0xc8]
mov r9d, 0
call fcn.25123f20
mov rdx, qword [rbp - 0xc8]
lea rcx, [rbp - 0xc0]
call fcn.25124990
mov rdx, qword [rbp - 0xc0]
test rdx, rdx
jne 0x2512d834
lea rdx, [0x25140470]
lea rcx, [0x25140ee0]
call sub.kernel32.dll_lstrcatW
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
lea rcx, [0x25140ee0]
movabs r9, 0
mov r8d, 0
mov edx, 0xc0000000
call sub.kernel32.dll_CreateFileW
mov qword [0x251377d0], rax
cmp qword [0x251377d0], 0xffffffffffffffff
jne 0x2512d8ac
call sub.kernel32.dll_GetLastError
mov dword [rbp - 0x28], eax
mov r8d, eax
lea rdx, str.Twain.ProcessMemory.CreateFileW
mov ecx, 1
call fcn.2512e3b0
jmp 0x2512db0f
lea rcx, [rbp - 0x58]
mov r8d, 0
movabs rdx, 0xe
call fcn.25121c80
mov word [rbp - 0x58], 0x4d42
mov dword [rbp - 0x56], 0xe
mov word [rbp - 0x52], 0
mov word [rbp - 0x50], 0
mov eax, dword [rbp - 0x48]
lea eax, [eax + 0xe]
mov dword [rbp - 0x4e], eax
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x30]
lea rdx, [rbp - 0x58]
mov rcx, qword [0x251377d0]
mov r8d, 0xe
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x2512d930
call sub.kernel32.dll_GetLastError
mov dword [rbp - 0x28], eax
mov r8d, eax
lea rdx, str.Twain.ProcessMemory.WriteFile.BitmapFileHeader
mov ecx, 1
call fcn.2512e3b0
jmp 0x2512db0f
mov qword [rsp + 0x20], 0
mov rdx, qword [rbp - 0x60]
lea r9, [rbp - 0x30]
mov r8d, dword [rbp - 0x48]
mov rcx, qword [0x251377d0]
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x2512d976
call sub.kernel32.dll_GetLastError
mov dword [rbp - 0x28], eax
mov r8d, eax
lea rdx, str.Twain.ProcessMemory.WriteFile.BitmapInfo
mov ecx, 1
call fcn.2512e3b0
jmp 0x2512db0f
cmp qword [rbp - 0x18], 0
je 0x2512dad5
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x16]
mov dword [rbp - 0x38], eax
mov rax, qword [rbp - 0x18]
mov rax, qword [rax + 0x22]
mov qword [rbp - 0x98], rax
mov edx, dword [rbp - 0x38]
lea rcx, [rbp - 0xa8]
call fcn.25127560
nop
jmp 0x2512dac2
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 2]
mov dword [rbp - 0x40], eax
cmp eax, dword [rbp - 0x38]
jbe 0x2512d9c5
mov eax, dword [rbp - 0x38]
mov dword [rbp - 0x40], eax
mov r8d, dword [rbp - 0x40]
mov rdx, qword [rbp - 0xa8]
mov rcx, qword [rbp - 0x98]
call fcn.25121980
cmp word [0x251377e0], 2
jne 0x2512da5a
mov rax, qword [rbp - 0xa8]
mov qword [rbp - 0xb0], rax
mov ecx, dword [rbp - 0x40]
mov dword [rbp - 0xa0], 1
cmp ecx, dword [rbp - 0xa0]
jl 0x2512da5a
sub dword [rbp - 0xa0], 1
nop
nop
add dword [rbp - 0xa0], 1
mov rax, qword [rbp - 0xb0]
mov al, byte [rax + 2]
mov byte [rbp - 0xb8], al
mov rax, qword [rbp - 0xb0]
mov dl, byte [rax]
mov byte [rax + 2], dl
mov rdx, qword [rbp - 0xb0]
mov al, byte [rbp - 0xb8]
mov byte [rdx], al
add qword [rbp - 0xb0], 3
cmp ecx, dword [rbp - 0xa0]
jg 0x2512da18
mov qword [rsp + 0x20], 0
mov rdx, qword [rbp - 0xa8]
lea r9, [rbp - 0x30]
mov r8d, dword [rbp - 0x40]
mov rcx, qword [0x251377d0]
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x2512daad
call sub.kernel32.dll_GetLastError
mov dword [rbp - 0x28], eax
mov r8d, eax
lea rdx, str.Twain.ProcessMemory.WriteFile.Buffer
mov ecx, 1
call fcn.2512e3b0
mov rcx, rsp
lea rdx, [0x2512db0f]
call fcn.2512bbf0
mov eax, dword [rbp - 0x38]
mov edx, dword [rbp - 0x40]
sub eax, edx
mov dword [rbp - 0x38], eax
mov eax, dword [rbp - 0x40]
add qword [rbp - 0x98], rax
cmp dword [rbp - 0x38], 0
ja 0x2512d9b0
nop
mov rcx, rbp
call fcn.2512d3c0
cmp dword [rbp - 0x20], 6
jne 0x2512db0e
mov rcx, qword [0x251377d0]
call sub.kernel32.dll_CloseHandle
mov qword [0x251377d0], 0xffffffffffffffff
lea rcx, [0x25140ee0]
call fcn.2512cf50
test al, al
jne 0x2512db0e
lea rcx, [0x25140ee0]
call sub.kernel32.dll_DeleteFileW
nop
mov rcx, rbp
call fcn.2512d3e0
lea rsp, [rbp]
pop rbp
ret