Function at 0x104d9b0
Capabilities:
Delete file
Write file on windows

Disassembly:
push rdi
sub rsp, 0x590
mov rax, qword [0x010667f0]
xor rax, rsp
mov qword [rsp + 0x580], rax
movzx eax, word [0x01001c50]
mov word [rsp + 0x170], ax
lea rax, [rsp + 0x172]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x50], ax
lea rax, [rsp + 0x52]
mov rdi, rax
xor eax, eax
mov ecx, 0xfe
rep stosb byte [rdi], al
mov dword [rsp + 0x570], 0
mov qword [rsp + 0x160], 0
mov qword [rsp + 0x150], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x158], 0
mov dword [rsp + 0x15c], 0
lea rcx, [0x0100b470]
call fcn.01053b10
lea r8, [0x01068274]
mov edx, 0x200
lea rcx, [rsp + 0x170]
call fcn.0105ab90
lea r8, [0x0100b448]
mov edx, 0x200
lea rcx, [rsp + 0x170]
call fcn.01015bf0
lea rcx, [0x01066a38]
call qword [0x01069178]
test eax, eax
jne 0x104dace
cmp dword [0x010689c0], 0
je 0x104dac1
cmp dword [0x01068484], 0
je 0x104dac1
lea rdx, [0x0100b408]
lea rcx, [0x01001b80]
call qword [sym.imp.MSVCR80.dll_wprintf]
lea rcx, [0x01066a38]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x010689c0], 0
je 0x104daf4
cmp dword [0x01068484], 0
je 0x104daf4
lea rdx, [0x0100b408]
lea rcx, [0x01001b48]
call qword [sym.imp.MSVCR80.dll_wprintf]
mov eax, dword [0x01066c84]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x104db4b
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x01066a38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x010689c0], 0
je 0x104db46
cmp dword [0x01068484], 0
je 0x104db46
lea rdx, [0x0100b408]
lea rcx, [0x01001b10]
call qword [sym.imp.MSVCR80.dll_wprintf]
jmp 0x104dda3
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100080
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x160], rax
cmp qword [rsp + 0x160], 0xffffffffffffffff
je 0x104dd70
mov dword [rsp + 0x20], pe_nt_image_headers64
lea r9, [rsp + 0x50]
lea r8, [0x01001c50]
lea rdx, [0x01002020]
lea rcx, [0x01001c10]
call fcn.010531b0
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCR80.dll__wtol]
mov dword [rsp + 0x158], eax
mov eax, dword [rsp + 0x158]
cdq
mov ecx, 0x186a0
idiv ecx
imul eax, eax, 0xf4240
mov dword [rsp + 0x574], eax
mov eax, dword [rsp + 0x158]
cdq
mov ecx, 0x186a0
idiv ecx
mov eax, edx
cdq
mov ecx, 0x3e8
idiv ecx
imul eax, eax, 0x2710
mov ecx, dword [rsp + 0x574]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x578], eax
mov eax, dword [rsp + 0x158]
cdq
mov ecx, 0x3e8
idiv ecx
mov eax, edx
mov ecx, dword [rsp + 0x578]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x158], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x570]
mov r8d, 4
lea rdx, [rsp + 0x158]
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x570]
mov r8d, 4
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x15c], 0
jmp 0x104dcb2
mov eax, dword [rsp + 0x15c]
add eax, 1
mov dword [rsp + 0x15c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x15c], eax
jge 0x104dd62
mov edx, dword [rsp + 0x15c]
lea rcx, [0x01066c78]
call qword [sym.imp.SQLSVC.dll_SHRecMemLock]
mov qword [rsp + 0x150], rax
cmp qword [rsp + 0x150], 0
je 0x104dd5d
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x570]
mov r8d, gethostbyname
mov rdx, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rsp + 0x150]
cmp qword [rax + 0x28], 0
je 0x104dd5d
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x570]
mov rax, qword [rsp + 0x150]
mov r8d, dword [rax + 0x20]
mov rax, qword [rsp + 0x150]
mov rdx, qword [rax + 0x28]
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x104dca1
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x01066a38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x010689c0], 0
je 0x104dda3
cmp dword [0x01068484], 0
je 0x104dda3
lea rdx, [0x0100b408]
lea rcx, [0x01001b10]
call qword [sym.imp.MSVCR80.dll_wprintf]
mov rcx, qword [rsp + 0x580]
xor rcx, rsp
call fcn.01059ab0
add rsp, 0x590
pop rdi
ret