Function at 0xf00d1a5
Capabilities:
Clear file content
Get common file path
Get file size
Get geographical location
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x17c
mov eax, dword [0xf061038]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
xor edi, edi
push eax
mov dword [ebp - 0x16c], edi
mov dword [ebp - 0x17c], edi
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0x40
mov dword [ebp - 0x168], eax
push 0xf09bf80
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
cmp eax, 0x40
mov dword [0xf09bf6c], eax
jb 0xf00d20c
mov dword [0xf09bf6c], edi
mov byte [0xf09bf80], 0
mov bl, byte [ebp + 8]
lea eax, [ebp - 0x114]
push eax
movzx eax, bl
push eax
call fcn.0f03bd25
test bl, bl
mov dword [ebp - 0x178], 0xf09bfc0
jne 0xf00d237
mov dword [ebp - 0x178], 0xf09bfc4
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x174], eax
je 0xf00d28d
mov eax, dword [0xf09bf6c]
cmp eax, edi
je 0xf00d28d
cmp eax, 0x40
jae 0xf00d28d
push edi
push dword [ebp - 0x174]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, edi
mov dword [ebp - 0x15c], esi
je 0xf00d293
cmp esi, 0xffffffff
jne 0xf00d2aa
jmp 0xf00d293
mov esi, dword [ebp - 0x15c]
push edi
lea eax, [ebp - 0x114]
push eax
push 0x150
call fcn.0f03464d
call fcn.0f034c11
lea eax, [esi + 1]
push eax
call fcn.0f007089
test bl, bl
pop ecx
mov dword [ebp - 0x170], eax
jne 0xf00d2d8
push esi
call fcn.0f007089
pop ecx
mov dword [0xf077488], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x158], edi
jmp 0xf00d2dd
mov eax, dword [0xf077488]
cmp dword [ebp - 0x170], edi
je 0xf00d2ed
test bl, bl
jne 0xf00d304
cmp eax, edi
jne 0xf00d304
push edi
lea eax, [ebp - 0x114]
push eax
push 0x151
call fcn.0f03464d
call fcn.0f034c11
push dword [ebp - 0x178]
lea eax, [ebp - 0x160]
push eax
call fcn.0f00fe9e
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ebx, 0x104
mov edi, 0x152
je 0xf00d35d
push 0
lea eax, [ebp - 0x168]
push eax
push dword [ebp - 0x15c]
push dword [ebp - 0x170]
push dword [ebp - 0x174]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xf00d35d
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x168], eax
je 0xf00d382
lea eax, [ebp - 0x114]
push eax
push ebx
call esi
push 0
lea eax, [ebp - 0x114]
push eax
push edi
mov byte [ebp - 0xd5], 0
call fcn.0f03464d
call fcn.0f034c11
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
push 0x111
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
mov dword [ebp - 0x168], eax
je 0xf00d3a6
cmp eax, 0x3f
jbe 0xf00d3cb
lea eax, [ebp - 0x114]
push eax
push ebx
call esi
push 0
lea eax, [ebp - 0x114]
push eax
push edi
mov byte [ebp - 0xd5], 0
call fcn.0f03464d
call fcn.0f034c11
mov edx, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x15c]
mov byte [edx + ecx], 0
mov eax, dword [0xf09bf6c]
cmp byte [eax + 0xf09bf7f], 0x5c
jne 0xf00d3f6
dec eax
mov dword [0xf09bf6c], eax
mov byte [eax + 0xf09bf80], 0
test ecx, ecx
mov ebx, edx
je 0xf00d7da
cmp dword [ebp - 0x15c], 0
je 0xf00d7da
movsx eax, byte [ebx]
push eax
call fcn.0f00a0d5
test eax, eax
pop ecx
jne 0xf00d424
inc ebx
dec dword [ebp - 0x15c]
jne 0xf00d40d
cmp dword [ebp - 0x15c], 0
je 0xf00d7da
cmp byte [ebp + 8], 0
je 0xf00d58c
push ebx
push 7
push str.country
call fcn.0f00bcef
test eax, eax
je 0xf00d465
mov al, byte [ebx]
test al, al
je 0xf00d400
cmp al, 0xa
je 0xf00d400
cmp al, 0xd
je 0xf00d400
inc ebx
dec dword [ebp - 0x15c]
jne 0xf00d44c
jmp 0xf00d400
push ebx
push 5
push str.shell
call fcn.0f00bcef
mov esi, eax
test esi, esi
je 0xf00d7a3
jmp 0xf00d493
mov al, byte [esi]
test al, al
je 0xf00d4a1
cmp al, 0xa
je 0xf00d4a1
cmp al, 0xd
je 0xf00d4a1
dec dword [ebp - 0x15c]
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00a0d5
test eax, eax
pop ecx
je 0xf00d47e
push 0xc
push esi
push str._SystemRoot_
call fcn.0f00816a
add esp, 0xc
test eax, eax
jne 0xf00d4c0
push 0xc
pop eax
mov dword [ebp - 0x168], eax
jmp 0xf00d4fe
mov edi, 0xf09bf80
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf00d4ca
sub eax, edx
push eax
push esi
push edi
call fcn.0f00816a
add esp, 0xc
test eax, eax
jne 0xf00d4f2
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf00d4e7
sub eax, edx
jmp 0xf00d4f4
xor eax, eax
test eax, eax
mov dword [ebp - 0x168], eax
je 0xf00d514
push 0x15
add eax, esi
push eax
push str.System32command.com
call fcn.0f00816a
add esp, 0xc
test eax, eax
je 0xf00d55c
mov dword [ebp - 0x17c], esi
cmp dword [ebp - 0x15c], 0
je 0xf00d7da
mov al, byte [ebx]
test al, al
je 0xf00d400
cmp al, 0xa
je 0xf00d400
cmp al, 0xd
je 0xf00d400
inc ebx
dec dword [ebp - 0x15c]
jne 0xf00d527
jmp 0xf00d400
test al, al
je 0xf00d51a
cmp al, 0xa
je 0xf00d562
cmp al, 0xd
je 0xf00d562
inc esi
mov al, byte [esi]
cmp al, 0x2f
jne 0xf00d54f
mov al, byte [esi]
test al, al
je 0xf00d51a
cmp al, 0xa
je 0xf00d51a
cmp al, 0xd
je 0xf00d51a
push 3
push 0xf065024
push esi
call fcn.0f00816a
add esp, 0xc
test eax, eax
jne 0xf00d55b
mov dword [ebp - 0x16c], esi
jmp 0xf00d55b
push 6
push str.PROMPT
push ebx
call fcn.0f00816a
add esp, 0xc
test eax, eax
jne 0xf00d638
mov edi, dword [ebp - 0x164]
mov eax, str.PROMPT
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0xf00d5b3
add edi, 7
add dword [ebp - 0x158], 7
lea esi, [ebx + 6]
jmp 0xf00d5db
mov al, byte [esi]
test al, al
je 0xf00d5e9
cmp al, 0xa
je 0xf00d5e9
cmp al, 0xd
je 0xf00d5e9
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00a0d5
test eax, eax
pop ecx
je 0xf00d5cc
cmp byte [esi], 0x3d
jne 0xf00d62d
jmp 0xf00d602
mov al, byte [esi]
test al, al
je 0xf00d6d3
cmp al, 0xa
je 0xf00d62d
cmp al, 0xd
je 0xf00d62d
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00a0d5
test eax, eax
pop ecx
je 0xf00d5f0
jmp 0xf00d62d
cmp al, 0xa
je 0xf00d6d3
cmp al, 0xd
je 0xf00d6d3
mov byte [edi], al
inc edi
inc esi
inc dword [ebp - 0x158]
mov al, byte [esi]
test al, al
jne 0xf00d613
jmp 0xf00d6d3
push 4
push str.PATH
push ebx
call fcn.0f00816a
add esp, 0xc
test eax, eax
jne 0xf00d6e2
mov edi, dword [ebp - 0x164]
mov eax, str.PATH
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0xf00d65f
add edi, 5
add dword [ebp - 0x158], 5
lea esi, [ebx + 4]
jmp 0xf00d687
mov al, byte [esi]
test al, al
je 0xf00d695
cmp al, 0xa
je 0xf00d695
cmp al, 0xd
je 0xf00d695
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00a0d5
test eax, eax
pop ecx
je 0xf00d678
cmp byte [esi], 0x3d
jne 0xf00d6cd
jmp 0xf00d6aa
mov al, byte [esi]
test al, al
je 0xf00d6d3
cmp al, 0xa
je 0xf00d6cd
cmp al, 0xd
je 0xf00d6cd
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00a0d5
test eax, eax
pop ecx
je 0xf00d69c
jmp 0xf00d6cd
cmp al, 0xa
je 0xf00d6d3
cmp al, 0xd
je 0xf00d6d3
mov byte [edi], al
inc edi
inc esi
inc dword [ebp - 0x158]
mov al, byte [esi]
test al, al
jne 0xf00d6bb
mov byte [edi], 0
inc edi
mov dword [ebp - 0x164], edi
jmp 0xf00d79d
push 3
push 0xf06502c
push ebx
call fcn.0f00816a
add esp, 0xc
test eax, eax
jne 0xf00d7a3
lea esi, [ebx + 3]
jmp 0xf00d70e
mov al, byte [esi]
test al, al
je 0xf00d71c
cmp al, 0xa
je 0xf00d71c
cmp al, 0xd
je 0xf00d71c
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00a0d5
test eax, eax
pop ecx
je 0xf00d6ff
mov cl, byte [esi]
mov eax, esi
jmp 0xf00d734
cmp cl, 0xa
je 0xf00d738
cmp cl, 0xd
je 0xf00d738
cmp cl, 0x3d
je 0xf00d738
inc eax
mov cl, byte [eax]
test cl, cl
jne 0xf00d722
mov cl, byte [eax]
test cl, cl
je 0xf00d7a3
cmp cl, 0xa
je 0xf00d7a3
cmp cl, 0xd
je 0xf00d7a3
cmp esi, eax
jae 0xf00d768
mov ecx, eax
sub ecx, esi
add dword [ebp - 0x158], ecx
mov ecx, dword [ebp - 0x164]
mov dl, byte [esi]
mov byte [ecx], dl
inc ecx
inc esi
cmp esi, eax
jb 0xf00d75c
jmp 0xf00d76e
mov ecx, dword [ebp - 0x164]
mov byte [ecx], 0
inc ecx
inc dword [ebp - 0x158]
inc esi
jmp 0xf00d78d
cmp al, 0xa
je 0xf00d793
cmp al, 0xd
je 0xf00d793
mov byte [ecx], al
inc ecx
inc esi
inc dword [ebp - 0x158]
mov al, byte [esi]
test al, al
jne 0xf00d77b
mov byte [ecx], 0
inc ecx
mov dword [ebp - 0x164], ecx
inc dword [ebp - 0x158]
push dword [ebp - 0x15c]
push ebx
push dword [ebp - 0x160]
call fcn.0f01913c
sub dword [ebp - 0x15c], eax
push 2
push 0xf065028
push dword [ebp - 0x160]
mov dword [ebp - 0x168], eax
add ebx, eax
call fcn.0f00a272
jmp 0xf00d400
cmp byte [ebp + 8], 0
je 0xf00d9c6
push 0x3f
lea eax, [ebp - 0x154]
push eax
push 0xa
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0xf00d815
push 0xa
lea eax, [ebp - 0x154]
push 0
push eax
call fcn.0f00b8af
add esp, 0xc
mov edi, eax
jmp 0xf00d818
xor edi, edi
inc edi
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0xf065028
mov ecx, str.country
push ecx
mov esi, 0xf09bf80
push esi
push eax
push edi
push ecx
lea eax, [ebp - 0x114]
push 0xf003964
push eax
call fcn.0f01347c
lea eax, [ebp - 0x114]
add esp, 0x20
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0xf00d84f
sub eax, ecx
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x160]
call fcn.0f00a272
push esi
push str.System32command.com
push esi
push str.shell
lea eax, [ebp - 0x114]
push 0xf00394c
push eax
call fcn.0f01347c
lea eax, [ebp - 0x114]
add esp, 0x18
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0xf00d894
sub eax, ecx
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x160]
call fcn.0f00a272
mov ebx, dword [ebp - 0x17c]
test ebx, ebx
je 0xf00d922
movsx eax, byte [ebx]
push eax
call fcn.0f00a0d5
test eax, eax
pop ecx
je 0xf00d922
mov al, byte [ebx]
mov esi, ebx
jmp 0xf00d8d9
cmp al, 0xa
je 0xf00d8dd
cmp al, 0xd
je 0xf00d8dd
inc esi
mov al, byte [esi]
test al, al
jne 0xf00d8ce
mov edi, dword [ebp - 0x16c]
test esi, esi
je 0xf00d9b4
test ebx, ebx
mov byte [esi], 0
je 0xf00d956
call fcn.0f00d187
mov esi, 0xf003944
lea edi, [ebp - 0x114]
movsd dword es:[edi], dword [esi]
mov eax, ebx
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf00d908
lea edi, [ebp - 0x114]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xf00d918
jmp 0xf00d97f
mov edi, dword [ebp - 0x16c]
test edi, edi
je 0xf00d952
movsx eax, byte [edi]
push eax
call fcn.0f00a0d5
test eax, eax
pop ecx
je 0xf00d952
movsx eax, byte [edi]
mov esi, edi
jmp 0xf00d945
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00a0d5
test eax, eax
pop ecx
jne 0xf00d941
jmp 0xf00d8e3
xor esi, esi
jmp 0xf00d8e3
test edi, edi
je 0xf00d98f
mov eax, edi
mov word [ebp - 0x114], 0x20
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf00d967
lea edi, [ebp - 0x114]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xf00d977
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf00d998
sub eax, edx
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x160]
call fcn.0f01913c
push 2
push 0xf065028
push dword [ebp - 0x160]
call fcn.0f00a272
push dword [ebp - 0x160]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebp - 0x160]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x174]
call esi
push dword [ebp - 0x170]
call fcn.0f0058a2
cmp byte [ebp + 8], 0
pop ecx
pop edi
pop esi
pop ebx
jne 0xf00da3c
mov ecx, dword [ebp - 0x158]
test ecx, ecx
mov eax, dword [0xf077488]
je 0xf00da2e
test eax, eax
je 0xf00da2e
mov byte [eax + ecx], 0
inc ecx
push ecx
push dword [0xf077488]
call fcn.0f01011d
test eax, eax
pop ecx
pop ecx
je 0xf00da3c
mov dword [0xf077488], eax
jmp 0xf00da3c
push eax
call fcn.0f0058a2
and dword [0xf077488], 0
pop ecx
mov ecx, dword [ebp - 4]
call fcn.0f01b780
leave
ret 4