Function at 0xf048cfe
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor ebx, ebx
inc ebx
push edi
mov dword [ebp - 8], 0x80
mov dword [ebp - 0xc], ebx
mov eax, dword fs:[0x18]
push dword [ebp + 8]
lea edi, [eax + 0xbf8]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
push 0
lea eax, [ebp - 0x14]
push eax
push edi
call dword [0xf09bdf8]
test eax, eax
jl 0xf048f40
mov edx, dword [ebp + 0xc]
test dl, 8
je 0xf048d55
mov eax, 0x80070001
jmp 0xf048f40
mov ecx, dword [ebp + 0x14]
mov eax, ecx
and eax, 0xf
sub eax, 0
push esi
je 0xf048d8d
dec eax
je 0xf048d7d
dec eax
jne 0xf048f3a
not cl
movzx esi, cl
and esi, 0x10
or esi, 0x40
shr esi, 4
jmp 0xf048d99
and cl, 0x10
neg cl
sbb ecx, ecx
neg ecx
add ecx, 3
mov esi, ecx
jmp 0xf048d99
cmp cx, 0x10
jne 0xf048f3a
mov esi, ebx
movzx eax, dx
mov ecx, eax
and ecx, 0x70
je 0xf048dd8
cmp ecx, 0x10
je 0xf048dd2
cmp ecx, 0x20
je 0xf048dcd
cmp ecx, 0x30
je 0xf048dc4
cmp ecx, 0x40
jne 0xf048f3a
mov dword [ebp + 8], 3
jmp 0xf048ddf
mov dword [ebp + 8], 2
jmp 0xf048ddf
mov dword [ebp + 8], ebx
jmp 0xf048ddf
and dword [ebp + 8], 0
jmp 0xf048ddf
mov dword [ebp + 8], 7
and eax, 0xf
sub eax, 0
mov ecx, 0x80000000
je 0xf048dfe
dec eax
je 0xf048e73
dec eax
je 0xf048e6c
dec eax
dec eax
jne 0xf048f3a
mov ebx, ecx
test dh, 0x98
jne 0xf048f3a
test dh, 1
je 0xf048e15
mov dword [ebp - 8], 0x20000080
test dh, 0x40
je 0xf048e1d
or dword [ebp - 8], ecx
push edi
call fcn.0f04695f
mov eax, dword [ebp + 0x10]
and dword [ebp - 0x1c], 0
push 0
and eax, 0x27
or eax, dword [ebp - 8]
mov dword [ebp - 0x20], 0xc
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x18], 1
push ebx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call esi
cmp edi, 0xffffffff
jne 0xf048e7a
or eax, 0x80070000
jmp 0xf048f3f
mov ebx, 0xc0000000
jmp 0xf048e00
mov ebx, 0x40000000
jmp 0xf048e00
cmp eax, 0xb7
jne 0xf048ec0
cmp word [ebp + 0x14], 0x12
jne 0xf048ecd
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0xf048ec6
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0xf048eb7
call esi
mov esi, eax
push edi
or esi, 0x80070000
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0xf048f3f
mov dword [ebp - 0xc], 3
jmp 0xf048ecd
test byte [ebp + 0x14], 0x10
je 0xf048ecd
mov dword [ebp - 0xc], 2
push 0
lea eax, [ebp - 4]
push eax
push 0
call sym.ntvdm.exe_VDDAllocateDosHandle
mov esi, eax
test si, si
jge 0xf048ef2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movsx eax, si
neg eax
jmp 0xf048e62
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
xor ecx, ecx
mov cl, al
and eax, 0x80
shl eax, 5
and ecx, 0x7f
mov word [edx + 2], cx
mov ecx, dword [ebp - 4]
mov byte [ecx + 4], 0
mov ecx, dword [ebp - 4]
mov word [ecx + 5], ax
mov eax, dword [ebp - 4]
or dword [eax + 7], 0xffffffff
mov eax, dword [ebp - 4]
mov cx, word [ebp - 0xc]
mov dword [eax + 0x1d], edi
mov eax, dword [ebp + 0x20]
mov word [eax], cx
mov eax, dword [ebp + 0x1c]
mov word [eax], si
xor eax, eax
jmp 0xf048f3f
mov eax, 0x80070057
pop esi
pop edi
pop ebx
leave
ret 0x1c