Function at 0xf00fe33
Capabilities:
Clear file content
Get common file path
Get file size
Get geographical location
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x17c
mov eax, dword [0xf0ad034]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
xor esi, esi
push eax
mov dword [ebp - 0x16c], esi
mov dword [ebp - 0x17c], esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x40
mov dword [ebp - 0x168], eax
push 0xf233740
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
cmp eax, 0x40
mov dword [0xf233730], eax
jb 0xf00fe9a
mov dword [0xf233730], esi
mov byte [0xf233740], 0
mov bl, byte [ebp + 8]
push esi
lea eax, [ebp - 0x114]
push eax
movzx eax, bl
push eax
call fcn.0f01d9cc
test bl, bl
mov dword [ebp - 0x178], 0xf233780
jne 0xf00fec6
mov dword [ebp - 0x178], 0xf233784
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x174], eax
je 0xf00ff1c
mov eax, dword [0xf233730]
cmp eax, esi
je 0xf00ff1c
cmp eax, 0x40
jae 0xf00ff1c
push esi
push dword [ebp - 0x174]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x15c], edi
je 0xf00ff22
cmp edi, 0xffffffff
jne 0xf00ff39
jmp 0xf00ff22
mov edi, dword [ebp - 0x15c]
push esi
lea eax, [ebp - 0x114]
push eax
push 0x150
call fcn.0f03da35
call fcn.0f03e381
lea eax, [edi + 1]
push eax
call fcn.0f009d40
test bl, bl
pop ecx
mov dword [ebp - 0x170], eax
jne 0xf00ff67
push edi
call fcn.0f009d40
pop ecx
mov dword [0xf205fd4], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x158], esi
jmp 0xf00ff6c
mov eax, dword [0xf205fd4]
cmp dword [ebp - 0x170], esi
je 0xf00ff7c
test bl, bl
jne 0xf00ff93
cmp eax, esi
jne 0xf00ff93
push esi
lea eax, [ebp - 0x114]
push eax
push 0x151
call fcn.0f03da35
call fcn.0f03e381
push dword [ebp - 0x178]
lea eax, [ebp - 0x160]
push eax
call fcn.0f012648
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ebx, 0x104
mov edi, 0x152
je 0xf00ffec
push 0
lea eax, [ebp - 0x168]
push eax
push dword [ebp - 0x15c]
push dword [ebp - 0x170]
push dword [ebp - 0x174]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xf00ffec
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x168], eax
je 0xf010011
lea eax, [ebp - 0x114]
push eax
push ebx
call esi
push 0
lea eax, [ebp - 0x114]
push eax
push edi
mov byte [ebp - 0xd5], 0
call fcn.0f03da35
call fcn.0f03e381
mov eax, dword [ebp - 0x178]
mov eax, dword [eax]
push 0x111
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
mov dword [ebp - 0x168], eax
je 0xf010035
cmp eax, 0x3f
jbe 0xf01005a
lea eax, [ebp - 0x114]
push eax
push ebx
call esi
push 0
lea eax, [ebp - 0x114]
push eax
push edi
mov byte [ebp - 0xd5], 0
call fcn.0f03da35
call fcn.0f03e381
mov edx, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x15c]
mov byte [edx + ecx], 0
mov eax, dword [0xf233730]
cmp byte [eax + 0xf23373f], 0x5c
jne 0xf010085
dec eax
mov dword [0xf233730], eax
mov byte [eax + 0xf233740], 0
test ecx, ecx
mov ebx, edx
je 0xf0104b4
cmp dword [ebp - 0x15c], 0
je 0xf0104b4
movsx eax, byte [ebx]
push eax
call fcn.0f00cb50
test eax, eax
pop ecx
jne 0xf0100b3
inc ebx
dec dword [ebp - 0x15c]
jne 0xf01009c
cmp dword [ebp - 0x15c], 0
je 0xf0104b4
push 3
push 0xf0b5050
push ebx
call fcn.0f09a5b0
add esp, 0xc
test eax, eax
jne 0xf0100fc
movsx eax, byte [ebx + 3]
push eax
call fcn.0f00cb50
test eax, eax
pop ecx
jne 0xf0100fc
mov al, byte [ebx]
test al, al
je 0xf01008f
cmp al, 0xa
je 0xf01008f
cmp al, 0xd
je 0xf01008f
inc ebx
dec dword [ebp - 0x15c]
jne 0xf0100e3
jmp 0xf01008f
cmp byte [ebp + 8], 0
je 0xf010266
push ebx
push 7
push str.country
call fcn.0f00e824
test eax, eax
je 0xf01013f
mov al, byte [ebx]
test al, al
je 0xf01008f
cmp al, 0xa
je 0xf01008f
cmp al, 0xd
je 0xf01008f
inc ebx
dec dword [ebp - 0x15c]
jne 0xf010117
jmp 0xf01008f
push ebx
push 5
push str.shell
call fcn.0f00e824
mov esi, eax
test esi, esi
je 0xf01047d
jmp 0xf01016d
mov al, byte [esi]
test al, al
je 0xf01017b
cmp al, 0xa
je 0xf01017b
cmp al, 0xd
je 0xf01017b
dec dword [ebp - 0x15c]
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00cb50
test eax, eax
pop ecx
je 0xf010158
push 0xc
push esi
push str._SystemRoot_
call fcn.0f09a5b0
add esp, 0xc
test eax, eax
jne 0xf01019a
push 0xc
pop eax
mov dword [ebp - 0x168], eax
jmp 0xf0101d8
mov edi, 0xf233740
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf0101a4
sub eax, edx
push eax
push esi
push edi
call fcn.0f09a5b0
add esp, 0xc
test eax, eax
jne 0xf0101cc
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf0101c1
sub eax, edx
jmp 0xf0101ce
xor eax, eax
test eax, eax
mov dword [ebp - 0x168], eax
je 0xf0101ee
push 0x15
add eax, esi
push eax
push str.System32command.com
call fcn.0f09a5b0
add esp, 0xc
test eax, eax
je 0xf010236
mov dword [ebp - 0x17c], esi
cmp dword [ebp - 0x15c], 0
je 0xf0104b4
mov al, byte [ebx]
test al, al
je 0xf01008f
cmp al, 0xa
je 0xf01008f
cmp al, 0xd
je 0xf01008f
inc ebx
dec dword [ebp - 0x15c]
jne 0xf010201
jmp 0xf01008f
test al, al
je 0xf0101f4
cmp al, 0xa
je 0xf01023c
cmp al, 0xd
je 0xf01023c
inc esi
mov al, byte [esi]
cmp al, 0x2f
jne 0xf010229
mov al, byte [esi]
test al, al
je 0xf0101f4
cmp al, 0xa
je 0xf0101f4
cmp al, 0xd
je 0xf0101f4
push 3
push 0xf0b5054
push esi
call fcn.0f09a5b0
add esp, 0xc
test eax, eax
jne 0xf010235
mov dword [ebp - 0x16c], esi
jmp 0xf010235
push 6
push str.PROMPT
push ebx
call fcn.0f09a5b0
add esp, 0xc
test eax, eax
jne 0xf010312
mov edi, dword [ebp - 0x164]
mov eax, str.PROMPT
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0xf01028d
add edi, 7
add dword [ebp - 0x158], 7
lea esi, [ebx + 6]
jmp 0xf0102b5
mov al, byte [esi]
test al, al
je 0xf0102c3
cmp al, 0xa
je 0xf0102c3
cmp al, 0xd
je 0xf0102c3
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00cb50
test eax, eax
pop ecx
je 0xf0102a6
cmp byte [esi], 0x3d
jne 0xf010307
jmp 0xf0102dc
mov al, byte [esi]
test al, al
je 0xf0103ad
cmp al, 0xa
je 0xf010307
cmp al, 0xd
je 0xf010307
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00cb50
test eax, eax
pop ecx
je 0xf0102ca
jmp 0xf010307
cmp al, 0xa
je 0xf0103ad
cmp al, 0xd
je 0xf0103ad
mov byte [edi], al
inc edi
inc esi
inc dword [ebp - 0x158]
mov al, byte [esi]
test al, al
jne 0xf0102ed
jmp 0xf0103ad
push 4
push str.PATH
push ebx
call fcn.0f09a5b0
add esp, 0xc
test eax, eax
jne 0xf0103bc
mov edi, dword [ebp - 0x164]
mov eax, str.PATH
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0xf010339
add edi, 5
add dword [ebp - 0x158], 5
lea esi, [ebx + 4]
jmp 0xf010361
mov al, byte [esi]
test al, al
je 0xf01036f
cmp al, 0xa
je 0xf01036f
cmp al, 0xd
je 0xf01036f
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00cb50
test eax, eax
pop ecx
je 0xf010352
cmp byte [esi], 0x3d
jne 0xf0103a7
jmp 0xf010384
mov al, byte [esi]
test al, al
je 0xf0103ad
cmp al, 0xa
je 0xf0103a7
cmp al, 0xd
je 0xf0103a7
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00cb50
test eax, eax
pop ecx
je 0xf010376
jmp 0xf0103a7
cmp al, 0xa
je 0xf0103ad
cmp al, 0xd
je 0xf0103ad
mov byte [edi], al
inc edi
inc esi
inc dword [ebp - 0x158]
mov al, byte [esi]
test al, al
jne 0xf010395
mov byte [edi], 0
inc edi
mov dword [ebp - 0x164], edi
jmp 0xf010477
push 3
push 0xf0b505c
push ebx
call fcn.0f09a5b0
add esp, 0xc
test eax, eax
jne 0xf01047d
lea esi, [ebx + 3]
jmp 0xf0103e8
mov al, byte [esi]
test al, al
je 0xf0103f6
cmp al, 0xa
je 0xf0103f6
cmp al, 0xd
je 0xf0103f6
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00cb50
test eax, eax
pop ecx
je 0xf0103d9
mov cl, byte [esi]
mov eax, esi
jmp 0xf01040e
cmp cl, 0xa
je 0xf010412
cmp cl, 0xd
je 0xf010412
cmp cl, 0x3d
je 0xf010412
inc eax
mov cl, byte [eax]
test cl, cl
jne 0xf0103fc
mov cl, byte [eax]
test cl, cl
je 0xf01047d
cmp cl, 0xa
je 0xf01047d
cmp cl, 0xd
je 0xf01047d
cmp esi, eax
jae 0xf010442
mov ecx, eax
sub ecx, esi
add dword [ebp - 0x158], ecx
mov ecx, dword [ebp - 0x164]
mov dl, byte [esi]
mov byte [ecx], dl
inc ecx
inc esi
cmp esi, eax
jb 0xf010436
jmp 0xf010448
mov ecx, dword [ebp - 0x164]
mov byte [ecx], 0
inc ecx
inc dword [ebp - 0x158]
inc esi
jmp 0xf010467
cmp al, 0xa
je 0xf01046d
cmp al, 0xd
je 0xf01046d
mov byte [ecx], al
inc ecx
inc esi
inc dword [ebp - 0x158]
mov al, byte [esi]
test al, al
jne 0xf010455
mov byte [ecx], 0
inc ecx
mov dword [ebp - 0x164], ecx
inc dword [ebp - 0x158]
push dword [ebp - 0x15c]
push ebx
push dword [ebp - 0x160]
call fcn.0f01bb65
sub dword [ebp - 0x15c], eax
push 2
push 0xf0b5058
push dword [ebp - 0x160]
mov dword [ebp - 0x168], eax
add ebx, eax
call fcn.0f00ccfb
jmp 0xf01008f
cmp byte [ebp + 8], 0
je 0xf010677
push 0x3f
lea eax, [ebp - 0x154]
push eax
push 0xa
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0xf0104ef
push 0xa
lea eax, [ebp - 0x154]
push 0
push eax
call fcn.0f00e210
add esp, 0xc
mov edi, eax
jmp 0xf0104f2
xor edi, edi
inc edi
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0xf0b5058
mov ecx, str.country
push ecx
mov esi, 0xf233740
push esi
push eax
push edi
push ecx
lea eax, [ebp - 0x114]
push 0xf006ee0
push eax
call fcn.0f015bd0
lea eax, [ebp - 0x114]
add esp, 0x20
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0xf010529
sub eax, ecx
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x160]
call fcn.0f00ccfb
push esi
push str.System32command.com
push esi
push str.shell
lea eax, [ebp - 0x114]
push 0xf006ec8
push eax
call fcn.0f015bd0
lea eax, [ebp - 0x114]
add esp, 0x18
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0xf01056e
sub eax, ecx
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x160]
call fcn.0f00ccfb
mov ebx, dword [ebp - 0x17c]
test ebx, ebx
je 0xf0105e6
movsx eax, byte [ebx]
push eax
call fcn.0f00cb50
test eax, eax
pop ecx
je 0xf0105e6
mov al, byte [ebx]
mov esi, ebx
jmp 0xf0105b3
cmp al, 0xa
je 0xf0105b7
cmp al, 0xd
je 0xf0105b7
inc esi
mov al, byte [esi]
test al, al
jne 0xf0105a8
mov edi, dword [ebp - 0x16c]
test esi, esi
je 0xf010665
test ebx, ebx
mov byte [esi], 0
je 0xf01061a
call fcn.0f00fe15
mov esi, 0xf006ec0
lea edi, [ebp - 0x114]
movsd dword es:[edi], dword [esi]
push 0x10d
movsb byte es:[edi], byte [esi]
push ebx
jmp 0xf01062d
mov edi, dword [ebp - 0x16c]
test edi, edi
je 0xf010616
movsx eax, byte [edi]
push eax
call fcn.0f00cb50
test eax, eax
pop ecx
je 0xf010616
movsx eax, byte [edi]
mov esi, edi
jmp 0xf010609
inc esi
movsx eax, byte [esi]
push eax
call fcn.0f00cb50
test eax, eax
pop ecx
jne 0xf010605
jmp 0xf0105bd
xor esi, esi
jmp 0xf0105bd
test edi, edi
je 0xf01063c
push 0x10f
mov word [ebp - 0x114], 0x20
push edi
lea eax, [ebp - 0x114]
push eax
call fcn.0f09ba30
add esp, 0xc
lea eax, [ebp - 0x114]
mov byte [ebp - 5], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf010649
sub eax, edx
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x160]
call fcn.0f01bb65
push 2
push 0xf0b5058
push dword [ebp - 0x160]
call fcn.0f00ccfb
push dword [ebp - 0x160]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebp - 0x160]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x174]
call esi
push dword [ebp - 0x170]
call fcn.0f008a60
cmp byte [ebp + 8], 0
pop ecx
pop edi
pop esi
pop ebx
jne 0xf0106ed
mov ecx, dword [ebp - 0x158]
test ecx, ecx
mov eax, dword [0xf205fd4]
je 0xf0106df
test eax, eax
je 0xf0106df
mov byte [eax + ecx], 0
inc ecx
push ecx
push dword [0xf205fd4]
call fcn.0f0128e0
test eax, eax
pop ecx
pop ecx
je 0xf0106ed
mov dword [0xf205fd4], eax
jmp 0xf0106ed
push eax
call fcn.0f008a60
and dword [0xf205fd4], 0
pop ecx
mov ecx, dword [ebp - 4]
call fcn.0f01dda0
leave
ret 4