Function at 0x1000eec1
Capabilities:
Delete file
Get common file path
Move file
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
push ebx
push esi
push edi
push 0x20
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
cmp eax, ebx
je 0x1000ef12
push str.MoveFileExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x1000ef12
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 4
push ebx
push dword [ebp + 8]
call esi
cmp eax, ebx
jne 0x1000f116
cmp dword [ebp + 0xc], ebx
je 0x1000f116
mov edi, 0x104
lea eax, [ebp - 0x110]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp eax, ebx
jbe 0x1000f116
cmp eax, 0xf7
jae 0x1000f116
lea eax, [ebp - 0x110]
push str.wininit.ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x318]
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
cmp eax, ebx
jbe 0x1000f116
cmp eax, edi
jae 0x1000f116
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x318]
push eax
call edi
mov dword [ebp - 4], eax
lea esi, [eax + 0x1b]
lea eax, [ebp - 0xc]
or dword [ebp - 0xc], 0xffffffff
push eax
lea eax, [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x110]
mov dword [ebp + 8], ebx
push eax
call fcn.1000e6b3
mov ebx, eax
add esp, 0x10
test ebx, ebx
mov dword [ebp + 0xc], ebx
jne 0x1000efc8
push esi
call fcn.1000b9fd
and dword [ebp + 8], ebx
pop ecx
test eax, eax
mov dword [ebp + 0xc], eax
je 0x1000f116
mov ebx, eax
mov eax, dword [ebp + 8]
push str._rename_
push ebx
and byte [ebx + eax], 0
call fcn.1000aaf3
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x1000f00a
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add eax, ebx
push str._r_n_rename__r_nNUL
push eax
call esi
lea eax, [ebp - 0x318]
push eax
mov eax, dword [ebp + 8]
add eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x1000f050
add esi, 8
push esi
mov dword [ebp - 8], esi
call edi
mov ecx, dword [ebp - 4]
inc eax
push eax
push esi
lea ebx, [ecx + esi + 8]
push ebx
call fcn.1000a965
add esp, 0xc
push dword [0x10018420]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call esi
lea eax, [ebp - 0x318]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov byte [ebx - 1], 0xa
mov byte [ebx - 2], 0xd
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x214]
push eax
call esi
lea eax, [ebp - 0x214]
push str..tmp
push eax
call edi
lea ecx, [ebp - 0x214]
sub ecx, 4
add eax, ecx
push eax
call esi
xor esi, esi
lea eax, [ebp - 0x214]
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push eax
mov dword [ebp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x1000f0da
lea eax, [ebp - 8]
push esi
push eax
push ebx
mov dword [ebp - 8], esi
call edi
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000f0ce
push ebx
call edi
cmp eax, dword [ebp - 8]
mov dword [ebp + 0xc], 1
je 0x1000f0d1
mov dword [ebp + 0xc], esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.1000ba08
cmp dword [ebp - 0xc], 0xffffffff
pop ecx
je 0x1000f0f0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0xc], esi
je 0x1000f116
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop edi
pop esi
pop ebx
leave
ret