Function at 0xf00d24d
Capabilities:
Clear file content
Get common file path
Get file size
Get geographical location
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x17c
mov eax, dword [0xf062038]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
xor esi, esi
push eax
mov dword [ebp - 0x16c], esi
mov dword [ebp - 0x17c], esi
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0x40
mov dword [ebp - 0x168], eax
push 0xf09cfc0
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
cmp eax, 0x40
mov dword [0xf09cfac], eax
jb 0xf00d2b4
mov dword [0xf09cfac], esi
mov byte [0xf09cfc0], 0
mov bl, byte [ebp + 8]
push esi
lea eax, [ebp - 0x114]
push eax
movzx eax, bl
push eax
call fcn.0f01b6e4
test bl, bl
mov dword [ebp - 0x178], 0xf09d000
jne 0xf00d2e0
mov dword [ebp - 0x178], 0xf09d004
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x174], eax
je 0xf00d336
mov eax, dword [0xf09cfac]
cmp eax, esi
je 0xf00d336
cmp eax, 0x40
jae 0xf00d336
push esi
push dword [ebp - 0x174]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x15c], edi
je 0xf00d33c
cmp edi, 0xffffffff
jne 0xf00d353
jmp 0xf00d33c
mov edi, dword [ebp - 0x15c]
push esi
lea eax, [ebp - 0x114]
push eax
push 0x150
call fcn.0f034840
call fcn.0f034e04
lea eax, [edi + 1]
push eax
call fcn.0f0070c9
test bl, bl
pop ecx
mov dword [ebp - 0x170], eax
jne 0xf00d381
push edi
call fcn.0f0070c9
pop ecx
mov dword [0xf0784c8], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x158], esi
jmp 0xf00d386
mov eax, dword [0xf0784c8]
cmp dword [ebp - 0x170], esi
je 0xf00d396
test bl, bl
jne 0xf00d3ad
cmp eax, esi
jne 0xf00d3ad
push esi
lea eax, [ebp - 0x114]
push eax
push 0x151
call fcn.0f034840
call fcn.0f034e04
push dword [ebp - 0x178]
lea eax, [ebp - 0x160]
push eax
call fcn.0f00ff55
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ebx, 0x104
mov edi, 0x152
je 0xf00d406
push 0
lea eax, [ebp - 0x168]
push eax
push dword [ebp - 0x15c]
push dword [ebp - 0x170]
push dword [ebp - 0x174]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xf00d406
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x168], eax
je 0xf00d42b
lea eax, [ebp - 0x114]
push eax
push ebx
call esi
push 0
lea eax, [ebp - 0x114]
push eax
push edi
mov byte [ebp - 0xd5], 0
call fcn.0f034840
call fcn.0f034e04
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
push 0x111
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
mov dword [ebp - 0x168], eax
je 0xf00d44f
cmp eax, 0x3f
jbe 0xf00d474
lea eax, [ebp - 0x114]
push eax
push ebx
call esi
push 0
lea eax, [ebp - 0x114]
push eax
push edi
mov byte [ebp - 0xd5], 0
call fcn.0f034840
call fcn.0f034e04
mov edx, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x15c]
mov byte [edx + ecx], 0
mov eax, dword [0xf09cfac]
cmp byte [eax + 0xf09cfbf], 0x5c
jne 0xf00d49f
dec eax
mov dword [0xf09cfac], eax
mov byte [eax + 0xf09cfc0], 0
test ecx, ecx
mov ebx, edx
je 0xf00d883
cmp dword [ebp - 0x15c], 0
je 0xf00d883
movsx eax, byte [ebx]
push eax
call fcn.0f00a17d
test eax, eax
pop ecx
jne 0xf00d4cd
inc ebx
dec dword [ebp - 0x15c]
jne 0xf00d4b6
cmp dword [ebp - 0x15c], 0
je 0xf00d883
cmp byte [ebp + 8], 0
je 0xf00d635
push ebx
push 7
push str.country
call fcn.0f00bd97
test eax, eax
je 0xf00d50e
mov al, byte [ebx]
test al, al
je 0xf00d4a9
cmp al, 0xa
je 0xf00d4a9
cmp al, 0xd
je 0xf00d4a9
inc ebx
dec dword [ebp - 0x15c]
jne 0xf00d4f5
jmp 0xf00d4a9
push ebx
push 5
push str.shell
call fcn.0f00bd97
mov esi, eax
test esi, esi
je 0xf00d84c
jmp 0xf00d53c
mov al, byte [esi]
test al, al
je 0xf00d54a
cmp al, 0xa
je 0xf00d54a
cmp al, 0xd
je 0xf00d54a
dec dword [ebp - 0x15c]
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00a17d
test eax, eax
pop ecx
je 0xf00d527
push 0xc
push esi
push str._SystemRoot_
call fcn.0f0081aa
add esp, 0xc
test eax, eax
jne 0xf00d569
push 0xc
pop eax
mov dword [ebp - 0x168], eax
jmp 0xf00d5a7
mov edi, 0xf09cfc0
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf00d573
sub eax, edx
push eax
push esi
push edi
call fcn.0f0081aa
add esp, 0xc
test eax, eax
jne 0xf00d59b
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf00d590
sub eax, edx
jmp 0xf00d59d
xor eax, eax
test eax, eax
mov dword [ebp - 0x168], eax
je 0xf00d5bd
push 0x15
add eax, esi
push eax
push str.System32command.com
call fcn.0f0081aa
add esp, 0xc
test eax, eax
je 0xf00d605
mov dword [ebp - 0x17c], esi
cmp dword [ebp - 0x15c], 0
je 0xf00d883
mov al, byte [ebx]
test al, al
je 0xf00d4a9
cmp al, 0xa
je 0xf00d4a9
cmp al, 0xd
je 0xf00d4a9
inc ebx
dec dword [ebp - 0x15c]
jne 0xf00d5d0
jmp 0xf00d4a9
test al, al
je 0xf00d5c3
cmp al, 0xa
je 0xf00d60b
cmp al, 0xd
je 0xf00d60b
inc esi
mov al, byte [esi]
cmp al, 0x2f
jne 0xf00d5f8
mov al, byte [esi]
test al, al
je 0xf00d5c3
cmp al, 0xa
je 0xf00d5c3
cmp al, 0xd
je 0xf00d5c3
push 3
push 0xf06602c
push esi
call fcn.0f0081aa
add esp, 0xc
test eax, eax
jne 0xf00d604
mov dword [ebp - 0x16c], esi
jmp 0xf00d604
push 6
push str.PROMPT
push ebx
call fcn.0f0081aa
add esp, 0xc
test eax, eax
jne 0xf00d6e1
mov edi, dword [ebp - 0x164]
mov eax, str.PROMPT
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0xf00d65c
add edi, 7
add dword [ebp - 0x158], 7
lea esi, [ebx + 6]
jmp 0xf00d684
mov al, byte [esi]
test al, al
je 0xf00d692
cmp al, 0xa
je 0xf00d692
cmp al, 0xd
je 0xf00d692
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00a17d
test eax, eax
pop ecx
je 0xf00d675
cmp byte [esi], 0x3d
jne 0xf00d6d6
jmp 0xf00d6ab
mov al, byte [esi]
test al, al
je 0xf00d77c
cmp al, 0xa
je 0xf00d6d6
cmp al, 0xd
je 0xf00d6d6
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00a17d
test eax, eax
pop ecx
je 0xf00d699
jmp 0xf00d6d6
cmp al, 0xa
je 0xf00d77c
cmp al, 0xd
je 0xf00d77c
mov byte [edi], al
inc edi
inc esi
inc dword [ebp - 0x158]
mov al, byte [esi]
test al, al
jne 0xf00d6bc
jmp 0xf00d77c
push 4
push str.PATH
push ebx
call fcn.0f0081aa
add esp, 0xc
test eax, eax
jne 0xf00d78b
mov edi, dword [ebp - 0x164]
mov eax, str.PATH
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0xf00d708
add edi, 5
add dword [ebp - 0x158], 5
lea esi, [ebx + 4]
jmp 0xf00d730
mov al, byte [esi]
test al, al
je 0xf00d73e
cmp al, 0xa
je 0xf00d73e
cmp al, 0xd
je 0xf00d73e
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00a17d
test eax, eax
pop ecx
je 0xf00d721
cmp byte [esi], 0x3d
jne 0xf00d776
jmp 0xf00d753
mov al, byte [esi]
test al, al
je 0xf00d77c
cmp al, 0xa
je 0xf00d776
cmp al, 0xd
je 0xf00d776
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00a17d
test eax, eax
pop ecx
je 0xf00d745
jmp 0xf00d776
cmp al, 0xa
je 0xf00d77c
cmp al, 0xd
je 0xf00d77c
mov byte [edi], al
inc edi
inc esi
inc dword [ebp - 0x158]
mov al, byte [esi]
test al, al
jne 0xf00d764
mov byte [edi], 0
inc edi
mov dword [ebp - 0x164], edi
jmp 0xf00d846
push 3
push 0xf066034
push ebx
call fcn.0f0081aa
add esp, 0xc
test eax, eax
jne 0xf00d84c
lea esi, [ebx + 3]
jmp 0xf00d7b7
mov al, byte [esi]
test al, al
je 0xf00d7c5
cmp al, 0xa
je 0xf00d7c5
cmp al, 0xd
je 0xf00d7c5
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00a17d
test eax, eax
pop ecx
je 0xf00d7a8
mov cl, byte [esi]
mov eax, esi
jmp 0xf00d7dd
cmp cl, 0xa
je 0xf00d7e1
cmp cl, 0xd
je 0xf00d7e1
cmp cl, 0x3d
je 0xf00d7e1
inc eax
mov cl, byte [eax]
test cl, cl
jne 0xf00d7cb
mov cl, byte [eax]
test cl, cl
je 0xf00d84c
cmp cl, 0xa
je 0xf00d84c
cmp cl, 0xd
je 0xf00d84c
cmp esi, eax
jae 0xf00d811
mov ecx, eax
sub ecx, esi
add dword [ebp - 0x158], ecx
mov ecx, dword [ebp - 0x164]
mov dl, byte [esi]
mov byte [ecx], dl
inc ecx
inc esi
cmp esi, eax
jb 0xf00d805
jmp 0xf00d817
mov ecx, dword [ebp - 0x164]
mov byte [ecx], 0
inc ecx
inc dword [ebp - 0x158]
inc esi
jmp 0xf00d836
cmp al, 0xa
je 0xf00d83c
cmp al, 0xd
je 0xf00d83c
mov byte [ecx], al
inc ecx
inc esi
inc dword [ebp - 0x158]
mov al, byte [esi]
test al, al
jne 0xf00d824
mov byte [ecx], 0
inc ecx
mov dword [ebp - 0x164], ecx
inc dword [ebp - 0x158]
push dword [ebp - 0x15c]
push ebx
push dword [ebp - 0x160]
call fcn.0f0192a0
sub dword [ebp - 0x15c], eax
push 2
push 0xf066030
push dword [ebp - 0x160]
mov dword [ebp - 0x168], eax
add ebx, eax
call fcn.0f00a31a
jmp 0xf00d4a9
cmp byte [ebp + 8], 0
je 0xf00da6f
push 0x3f
lea eax, [ebp - 0x154]
push eax
push 0xa
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0xf00d8be
push 0xa
lea eax, [ebp - 0x154]
push 0
push eax
call fcn.0f00b957
add esp, 0xc
mov edi, eax
jmp 0xf00d8c1
xor edi, edi
inc edi
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0xf066030
mov ecx, str.country
push ecx
mov esi, 0xf09cfc0
push esi
push eax
push edi
push ecx
lea eax, [ebp - 0x114]
push 0xf003998
push eax
call fcn.0f013533
lea eax, [ebp - 0x114]
add esp, 0x20
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0xf00d8f8
sub eax, ecx
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x160]
call fcn.0f00a31a
push esi
push str.System32command.com
push esi
push str.shell
lea eax, [ebp - 0x114]
push 0xf003980
push eax
call fcn.0f013533
lea eax, [ebp - 0x114]
add esp, 0x18
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0xf00d93d
sub eax, ecx
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x160]
call fcn.0f00a31a
mov ebx, dword [ebp - 0x17c]
test ebx, ebx
je 0xf00d9cb
movsx eax, byte [ebx]
push eax
call fcn.0f00a17d
test eax, eax
pop ecx
je 0xf00d9cb
mov al, byte [ebx]
mov esi, ebx
jmp 0xf00d982
cmp al, 0xa
je 0xf00d986
cmp al, 0xd
je 0xf00d986
inc esi
mov al, byte [esi]
test al, al
jne 0xf00d977
mov edi, dword [ebp - 0x16c]
test esi, esi
je 0xf00da5d
test ebx, ebx
mov byte [esi], 0
je 0xf00d9ff
call fcn.0f00d22f
mov esi, 0xf003978
lea edi, [ebp - 0x114]
movsd dword es:[edi], dword [esi]
mov eax, ebx
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf00d9b1
lea edi, [ebp - 0x114]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xf00d9c1
jmp 0xf00da28
mov edi, dword [ebp - 0x16c]
test edi, edi
je 0xf00d9fb
movsx eax, byte [edi]
push eax
call fcn.0f00a17d
test eax, eax
pop ecx
je 0xf00d9fb
movsx eax, byte [edi]
mov esi, edi
jmp 0xf00d9ee
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00a17d
test eax, eax
pop ecx
jne 0xf00d9ea
jmp 0xf00d98c
xor esi, esi
jmp 0xf00d98c
test edi, edi
je 0xf00da38
mov eax, edi
mov word [ebp - 0x114], 0x20
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf00da10
lea edi, [ebp - 0x114]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xf00da20
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf00da41
sub eax, edx
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x160]
call fcn.0f0192a0
push 2
push 0xf066030
push dword [ebp - 0x160]
call fcn.0f00a31a
push dword [ebp - 0x160]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebp - 0x160]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x174]
call esi
push dword [ebp - 0x170]
call fcn.0f0058e2
cmp byte [ebp + 8], 0
pop ecx
pop edi
pop esi
pop ebx
jne 0xf00dae5
mov ecx, dword [ebp - 0x158]
test ecx, ecx
mov eax, dword [0xf0784c8]
je 0xf00dad7
test eax, eax
je 0xf00dad7
mov byte [eax + ecx], 0
inc ecx
push ecx
push dword [0xf0784c8]
call fcn.0f0101d4
test eax, eax
pop ecx
pop ecx
je 0xf00dae5
mov dword [0xf0784c8], eax
jmp 0xf00dae5
push eax
call fcn.0f0058e2
and dword [0xf0784c8], 0
pop ecx
mov ecx, dword [ebp - 4]
call fcn.0f01b9b9
leave
ret 4