Function at 0x2513b540
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x2513b98e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x25146bec], 0xffffffff
jne 0x2513b847
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x2a
call fcn.25123e60
lea eax, [ebp - 0x58]
push eax
push 1
push 0x101
push 2
push esi
push ebx
call dword [ebp + 8]
test ax, ax
je 0x2513b5b7
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 8], eax
mov edx, 0x2513b9a0
mov ecx, dword [ebp - 8]
mov ax, 1
call fcn.251286f8
jmp 0x2513b970
movzx eax, word [ebp - 0x32]
mov word [0x25146bf0], ax
movzx eax, word [0x25146bf0]
sub ax, 1
jb 0x2513b5d7
je 0x2513b5de
dec ax
je 0x2513b5e5
jmp 0x2513b5ec
mov edi, 0x30
jmp 0x2513b5f1
mov edi, 0x428
jmp 0x2513b5f1
mov edi, 0x28
jmp 0x2513b5f1
mov edi, 0x428
mov eax, edi
call fcn.25123a48
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, edi
call fcn.25123e60
mov dword [ebx], 0x28
mov eax, dword [ebp - 0x50]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebx + 8], eax
mov word [ebx + 0xc], 1
movzx eax, word [ebp - 0x36]
mov word [ebx + 0xe], ax
xor eax, eax
mov dword [ebx + 0x10], eax
movsx eax, word [ebp - 0x36]
imul dword [ebp - 0x50]
add eax, 0x1f
test eax, eax
jns 0x2513b63b
add eax, 0x1f
sar eax, 5
add eax, eax
add eax, eax
imul dword [ebp - 0x4c]
add eax, edi
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x18], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
movzx eax, word [0x25146bf0]
sub ax, 1
jb 0x2513b66a
je 0x2513b69a
dec ax
je 0x2513b6c1
jmp 0x2513b6c8
mov dword [ebx + 0x20], 2
xor eax, eax
mov dword [ebx + 0x24], eax
xor esi, esi
mov eax, esi
mov edx, eax
shl eax, 8
sub eax, edx
mov byte [ebx + esi*4 + 0x2a], al
mov byte [ebx + esi*4 + 0x29], al
mov byte [ebx + esi*4 + 0x28], al
mov byte [ebx + esi*4 + 0x2b], 0
inc esi
cmp esi, 2
jne 0x2513b678
jmp 0x2513b6ed
mov dword [ebx + 0x20], pe_nt_image_headers32
xor esi, esi
mov eax, esi
mov byte [ebx + esi*4 + 0x2a], al
mov byte [ebx + esi*4 + 0x29], al
mov byte [ebx + esi*4 + 0x28], al
mov byte [ebx + esi*4 + 0x2b], 0
inc esi
cmp esi, 0x100
jne 0x2513b6a3
jmp 0x2513b6ed
xor eax, eax
mov dword [ebx + 0x20], eax
jmp 0x2513b6ed
mov dword [ebx + 0x20], pe_nt_image_headers32
xor esi, esi
mov eax, esi
mov byte [ebx + esi*4 + 0x2a], al
mov byte [ebx + esi*4 + 0x29], al
mov byte [ebx + esi*4 + 0x28], al
mov byte [ebx + esi*4 + 0x2b], 0
inc esi
cmp esi, 0x100
jne 0x2513b6d1
mov eax, 0x2514a0ec
xor ecx, ecx
mov edx, 0x20a
call fcn.25123e60
push 0x2514a0ec
push 0x104
call sub.kernel32.dll_GetTempPathW
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x68], eax
xor eax, eax
mov dword [ebp - 0x64], eax
fild qword [ebp - 0x68]
add esp, 0xfffffffc
fstp dword [esp]
wait
lea eax, [ebp - 0x60]
call fcn.25128810
lea eax, [ebp - 0x60]
mov edx, 0x2513b9e8
call fcn.25126350
mov edx, dword [ebp - 0x60]
lea eax, [ebp - 0x5c]
call fcn.25126254
mov eax, dword [ebp - 0x5c]
call fcn.25126028
push eax
push 0x2514a0ec
call sub.kernel32.dll_lstrcatW
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x2514a0ec
call sub.kernel32.dll_CreateFileW
mov dword [0x25146bec], eax
cmp dword [0x25146bec], 0xffffffff
jne 0x2513b79f
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 8], eax
mov edx, 0x2513b9f4
mov ecx, dword [ebp - 8]
mov ax, 1
call fcn.251286f8
jmp 0x2513b970
lea eax, [ebp - 0x2e]
xor ecx, ecx
mov edx, 0xe
call fcn.25123e60
mov word [ebp - 0x2e], 0x4d42
mov dword [ebp - 0x2c], 0xe
mov word [ebp - 0x28], 0
mov word [ebp - 0x26], 0
lea eax, [edi + 0xe]
mov dword [ebp - 0x24], eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe
lea eax, [ebp - 0x2e]
push eax
mov eax, dword [0x25146bec]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x2513b80c
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 8], eax
mov edx, 0x2513ba34
mov ecx, dword [ebp - 8]
mov ax, 1
call fcn.251286f8
jmp 0x2513b970
push 0
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
mov eax, dword [0x25146bec]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x2513b847
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 8], eax
mov edx, 0x2513ba94
mov ecx, dword [ebp - 8]
mov ax, 1
call fcn.251286f8
jmp 0x2513b970
cmp dword [ebp - 4], 0
je 0x2513b93d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x16]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x22]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
call fcn.25123a48
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x2513b936
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x10], 0
jbe 0x2513b920
mov eax, dword [ebp - 4]
mov edi, dword [eax + 2]
cmp edi, dword [ebp - 0x10]
jbe 0x2513b894
mov edi, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, edi
call fcn.25123b80
cmp word [0x25146bf0], 2
jne 0x2513b8d0
mov ebx, dword [ebp - 0x18]
test edi, edi
jle 0x2513b8d0
mov dword [ebp - 0x20], edi
movzx eax, byte [ebx + 2]
mov byte [ebp - 0x19], al
movzx eax, byte [ebx]
mov byte [ebx + 2], al
movzx eax, byte [ebp - 0x19]
mov byte [ebx], al
add ebx, 3
dec dword [ebp - 0x20]
jne 0x2513b8b5
push 0
lea eax, [ebp - 0xc]
push eax
push edi
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [0x25146bec]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x2513b910
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 8], eax
mov edx, 0x2513bae8
mov ecx, dword [ebp - 8]
mov ax, 1
call fcn.251286f8
call fcn.25124fe0
jmp 0x2513b970
sub dword [ebp - 0x10], edi
add dword [ebp - 0x14], edi
cmp dword [ebp - 0x10], 0
ja 0x2513b886
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2513b93d
mov eax, dword [ebp - 0x18]
call fcn.25123a64
ret
cmp dword [ebp + 0xc], 6
jne 0x2513b970
mov eax, dword [0x25146bec]
push eax
call sub.kernel32.dll_CloseHandle_1
mov dword [0x25146bec], 0xffffffff
mov eax, 0x2514a0ec
call fcn.2513b0f4
test al, al
jne 0x2513b970
push 0x2514a0ec
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2513b995
lea eax, [ebp - 0x60]
call fcn.251256fc
lea eax, [ebp - 0x5c]
call fcn.25125744
ret