Function at 0x2e01aa57
Capabilities:
Delete file
Read file on windows

Disassembly:
push 0x878
mov eax, 0x2e101a87
call fcn.2e01c44f
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x854], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x85c], eax
xor eax, eax
mov esi, 0x208
xor ebx, ebx
push esi
mov word [ebp - 0x630], ax
lea eax, [ebp - 0x62e]
push ebx
push eax
mov dword [ebp - 0x858], ecx
mov dword [ebp - 0x848], 0xfffffffb
mov dword [ebp - 0x844], ebx
call fcn.2e01b598
add esp, 0xc
push ebx
push edi
push dword [ebp - 0x840]
call fcn.2e01a0e0
test al, al
jne 0x2e01aad4
push 0xfffffffffffffffb
pop eax
jmp 0x2e01ad9e
lea eax, [ebp - 0x630]
push eax
mov edi, 0x105
push edi
call fcn.2e019fdc
dec eax
mov dword [ebp - 0x860], eax
cmp eax, 0x104
ja 0x2e01ab36
xor eax, eax
push esi
mov word [ebp - 0x83c], ax
lea eax, [ebp - 0x83a]
push ebx
push eax
call fcn.2e01b598
add esp, 0xc
push ebx
push 0x2e001f40
push 0x2e001ef8
push edi
lea eax, [ebp - 0x83c]
push eax
call fcn.2e019c43
test al, al
je 0x2e01ab36
lea eax, [ebp - 0x83c]
push eax
call fcn.2e01a05f
cmp dword [ebp - 0x840], ebx
jne 0x2e01ab45
cmp dword [ebp + 0xc], ebx
jne 0x2e01ab4d
jmp 0x2e01aacc
cmp dword [ebp + 0xc], ebx
je 0x2e01ab4d
mov dword [ebp + 0xc], ebx
mov esi, dword [ebp - 0x858]
mov ecx, esi
call fcn.2e01a2fe
test al, al
je 0x2e01ad75
push dword [ebp - 0x840]
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.2e01ada6
test eax, eax
je 0x2e01ad75
cmp dword [ebp + 0xc], ebx
jne 0x2e01ad4b
lea eax, [ebp - 0x218]
push eax
push edi
lea eax, [ebp - 0x424]
push eax
call fcn.2e019e68
test eax, eax
je 0x2e01ad75
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 0x424]
push edx
push eax
call dword [ecx + 0x44]
cmp eax, ebx
jne 0x2e01ad4b
mov eax, dword [esi + 4]
mov ecx, dword [eax]
add esi, 0x10
push esi
push eax
call dword [ecx + 0x20]
test eax, eax
jl 0x2e01ad75
push 0x104
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.2e01a9dd
cmp al, 1
jne 0x2e01ad75
lea eax, [ebp - 0x114]
push eax
push edi
lea eax, [ebp - 0x424]
push eax
call fcn.2e019e68
test eax, eax
je 0x2e01ad75
mov eax, dword [esi]
mov ecx, dword [eax]
push ebx
push 0xffffffffffffffff
push 1
lea edx, [ebp - 0x424]
push edx
push eax
call dword [ecx + 0xb0]
test eax, eax
jl 0x2e01ad75
mov edi, 0x1000
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x844], eax
cmp eax, ebx
je 0x2e01ad75
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x840], eax
cmp eax, ebx
je 0x2e01ad55
push ebx
push 0x8000000
push 3
push ebx
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x848], 0xfffffffc
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x84c], eax
cmp eax, 0xffffffff
je 0x2e01ad3c
lea ecx, [ebp - 0x884]
call fcn.2e01ae12
push dword [ebp - 0x854]
mov dword [ebp - 4], ebx
push dword [ebp - 0x854]
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push 1
push dword [ebp - 0x85c]
lea ecx, [ebp - 0x884]
call fcn.2e01ae35
test al, al
je 0x2e01ad21
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x2e01acf5
cmp dword [ebp - 0x850], ebx
je 0x2e01ad10
push dword [ebp - 0x850]
lea ecx, [ebp - 0x884]
push dword [ebp - 0x840]
call fcn.2e01af29
push ebx
lea eax, [ebp - 0x850]
push eax
push edi
push dword [ebp - 0x840]
push dword [ebp - 0x84c]
call esi
test eax, eax
jne 0x2e01acd6
lea ecx, [ebp - 0x884]
mov dword [ebp - 0x848], ebx
call fcn.2e01b018
push dword [ebp - 0x84c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x884]
call fcn.2e01b062
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x2e01ad55
mov dword [ebp - 0x848], 0xfffffffb
cmp dword [ebp - 0x844], ebx
je 0x2e01ad75
push dword [ebp - 0x844]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 0x844]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0x858]
call fcn.2e019f85
cmp dword [ebp - 0x860], 0x104
ja 0x2e01ad98
lea eax, [ebp - 0x630]
push eax
call fcn.2e01a05f
mov eax, dword [ebp - 0x848]
call fcn.2e01c4d2
ret 0x18