Function at 0x40f080
Capabilities:
Delete file
Get common file path
Get hostname
Get session user name
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x524
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0x10], ebp
lea esi, [ebp + 0x5ca5c8]
push esi
push 0x104
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x40f0be
mov ecx, ebp
call fcn.0040f940
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x524
ret
push esi
mov edi, 0x41a23c
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [eax + ebp + 0x5ca5c7]
mov ecx, 1
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40f0e1
sbb eax, eax
sbb eax, 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
je 0x40f0f7
mov eax, dword [esp + 0x1c]
push 0x41a23c
push eax
call ebx
lea esi, [ebp + 0x5ca7d0]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test eax, eax
jne 0x40f116
mov ecx, dword [esp + 0x1c]
push ecx
push esi
call ebp
mov esi, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [esp + 0x18]
lea eax, [esp + 0x32c]
push edx
push eax
mov dword [esp + 0x20], 0x104
call esi
lea ecx, [esp + 0x18]
lea edx, [esp + 0x228]
push ecx
push edx
call esi
lea eax, [esp + 0x228]
push 0x41aec8
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x228]
push ecx
call esi
mov edx, 0x104
lea ecx, [esp + 0x18]
sub edx, eax
push ecx
mov dword [esp + 0x1c], edx
lea edx, [esp + eax + 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov eax, dword [esp + 0x10]
cmp dword [eax + 8], 1
jne 0x40f1c4
lea ecx, [esp + 0x124]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x127]
push str.Documents_and_Settings_
push edx
call ebp
lea eax, [esp + 0x32c]
lea ecx, [esp + 0x124]
push eax
push ecx
call ebx
push str.Local_SettingsTemp_
jmp 0x40f206
lea eax, [esp + 0x124]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x124]
mov edi, 0x41a23c
push ecx
call esi
lea esi, [esp + eax + 0x123]
mov ecx, 1
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40f1fd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40f210
push 0x41a23c
lea edx, [esp + 0x128]
push edx
call ebx
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x124]
lea ecx, [esp + 0x20]
push eax
push ecx
call ebx
lea edx, [esp + 0x20]
push str.current.tmp
push edx
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 0
lea eax, [esp + 0x34]
push 0x80000000
push eax
mov dword [esp + 0x30], 0
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x40f49c
lea ecx, [esp + 0x124]
push ecx
call fcn.00401940
add esp, 4
lea edx, [esp + 0x20]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push edx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x40f49c
mov eax, dword [esp + 0x10]
cmp dword [eax + 8], 1
jne 0x40f464
lea ecx, [esp + 0x20]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x23]
push str.Documents_and_Settings_
push edx
call ebp
lea eax, [esp + 0x228]
lea ecx, [esp + 0x20]
push eax
push ecx
call ebx
lea edx, [esp + 0x20]
push str.Local_SettingsTemp_
push edx
call ebx
lea eax, [esp + 0x20]
push str.current.tmp
push eax
call ebx
push 0
push 0x80
push 3
push 0
push 0
lea ecx, [esp + 0x34]
push 0x80000000
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x40f3f5
lea edx, [esp + 0x20]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x23]
push str.Documents_and_Settings_
push eax
call ebp
lea ecx, [esp + 0x32c]
lea edx, [esp + 0x20]
push ecx
push edx
call ebx
lea eax, [esp + 0x20]
push str.Local_SettingsTemp_
push eax
call ebx
lea ecx, [esp + 0x20]
push str.current.tmp
push ecx
call ebx
push 0
push 0x80
push 2
push 0
push 0
lea edx, [esp + 0x34]
push 0x40000000
push edx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x40f450
lea eax, [esp + 0x20]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x23]
push str.Documents_and_Settings_
push ecx
call ebp
lea edx, [esp + 0x228]
lea eax, [esp + 0x20]
push edx
push eax
call ebx
lea ecx, [esp + 0x20]
push str.Local_SettingsTemp_
push ecx
call ebx
lea edx, [esp + 0x20]
push str.current.tmp
push edx
call ebx
push 0
push 0x80
push 2
push 0
push 0
lea eax, [esp + 0x34]
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x40f3f5
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x524
ret
lea edx, [esp + 0x228]
test edx, edx
je 0x40f415
lea eax, [esp + 0x228]
mov ecx, dword [esp + 0x10]
push eax
add ecx, 0x52e9b8
push ecx
call ebp
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push 0
push ecx
push 0x104
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
push esi
test eax, eax
je 0x40f4df
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x524
ret
lea edx, [esp + 0x32c]
test edx, edx
je 0x40f415
lea eax, [esp + 0x32c]
jmp 0x40f407
push 0
push 0x80
push 2
push 0
push 0
lea edx, [esp + 0x34]
push 0x40000000
push edx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x40f415
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x524
ret
lea ecx, [esp + 0x32c]
test ecx, ecx
je 0x40f4bb
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x32c]
add eax, 0x52e9b8
push edx
push eax
call ebp
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x438]
push 0x104
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x40f4fd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x524
ret
mov ebp, dword [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea ecx, [esp + 0x124]
push ebp
push ecx
call ebx
test eax, eax
jne 0x40f52c
mov ecx, dword [esp + 0x10]
call fcn.0040f5d0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x524
ret
lea edx, [esp + 0x430]
push ebp
push edx
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40f5b3
push esi
call ebx
push 0
push 0x80
push 2
push 0
push 0
lea eax, [esp + 0x34]
push 0x40000000
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x40f57c
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x524
ret
lea edx, [esp + 0x14]
push 0
push edx
push 0x104
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x40f5b3
push esi
call ebx
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x524
ret
push esi
call ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x524
ret