Function at 0x10144584
Capabilities:
Delete file
Get common file path
Move file
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x1019fbfc]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x30], edx
xor edx, edx
push edi
mov dword [ebp - 0x40], ecx
xor edi, edi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x3c], eax
mov dword [eax], 1
call fcn.1013ac07
mov dword [ebp - 0x54], eax
test eax, eax
jne 0x101445dc
push 2
mov edx, 0x1003484c
mov ecx, esi
call fcn.1013a62f
xor eax, eax
jmp 0x10144857
add eax, 0x18
push eax
call fcn.10161b89
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x10144600
push edi
mov edx, 0x10034820
mov ecx, esi
call fcn.1013a62f
mov eax, dword [ebp - 0x3c]
mov dword [eax], edi
jmp 0x101445d5
mov ecx, dword [ebp - 0x40]
lea edx, [ebx + 0x18]
call fcn.1013ac07
mov edx, dword [ebp - 0x54]
add edx, 0x18
lea ecx, [edx - 0x18]
cmp eax, ecx
je 0x10144622
mov edx, 0x10034888
jmp 0x10144844
mov eax, dword [ebp + 8]
lea ecx, [ebx + 4]
mov dword [ebx], edi
mov dword [ecx], edx
add edx, 0xfffffffc
mov dword [ebx + 8], 0x5251955
mov dword [ebx + 0xc], 0x1c
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebx + 0x14], eax
call fcn.10109f5b
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x10144655
mov dword [ecx], eax
mov dword [ebx], eax
lea eax, [ebp - 0x2c]
push eax
push edi
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x101447e9
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x101447e9
mov esi, dword [ebp - 0x30]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x10144684
sub esi, ecx
lea ecx, [ebp - 0x50]
sar esi, 1
lea esi, [esi*2 + 2]
push esi
call fcn.1013a608
push esi
lea ecx, [ebp - 0x44]
call fcn.1013a608
push esi
lea ecx, [ebp - 0x5c]
call fcn.1013a608
lea eax, [esi + 0x208]
push eax
lea ecx, [ebp - 0x64]
call fcn.1013a608
push esi
lea ecx, [ebp - 0x38]
call fcn.1013a608
mov esi, dword [ebp - 0x64]
cmp dword [ebp - 0x50], edi
je 0x10144868
cmp dword [ebp - 0x44], edi
je 0x10144868
cmp dword [ebp - 0x5c], edi
je 0x10144868
test esi, esi
je 0x10144868
cmp dword [ebp - 0x38], edi
je 0x10144868
mov eax, dword [ebp - 0x58]
push edi
push edi
shr eax, 1
push eax
push dword [ebp - 0x5c]
mov eax, dword [ebp - 0x40]
shr eax, 1
push eax
push dword [ebp - 0x44]
mov eax, dword [ebp - 0x4c]
shr eax, 1
push eax
push dword [ebp - 0x50]
push dword [ebp - 0x30]
call dword [sym.imp.msvcrt.dll__wsplitpath_s]
mov eax, 0x10018c4c
push eax
push eax
push dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
push dword [ebp - 0x50]
shr eax, 1
push eax
push dword [ebp - 0x38]
call dword [sym.imp.msvcrt.dll__wmakepath_s]
add esp, 0x3c
push esi
push edi
push 0x10034880
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x10144797
mov edx, 0x100348f4
mov ecx, dword [ebp - 0x48]
push 2
call fcn.1013a62f
push dword [ebp - 0x38]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
push dword [ebp - 0x5c]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
push dword [ebp - 0x44]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
push dword [ebp - 0x50]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
add esp, 0x14
jmp 0x1014484d
push 1
push esi
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x101447ae
mov edx, 0x100348b0
jmp 0x1014475a
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push dword [ebp - 0x38]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
push dword [ebp - 0x5c]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
push dword [ebp - 0x44]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
push dword [ebp - 0x50]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
mov esi, dword [ebp - 0x48]
add esp, 0x14
push edi
push 0x8000080
push 2
push edi
push edi
push 0x40000000
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x34], eax
cmp eax, 0xffffffff
je 0x1014483f
push edi
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
push ecx
mov ecx, dword [ebp - 0x54]
add ecx, 0x18
push ecx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10144832
mov eax, dword [ebp - 0x54]
add eax, 0x18
cmp eax, dword [ebp - 0x3c]
jne 0x10144832
xor edi, edi
inc edi
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x1014484d
mov edx, 0x10034930
push 2
mov ecx, esi
call fcn.1013a62f
push ebx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
pop ecx
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101637b0
leave
ret 0x14
mov eax, dword [ebp - 0x3c]
push dword [ebp - 0x38]
mov dword [eax], edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
push dword [ebp - 0x5c]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
push dword [ebp - 0x44]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
push dword [ebp - 0x50]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
add esp, 0x14
jmp 0x101445d5