Function at 0x416c20
Capabilities:
Delete file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b598
mov eax, dword fs:[0]
push eax
sub esp, 0x3a4
mov eax, dword [0x42500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3ac], edx
mov ebx, ecx
mov dword [ebp - 0x3b0], ebx
push 0x104
lea eax, [ebp - 0x114]
mov dword [ebp - 4], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x114]
test ebx, ebx
jne 0x416c95
push 0x42092c
push 0x104
push eax
call fcn.0040afa0
jmp 0x416ca2
push ebx
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
lea eax, [ebp - 0x39c]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x114]
add esp, 0xc
push 0
push 0
push 0xffffffffffffffff
push eax
push 1
push 0
call edi
mov esi, eax
test esi, esi
je 0x416d0f
cmp esi, 0x104
jg 0x416d0f
push 0x208
lea eax, [ebp - 0x39c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x39c]
push esi
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x114]
push eax
push 1
push 0
call edi
lea ecx, [ebp - 0x39c]
call fcn.0040d1b0
test al, al
je 0x416d2e
lea eax, [ebp - 0x39c]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
add esp, 4
lea eax, [ebp - 0x114]
push 0x420944
push eax
call fcn.00401fb0
mov edi, eax
add esp, 8
mov dword [ebp - 0x3a8], edi
test edi, edi
je 0x416f8c
mov ecx, dword [ebp + 0xc]
mov eax, 0x2aaaaaab
mov esi, dword [ebp + 8]
xor ebx, ebx
sub ecx, esi
mov dword [ebp - 0x3a4], ebx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x416f09
xor ecx, ecx
mov dword [ebp - 0x3a0], ecx
cmp dword [ecx + esi + 0x14], 0x10
lea eax, [ecx + esi]
jb 0x416d8d
mov eax, dword [eax]
push eax
push ebx
push 0x4b
push str.OutputZip
push str._s__d____02d___s_n
call fcn.0040cd80
mov eax, dword [ebp + 8]
add esp, 0x14
add eax, ecx
cmp dword [eax + 0x14], 0x10
jb 0x416db0
mov eax, dword [eax]
push 0x4201b4
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x416ece
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
mov edi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
test edi, edi
jle 0x416ece
push edi
call fcn.00418db5
mov ebx, eax
add esp, 4
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x3a0]
cmp dword [eax + 0x14], 0x10
jb 0x416e0b
mov eax, dword [eax]
push 0x4201ec
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x416e5c
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
add esp, 0x10
cmp eax, edi
jl 0x416e52
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push esi
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x1c
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x416ec8
push 0x80
lea eax, [ebp - 0x194]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [ebp - 0x3a0]
add esp, 0xc
add ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x416e87
mov ecx, dword [ecx]
push ecx
lea edx, [ebp - 0x194]
call fcn.00416b30
lea eax, [ebp - 0x194]
push eax
push dword [ebp - 0x3a8]
call fcn.00402610
mov esi, eax
add esp, 0xc
test esi, esi
je 0x416ebf
push edi
push ebx
push esi
call fcn.00401fc0
push esi
call fcn.00401fd0
add esp, 0x10
push ebx
call fcn.00418db0
add esp, 4
mov ebx, dword [ebp - 0x3a4]
mov ecx, dword [ebp + 0xc]
mov eax, 0x2aaaaaab
mov esi, dword [ebp + 8]
inc ebx
add dword [ebp - 0x3a0], 0x18
sub ecx, esi
imul ecx
mov ecx, dword [ebp - 0x3a0]
sar edx, 2
mov eax, edx
mov dword [ebp - 0x3a4], ebx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x416d81
mov edi, dword [ebp - 0x3a8]
push edi
call fcn.00401fe0
mov eax, dword [ebp - 0x3b0]
add esp, 4
test eax, eax
je 0x416f33
lea ecx, [ebp - 0x114]
push ecx
push dword [ebp - 0x3ac]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
xor ebx, ebx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x416f6e
push dword [ebp - 0x3ac]
mov edx, dword [ebp + 0xc]
push ecx
call fcn.0040aee0
mov ecx, dword [ebp + 0x10]
mov eax, 0x2aaaaaab
mov esi, dword [ebp + 8]
add esp, 8
sub ecx, esi
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
push esi
call fcn.0040a170
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00418d36
mov esp, ebp
pop ebp
ret
mov ebx, 1
jmp 0x416f35