Function at 0x51baf0
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 0x50
push ebx
push ebp
push esi
push edi
xor edi, edi
push 0xe
lea eax, [esp + 0x54]
push edi
push eax
xor ebx, ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x2c], 0xffffffff
call fcn.004dc0b0
mov esi, dword [esp + 0x74]
mov eax, 0x36
mov dword [esp + 0x66], eax
mov dword [esp + 0x5e], eax
movzx eax, word [esi]
add esp, 0xc
cmp eax, 8
mov word [esp + 0x50], 0x4d42
je 0x51be65
cmp eax, 0x10
je 0x51bb49
cmp eax, 0x20
jne 0x51c036
push edi
push 0x69d8f9
push 0x2c
call fcn.004e0700
mov ebx, eax
add esp, 0xc
cmp ebx, edi
mov dword [esp + 0x4c], ebx
jne 0x51bb75
push str.BITMAPINFO
call fcn.004e16a0
add esp, 4
jmp 0x51c03e
mov eax, dword [esi + 0x428]
mov ecx, dword [esi + 0x42c]
add eax, 1
lea eax, [eax + eax*2]
cdq
and edx, 3
add eax, edx
mov ebp, eax
sar ebp, 2
add ebp, ebp
add ebp, ebp
imul ecx, ebp
push edi
push 0x69d8f9
push ecx
mov dword [esp + 0x28], ebp
call fcn.004e0700
mov edx, eax
add esp, 0xc
cmp edx, edi
mov dword [esp + 0x10], edx
jne 0x51bbc8
push 0x6aa5c0
call fcn.004e16a0
add esp, 4
jmp 0x51c03e
mov eax, dword [esi + 0x42c]
imul eax, ebp
add dword [esp + 0x52], eax
mov word [ebx + 0xe], 0x18
mov dword [ebx], 0x28
mov ecx, dword [esi + 0x428]
mov dword [ebx + 4], ecx
mov eax, dword [esi + 0x42c]
mov dword [ebx + 8], eax
mov word [ebx + 0xc], 1
mov dword [ebx + 0x10], edi
movzx eax, word [esi]
cmp eax, 0x10
je 0x51bcad
cmp eax, 0x20
jne 0x51bde8
mov edi, dword [esi + 0x42c]
sub edi, 1
cmp edi, 0xffffffff
mov dword [esp + 0x68], edi
jle 0x51bde8
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x428]
mov dword [esp + 0x18], ecx
jmp 0x51bc44
mov edi, dword [esp + 0x68]
mov eax, dword [esi + 0x430]
mov ecx, dword [esp + 0x18]
imul eax, edi
add eax, dword [esi + 0x434]
xor edi, edi
test edx, edx
jle 0x51bc94
lea ecx, [ecx]
movzx edx, byte [eax]
mov byte [ecx], dl
movzx edx, byte [eax + 1]
add eax, 1
add ecx, 1
mov byte [ecx], dl
movzx edx, byte [eax + 1]
add eax, 1
add ecx, 1
mov byte [ecx], dl
mov edx, dword [esi + 0x428]
add edi, 1
add eax, 2
add ecx, 1
cmp edi, edx
jl 0x51bc60
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x68]
add dword [esp + 0x18], ebp
sub eax, 1
cmp eax, 0xffffffff
mov dword [esp + 0x68], eax
jg 0x51bc40
jmp 0x51bde8
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0xc]
mov dword [esp + 0x34], ecx
movzx ecx, byte [esi + 8]
mov dword [esp + 0x40], eax
mov eax, dword [esi + 0x14]
mov dword [esp + 0x44], ecx
movzx ecx, byte [esi + 0xa]
mov dword [esp + 0x28], eax
movzx eax, byte [esi + 9]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [esi + 4]
mov dword [esp + 0x38], eax
mov eax, 8
sub eax, ecx
movzx ecx, byte [esi + 5]
mov dword [esp + 0x48], eax
mov eax, 0x10
sub eax, ecx
movzx ecx, byte [esi + 6]
mov dword [esp + 0x3c], eax
mov eax, 0x18
sub eax, ecx
mov ecx, dword [esi + 0x42c]
sub ecx, 1
cmp ecx, 0xffffffff
mov dword [esp + 0x30], eax
mov dword [esp + 0x68], ecx
jle 0x51bde8
mov eax, dword [esi + 0x428]
mov dword [esp + 0x24], edx
jmp 0x51bd30
mov ebp, dword [esi + 0x430]
imul ebp, ecx
add ebp, dword [esi + 0x434]
test eax, eax
mov edi, edx
mov dword [esp + 0x18], 0
jle 0x51bdc8
lea ecx, [ecx]
movzx edx, word [ebp]
mov ecx, dword [esp + 0x2c]
mov eax, edx
and eax, dword [esp + 0x28]
mov ebx, edx
and ebx, dword [esp + 0x34]
and edx, dword [esp + 0x40]
shr eax, cl
mov ecx, dword [esp + 0x30]
add edi, 1
add edi, 1
shl eax, cl
mov ecx, dword [esp + 0x38]
shr ebx, cl
mov ecx, dword [esp + 0x3c]
add edi, 1
add ebp, 2
shl ebx, cl
mov ecx, dword [esp + 0x44]
shr edx, cl
mov ecx, dword [esp + 0x48]
or eax, ebx
shl edx, cl
or eax, edx
mov edx, eax
shr edx, 0x10
mov byte [edi - 3], dl
mov ecx, eax
shr ecx, 8
mov byte [edi - 2], cl
mov ecx, dword [esp + 0x18]
mov byte [edi - 1], al
mov eax, dword [esi + 0x428]
add ecx, 1
cmp ecx, eax
mov dword [esp + 0x18], ecx
jl 0x51bd50
mov ebx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x24]
add edx, dword [esp + 0x1c]
sub ecx, 1
cmp ecx, 0xffffffff
mov dword [esp + 0x68], ecx
mov dword [esp + 0x24], edx
jg 0x51bd30
mov ebp, dword [esp + 0x1c]
mov edi, dword [esp + 0x64]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
jne 0x51be24
push 0x6aa590
call fcn.004e16a0
add esp, 4
jmp 0x51c03e
push 0
lea edx, [esp + 0x18]
push edx
push 0xe
lea eax, [esp + 0x5c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x28
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 0x42c]
mov ecx, dword [esp + 0x10]
imul eax, ebp
push 0
lea edx, [esp + 0x18]
push edx
push eax
push ecx
jmp 0x51c028
push edi
push 0x69d8f9
push 0x42c
call fcn.004e0700
mov ebx, eax
add esp, 0xc
cmp ebx, edi
jne 0x51be90
push str.BITMAPINFO
call fcn.004e16a0
add esp, 4
jmp 0x51c03e
mov eax, dword [esi + 0x428]
add eax, 3
cdq
and edx, 3
add eax, edx
mov edx, dword [esi + 0x42c]
mov ebp, eax
sar ebp, 2
add ebp, ebp
add ebp, ebp
imul edx, ebp
push edi
push 0x69d8f9
push edx
call fcn.004e0700
add esp, 0xc
cmp eax, edi
mov dword [esp + 0x10], eax
jne 0x51beda
push 0x6aa5c0
call fcn.004e16a0
add esp, 4
jmp 0x51c03e
lea eax, [ebx + 0x28]
mov ecx, eax
sub ecx, ebx
lea edi, [ecx + esi - 6]
mov ecx, 0x100
lea ebx, [ebx]
movzx edx, byte [edi - 2]
mov byte [eax], dl
movzx edx, byte [edi - 1]
mov byte [eax + 1], dl
movzx edx, byte [edi]
mov byte [eax + 2], dl
mov byte [eax + 3], 0
add eax, 4
add edi, 4
sub ecx, 1
jne 0x51bef0
mov eax, dword [esi + 0x42c]
mov ecx, dword [esp + 0x52]
imul eax, ebp
add dword [esp + 0x5a], 0x400
lea edx, [ecx + eax + 0x400]
mov dword [esp + 0x52], edx
mov word [ebx + 0xe], 8
mov dword [ebx], 0x28
mov eax, dword [esi + 0x428]
mov dword [ebx + 4], eax
mov ecx, dword [esi + 0x42c]
mov dword [ebx + 8], ecx
mov word [ebx + 0xc], 1
mov dword [ebx + 0x10], 0
mov edi, dword [esi + 0x42c]
sub edi, 1
cmp edi, 0xffffffff
jle 0x51bfb0
mov edx, dword [esp + 0x10]
mov dword [esp + 0x68], edx
jmp 0x51bf80
mov ecx, dword [esi + 0x430]
mov eax, dword [esi + 0x428]
imul ecx, edi
add ecx, dword [esi + 0x434]
mov edx, dword [esp + 0x68]
push eax
push ecx
push edx
call fcn.004dc130
add dword [esp + 0x74], ebp
sub edi, 1
add esp, 0xc
cmp edi, 0xffffffff
jg 0x51bf80
mov edi, dword [esp + 0x64]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
jne 0x51bfe9
push 0x6aa590
call fcn.004e16a0
add esp, 4
jmp 0x51c03e
push 0
lea eax, [esp + 0x18]
push eax
push 0xe
lea ecx, [esp + 0x5c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [esp + 0x18]
push edx
push 0x428
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 0x42c]
mov edx, dword [esp + 0x10]
imul ecx, ebp
push 0
lea eax, [esp + 0x18]
push eax
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x20], 0
test ebx, ebx
je 0x51c04b
push ebx
call fcn.004e0760
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
pop edi
pop esi
pop ebp
pop ebx
je 0x51c060
push eax
call fcn.004e0760
add esp, 4
mov eax, dword [esp + 0x10]
add esp, 0x50
ret