Function at 0x47a887
Capabilities:
Delete file
Get file size
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
and dword [esp + 0x14], 0
push ebx
push esi
push edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
mov ebx, edi
call fcn.0047a6b7
test eax, eax
jne 0x47a902
lea eax, [edi + 0x80]
cmp dword [eax], 0
jbe 0x47a8c4
push 4
push eax
push 2
push dword [esp + 0x2c]
call dword [sym.imp.WININET.dll_InternetSetOptionW]
lea eax, [esp + 0x2c]
push eax
lea esi, [edi + 0x30]
push esi
push edi
call fcn.0047bb42
mov ebx, dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x47a909
push eax
lea eax, [edi + 4]
call fcn.004887e8
mov esi, dword [esp + 0x1c]
push 0
push dword [esp + 0x24]
call ebx
push dword [esp + 0x20]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0x28]
push ecx
lea ecx, [esp + 0x14]
push esi
lea eax, [edi + 0x2c]
push ecx
call fcn.0047db5c
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp dword [eax - 0xc], 0
jne 0x47a949
mov eax, 0xe0000005
mov dword [edi + 0x20], eax
push eax
lea eax, [edi + 4]
call fcn.004887e8
mov edi, dword [edi + 0x20]
lea ecx, [esp + 0x10]
call fcn.00402907
mov esi, edi
jmp 0x47a8ee
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00425ecf
push 0x4fb2bc
lea eax, [esp + 0x18]
push eax
call fcn.00443470
lea esi, [edi + 4]
push 1
mov eax, esi
mov dword [esp + 0x1c], esi
call fcn.004887d0
and dword [esp + 0x24], 0
cmp byte [edi + 0x4c], 0
je 0x47a98f
lea eax, [esp + 0x14]
call fcn.0046e0f8
mov dword [esp + 0x24], eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x28]
call fcn.0047adcd
mov dword [esp + 0x1c], eax
mov eax, esi
call fcn.004887fc
test al, al
je 0x47a9cd
lea ecx, [esp + 0x14]
call fcn.00402907
lea ecx, [esp + 0x10]
call fcn.00402907
mov esi, 0xe0000008
jmp 0x47a8ee
cmp dword [esp + 0x1c], 0
je 0x47aa00
cmp dword [esp + 0x1c], 0xe0000013
je 0x47a9e9
push dword [esp + 0x1c]
mov eax, esi
call fcn.004887e8
lea ecx, [esp + 0x14]
call fcn.00402907
lea ecx, [esp + 0x10]
call fcn.00402907
jmp 0x47a8ea
mov eax, dword [edi + 0x18]
mov ecx, dword [esi]
mov dword [esp + 0x38], eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], edi
test ecx, ecx
je 0x47aa25
push dword [esp + 0x10]
mov eax, dword [ecx]
push dword [esp + 0x2c]
call dword [eax + 8]
mov eax, esi
call fcn.004887fc
test al, al
je 0x47aa69
xor esi, esi
mov dword [edi + 0x84], esi
lea edi, [esp + 0x48]
call fcn.0047bf4a
push esi
push dword [esp + 0x3c]
call ebx
push dword [esp + 0x38]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
lea ecx, [esp + 0x14]
call fcn.00402907
lea ecx, [esp + 0x10]
call fcn.00402907
jmp 0x47a8ee
mov eax, dword [esp + 0x28]
test eax, eax
jbe 0x47aa9a
cmp eax, dword [esp + 0x24]
jne 0x47aa9a
mov esi, dword [esi]
test esi, esi
je 0x47aa86
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0xc]
and dword [edi + 0x84], 0
lea edi, [esp + 0x48]
call fcn.0047bf4a
xor esi, esi
jmp 0x47aa41
push 0
push 0
lea ecx, [esp + 0x1c]
call fcn.0045dce0
pop ecx
pop ecx
xor ecx, ecx
mov dword [esp + 0x1c], eax
cmp eax, ecx
je 0x47aadb
push eax
mov eax, esi
call fcn.004887e8
lea edi, [esp + 0x48]
call fcn.0047bf4a
push 0
push dword [esp + 0x3c]
call ebx
push dword [esp + 0x38]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x47a9e9
xor eax, eax
cmp eax, dword [esp + 0x24]
push ecx
sbb eax, eax
neg eax
push 0x80
inc eax
inc eax
push eax
push ecx
push ecx
push 0xc0000000
lea esi, [esp + 0x2c]
call fcn.00411f01
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x40], eax
cmp eax, 0xffffffff
jne 0x47ab6d
mov eax, dword [esp + 0x18]
call fcn.004887fc
test al, al
je 0x47ab43
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [esp + 0x48]
call fcn.0047bf4a
push 0
push dword [esp + 0x3c]
call ebx
push dword [esp + 0x38]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x47a9b1
push edi
call fcn.0047bf37
mov esi, eax
mov eax, dword [esp + 0x18]
push esi
call fcn.004887e8
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [esp + 0x48]
call fcn.0047bf4a
push 0
jmp 0x47aa42
xor esi, esi
cmp dword [esp + 0x24], esi
jbe 0x47ab90
push 2
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
cmp ecx, esi
je 0x47aba0
push dword [esp + 0x24]
jmp 0x47ab9b
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
cmp ecx, esi
je 0x47aba0
push esi
mov eax, dword [ecx]
call dword [eax + 0x14]
push 0xc800
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], esi
call fcn.00441691
lea eax, [esp + 0x24]
push eax
push dword [edi + 0x14]
mov eax, edi
call fcn.0047af6f
and dword [esp + 0x30], 0
mov esi, eax
test esi, esi
jne 0x47ac04
cmp dword [esp + 0x24], eax
jbe 0x47ac8c
mov eax, 0xc800
cmp dword [esp + 0x24], eax
jae 0x47abe6
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x30]
push ecx
push eax
push dword [esp + 0x24]
mov eax, edi
push dword [edi + 0x14]
call fcn.0047aed0
mov esi, eax
test esi, esi
je 0x47ac85
cmp esi, 0x2ee2
je 0x47ac24
cmp esi, 0x2efe
je 0x47ac24
cmp esi, 0x2eff
je 0x47ac24
cmp esi, 0x2f83
jne 0x47ac55
cmp dword [esp + 0x2c], 3
je 0x47ac32
cmp dword [esp + 0x2c], 4
jne 0x47ac55
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x48]
mov eax, edi
push dword [esp + 0x2c]
call fcn.0047ae54
mov esi, eax
test esi, esi
je 0x47abb3
cmp esi, 0xe0000008
je 0x47ac67
mov eax, dword [esp + 0x18]
push esi
call fcn.004887e8
push dword [esp + 0x1c]
call fcn.004af6b2
cmp dword [esp + 0x44], 0
pop ecx
je 0x47ab5d
push dword [esp + 0x40]
jmp 0x47ab57
cmp dword [esp + 0x30], 0
jne 0x47acca
cmp dword [esp + 0x28], 0
jbe 0x47ad41
push 0
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, dword [esp + 0x28]
jae 0x47ad41
cmp dword [esp + 0x2c], 3
je 0x47ac32
cmp dword [esp + 0x2c], 4
je 0x47ac32
mov esi, 0xe000000f
jmp 0x47ac5d
push 0
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x38]
push dword [esp + 0x28]
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x47adb2
mov esi, dword [esp + 0x18]
mov ecx, dword [esi]
test ecx, ecx
je 0x47acfe
push dword [esp + 0x34]
mov eax, dword [ecx]
call dword [eax + 0x14]
lea eax, [edi + 0x44]
push eax
call fcn.00488813
mov eax, esi
call fcn.004887fc
test al, al
je 0x47abb3
push dword [esp + 0x1c]
xor esi, esi
mov dword [edi + 0x84], esi
call fcn.004af6b2
pop ecx
cmp dword [esp + 0x40], esi
je 0x47aa38
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x47aa38
cmp dword [esp + 0x40], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x47ad59
push dword [esp + 0x40]
call esi
and dword [esp + 0x40], 0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp + 0x10]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
test ecx, ecx
je 0x47ad82
mov eax, dword [ecx]
push 1
call dword [eax + 0xc]
push dword [edi + 0x68]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [esp + 0x1c]
and dword [edi + 0x84], 0
call fcn.004af6b2
cmp dword [esp + 0x44], 0
pop ecx
je 0x47aa8d
push dword [esp + 0x40]
call esi
jmp 0x47aa8d
push edi
call fcn.0047bf37
mov dword [edi + 0x20], eax
push eax
mov eax, dword [esp + 0x1c]
call fcn.004887e8
mov esi, dword [edi + 0x20]
jmp 0x47ac67