Function at 0xf00d0ac
Capabilities:
Clear file content
Get common file path
Get file size
Get geographical location
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x17c
mov eax, dword [0xf061038]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
xor edi, edi
push eax
mov dword [ebp - 0x16c], edi
mov dword [ebp - 0x17c], edi
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0x40
mov dword [ebp - 0x168], eax
push 0xf09bec0
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
cmp eax, 0x40
mov dword [0xf09beac], eax
jb 0xf00d113
mov dword [0xf09beac], edi
mov byte [0xf09bec0], 0
mov bl, byte [ebp + 8]
lea eax, [ebp - 0x114]
push eax
movzx eax, bl
push eax
call fcn.0f03b7d7
test bl, bl
mov dword [ebp - 0x178], 0xf09bf00
jne 0xf00d13e
mov dword [ebp - 0x178], 0xf09bf04
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x174], eax
je 0xf00d194
mov eax, dword [0xf09beac]
cmp eax, edi
je 0xf00d194
cmp eax, 0x40
jae 0xf00d194
push edi
push dword [ebp - 0x174]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, edi
mov dword [ebp - 0x15c], esi
je 0xf00d19a
cmp esi, 0xffffffff
jne 0xf00d1b1
jmp 0xf00d19a
mov esi, dword [ebp - 0x15c]
push edi
lea eax, [ebp - 0x114]
push eax
push 0x150
call fcn.0f03429c
call fcn.0f034856
lea eax, [esi + 1]
push eax
call fcn.0f006f83
test bl, bl
pop ecx
mov dword [ebp - 0x170], eax
jne 0xf00d1df
push esi
call fcn.0f006f83
pop ecx
mov dword [0xf0773d0], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x158], edi
jmp 0xf00d1e4
mov eax, dword [0xf0773d0]
cmp dword [ebp - 0x170], edi
je 0xf00d1f4
test bl, bl
jne 0xf00d20b
cmp eax, edi
jne 0xf00d20b
push edi
lea eax, [ebp - 0x114]
push eax
push 0x151
call fcn.0f03429c
call fcn.0f034856
push dword [ebp - 0x178]
lea eax, [ebp - 0x160]
push eax
call fcn.0f00fda1
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ebx, 0x104
mov edi, 0x152
je 0xf00d264
push 0
lea eax, [ebp - 0x168]
push eax
push dword [ebp - 0x15c]
push dword [ebp - 0x170]
push dword [ebp - 0x174]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xf00d264
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x168], eax
je 0xf00d289
lea eax, [ebp - 0x114]
push eax
push ebx
call esi
push 0
lea eax, [ebp - 0x114]
push eax
push edi
mov byte [ebp - 0xd5], 0
call fcn.0f03429c
call fcn.0f034856
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
push 0x111
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
mov dword [ebp - 0x168], eax
je 0xf00d2ad
cmp eax, 0x3f
jbe 0xf00d2d2
lea eax, [ebp - 0x114]
push eax
push ebx
call esi
push 0
lea eax, [ebp - 0x114]
push eax
push edi
mov byte [ebp - 0xd5], 0
call fcn.0f03429c
call fcn.0f034856
mov edx, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x15c]
mov byte [edx + ecx], 0
mov eax, dword [0xf09beac]
cmp byte [eax + 0xf09bebf], 0x5c
jne 0xf00d2fd
dec eax
mov dword [0xf09beac], eax
mov byte [eax + 0xf09bec0], 0
test ecx, ecx
mov ebx, edx
je 0xf00d6e1
cmp dword [ebp - 0x15c], 0
je 0xf00d6e1
movsx eax, byte [ebx]
push eax
call fcn.0f009fcf
test eax, eax
pop ecx
jne 0xf00d32b
inc ebx
dec dword [ebp - 0x15c]
jne 0xf00d314
cmp dword [ebp - 0x15c], 0
je 0xf00d6e1
cmp byte [ebp + 8], 0
je 0xf00d493
push ebx
push 7
push str.country
call fcn.0f00bbd2
test eax, eax
je 0xf00d36c
mov al, byte [ebx]
test al, al
je 0xf00d307
cmp al, 0xa
je 0xf00d307
cmp al, 0xd
je 0xf00d307
inc ebx
dec dword [ebp - 0x15c]
jne 0xf00d353
jmp 0xf00d307
push ebx
push 5
push str.shell
call fcn.0f00bbd2
mov esi, eax
test esi, esi
je 0xf00d6aa
jmp 0xf00d39a
mov al, byte [esi]
test al, al
je 0xf00d3a8
cmp al, 0xa
je 0xf00d3a8
cmp al, 0xd
je 0xf00d3a8
dec dword [ebp - 0x15c]
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f009fcf
test eax, eax
pop ecx
je 0xf00d385
push 0xc
push esi
push str._SystemRoot_
call fcn.0f008064
add esp, 0xc
test eax, eax
jne 0xf00d3c7
push 0xc
pop eax
mov dword [ebp - 0x168], eax
jmp 0xf00d405
mov edi, 0xf09bec0
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf00d3d1
sub eax, edx
push eax
push esi
push edi
call fcn.0f008064
add esp, 0xc
test eax, eax
jne 0xf00d3f9
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf00d3ee
sub eax, edx
jmp 0xf00d3fb
xor eax, eax
test eax, eax
mov dword [ebp - 0x168], eax
je 0xf00d41b
push 0x15
add eax, esi
push eax
push str.System32command.com
call fcn.0f008064
add esp, 0xc
test eax, eax
je 0xf00d463
mov dword [ebp - 0x17c], esi
cmp dword [ebp - 0x15c], 0
je 0xf00d6e1
mov al, byte [ebx]
test al, al
je 0xf00d307
cmp al, 0xa
je 0xf00d307
cmp al, 0xd
je 0xf00d307
inc ebx
dec dword [ebp - 0x15c]
jne 0xf00d42e
jmp 0xf00d307
test al, al
je 0xf00d421
cmp al, 0xa
je 0xf00d469
cmp al, 0xd
je 0xf00d469
inc esi
mov al, byte [esi]
cmp al, 0x2f
jne 0xf00d456
mov al, byte [esi]
test al, al
je 0xf00d421
cmp al, 0xa
je 0xf00d421
cmp al, 0xd
je 0xf00d421
push 3
push 0xf06500c
push esi
call fcn.0f008064
add esp, 0xc
test eax, eax
jne 0xf00d462
mov dword [ebp - 0x16c], esi
jmp 0xf00d462
push 6
push str.PROMPT
push ebx
call fcn.0f008064
add esp, 0xc
test eax, eax
jne 0xf00d53f
mov edi, dword [ebp - 0x164]
mov eax, str.PROMPT
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0xf00d4ba
add edi, 7
add dword [ebp - 0x158], 7
lea esi, [ebx + 6]
jmp 0xf00d4e2
mov al, byte [esi]
test al, al
je 0xf00d4f0
cmp al, 0xa
je 0xf00d4f0
cmp al, 0xd
je 0xf00d4f0
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f009fcf
test eax, eax
pop ecx
je 0xf00d4d3
cmp byte [esi], 0x3d
jne 0xf00d534
jmp 0xf00d509
mov al, byte [esi]
test al, al
je 0xf00d5da
cmp al, 0xa
je 0xf00d534
cmp al, 0xd
je 0xf00d534
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f009fcf
test eax, eax
pop ecx
je 0xf00d4f7
jmp 0xf00d534
cmp al, 0xa
je 0xf00d5da
cmp al, 0xd
je 0xf00d5da
mov byte [edi], al
inc edi
inc esi
inc dword [ebp - 0x158]
mov al, byte [esi]
test al, al
jne 0xf00d51a
jmp 0xf00d5da
push 4
push str.PATH
push ebx
call fcn.0f008064
add esp, 0xc
test eax, eax
jne 0xf00d5e9
mov edi, dword [ebp - 0x164]
mov eax, str.PATH
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0xf00d566
add edi, 5
add dword [ebp - 0x158], 5
lea esi, [ebx + 4]
jmp 0xf00d58e
mov al, byte [esi]
test al, al
je 0xf00d59c
cmp al, 0xa
je 0xf00d59c
cmp al, 0xd
je 0xf00d59c
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f009fcf
test eax, eax
pop ecx
je 0xf00d57f
cmp byte [esi], 0x3d
jne 0xf00d5d4
jmp 0xf00d5b1
mov al, byte [esi]
test al, al
je 0xf00d5da
cmp al, 0xa
je 0xf00d5d4
cmp al, 0xd
je 0xf00d5d4
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f009fcf
test eax, eax
pop ecx
je 0xf00d5a3
jmp 0xf00d5d4
cmp al, 0xa
je 0xf00d5da
cmp al, 0xd
je 0xf00d5da
mov byte [edi], al
inc edi
inc esi
inc dword [ebp - 0x158]
mov al, byte [esi]
test al, al
jne 0xf00d5c2
mov byte [edi], 0
inc edi
mov dword [ebp - 0x164], edi
jmp 0xf00d6a4
push 3
push 0xf065014
push ebx
call fcn.0f008064
add esp, 0xc
test eax, eax
jne 0xf00d6aa
lea esi, [ebx + 3]
jmp 0xf00d615
mov al, byte [esi]
test al, al
je 0xf00d623
cmp al, 0xa
je 0xf00d623
cmp al, 0xd
je 0xf00d623
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f009fcf
test eax, eax
pop ecx
je 0xf00d606
mov cl, byte [esi]
mov eax, esi
jmp 0xf00d63b
cmp cl, 0xa
je 0xf00d63f
cmp cl, 0xd
je 0xf00d63f
cmp cl, 0x3d
je 0xf00d63f
inc eax
mov cl, byte [eax]
test cl, cl
jne 0xf00d629
mov cl, byte [eax]
test cl, cl
je 0xf00d6aa
cmp cl, 0xa
je 0xf00d6aa
cmp cl, 0xd
je 0xf00d6aa
cmp esi, eax
jae 0xf00d66f
mov ecx, eax
sub ecx, esi
add dword [ebp - 0x158], ecx
mov ecx, dword [ebp - 0x164]
mov dl, byte [esi]
mov byte [ecx], dl
inc ecx
inc esi
cmp esi, eax
jb 0xf00d663
jmp 0xf00d675
mov ecx, dword [ebp - 0x164]
mov byte [ecx], 0
inc ecx
inc dword [ebp - 0x158]
inc esi
jmp 0xf00d694
cmp al, 0xa
je 0xf00d69a
cmp al, 0xd
je 0xf00d69a
mov byte [ecx], al
inc ecx
inc esi
inc dword [ebp - 0x158]
mov al, byte [esi]
test al, al
jne 0xf00d682
mov byte [ecx], 0
inc ecx
mov dword [ebp - 0x164], ecx
inc dword [ebp - 0x158]
push dword [ebp - 0x15c]
push ebx
push dword [ebp - 0x160]
call fcn.0f018e7c
sub dword [ebp - 0x15c], eax
push 2
push 0xf065010
push dword [ebp - 0x160]
mov dword [ebp - 0x168], eax
add ebx, eax
call fcn.0f00a16c
jmp 0xf00d307
cmp byte [ebp + 8], 0
je 0xf00d8cd
push 0x3f
lea eax, [ebp - 0x154]
push eax
push 0xa
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0xf00d71c
push 0xa
lea eax, [ebp - 0x154]
push 0
push eax
call fcn.0f00b792
add esp, 0xc
mov edi, eax
jmp 0xf00d71f
xor edi, edi
inc edi
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0xf065010
mov ecx, str.country
push ecx
mov esi, 0xf09bec0
push esi
push eax
push edi
push ecx
lea eax, [ebp - 0x114]
push 0xf0038d0
push eax
call fcn.0f01336d
lea eax, [ebp - 0x114]
add esp, 0x20
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0xf00d756
sub eax, ecx
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x160]
call fcn.0f00a16c
push esi
push str.System32command.com
push esi
push str.shell
lea eax, [ebp - 0x114]
push 0xf0038b8
push eax
call fcn.0f01336d
lea eax, [ebp - 0x114]
add esp, 0x18
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0xf00d79b
sub eax, ecx
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x160]
call fcn.0f00a16c
mov ebx, dword [ebp - 0x17c]
test ebx, ebx
je 0xf00d829
movsx eax, byte [ebx]
push eax
call fcn.0f009fcf
test eax, eax
pop ecx
je 0xf00d829
mov al, byte [ebx]
mov esi, ebx
jmp 0xf00d7e0
cmp al, 0xa
je 0xf00d7e4
cmp al, 0xd
je 0xf00d7e4
inc esi
mov al, byte [esi]
test al, al
jne 0xf00d7d5
mov edi, dword [ebp - 0x16c]
test esi, esi
je 0xf00d8bb
test ebx, ebx
mov byte [esi], 0
je 0xf00d85d
call fcn.0f00d08e
mov esi, 0xf0038b0
lea edi, [ebp - 0x114]
movsd dword es:[edi], dword [esi]
mov eax, ebx
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf00d80f
lea edi, [ebp - 0x114]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xf00d81f
jmp 0xf00d886
mov edi, dword [ebp - 0x16c]
test edi, edi
je 0xf00d859
movsx eax, byte [edi]
push eax
call fcn.0f009fcf
test eax, eax
pop ecx
je 0xf00d859
movsx eax, byte [edi]
mov esi, edi
jmp 0xf00d84c
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f009fcf
test eax, eax
pop ecx
jne 0xf00d848
jmp 0xf00d7ea
xor esi, esi
jmp 0xf00d7ea
test edi, edi
je 0xf00d896
mov eax, edi
mov word [ebp - 0x114], 0x20
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf00d86e
lea edi, [ebp - 0x114]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xf00d87e
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf00d89f
sub eax, edx
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x160]
call fcn.0f018e7c
push 2
push 0xf065010
push dword [ebp - 0x160]
call fcn.0f00a16c
push dword [ebp - 0x160]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebp - 0x160]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x174]
call esi
push dword [ebp - 0x170]
call fcn.0f00579c
cmp byte [ebp + 8], 0
pop ecx
pop edi
pop esi
pop ebx
jne 0xf00d943
mov ecx, dword [ebp - 0x158]
test ecx, ecx
mov eax, dword [0xf0773d0]
je 0xf00d935
test eax, eax
je 0xf00d935
mov byte [eax + ecx], 0
inc ecx
push ecx
push dword [0xf0773d0]
call fcn.0f010020
test eax, eax
pop ecx
pop ecx
je 0xf00d943
mov dword [0xf0773d0], eax
jmp 0xf00d943
push eax
call fcn.0f00579c
and dword [0xf0773d0], 0
pop ecx
mov ecx, dword [ebp - 4]
call fcn.0f01b45c
leave
ret 4