Function at 0x4024bf
Capabilities:
Check if file exists
Check os version
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
and dword [ebp - 4], 0
and dword [ebp - 0x118], 0
and dword [ebp - 8], 0
and dword [ebp - 0x11c], 0
or dword [ebp - 0x114], 0xffffffff
cmp dword [0x415b5c], 5
je 0x40250c
cmp dword [0x415b5c], 6
je 0x40250c
mov dword [0x415b58], 0x9c
push 0x415b58
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [0x415b5c], 5
jne 0x40251e
mov dword [ebp - 4], str.C:Documents_and_Settings_
jmp 0x402525
mov dword [ebp - 4], str.C:Users_
push 0x104
push 0
lea eax, [ebp - 0x110]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.Infotmp.txt
push dword [ebp - 4]
push str._s_s
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
cmp dword [ebp + 8], 0
je 0x40256a
mov dword [ebp - 0x118], 2
jmp 0x402574
mov dword [ebp - 0x118], 3
push 0
push 0x80
push dword [ebp - 0x118]
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xffffffff
jne 0x4025fe
cmp dword [ebp + 0xc], 4
jne 0x4025ea
push 0x2d4
push 0
push 0x415b58
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x415bf8], 3
push 1
push 0
push 0
call fcn.00402aee
mov dword [0x415b58], 0x9c
push 0x415b58
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0x11c], 2
jmp 0x40284d
cmp dword [ebp + 8], 0
je 0x40278a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0xf
jne 0x40262a
mov eax, dword [ebp + 8]
movzx eax, word [eax]
cmp eax, 0x3a43
jne 0x40262a
mov dword [ebp + 0xc], 3
push 0x2d4
push 0
push 0x415b58
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [0x415bf8], eax
push dword [ebp + 8]
push 0x415bfc
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
push 0
push 0
call fcn.00402aee
mov eax, dword [0x415bf4]
and eax, 0x11
cmp eax, 1
jne 0x4026fe
and dword [ebp - 0x120], 0
push dword [0x415e28]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x4026fe
push 0x104
lea eax, [ebp - 0x228]
push eax
push 0
push dword [ebp - 0x120]
call sub.PSAPI.DLL_GetModuleFileNameExA
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.RsAgent.exe
push 0x5c
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
pop ecx
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x415d20
push 0
push 0
lea eax, [ebp - 0x228]
push eax
call fcn.004033ee
mov eax, dword [0x415bf4]
or eax, 0x10
mov dword [0x415bf4], eax
call fcn.0040246e
and eax, 0xffff0000
mov ecx, dword [0x415d20]
and ecx, 0xffff
or eax, ecx
push eax
push str._.8X.tmp
push 0x415d00
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [0x415b58], 0x9c
push 0x415b58
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
call fcn.0040246e
push eax
push 0x415940
push str._s_.8X.log
push 0x415d24
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
lea eax, [ebp - 8]
push eax
push 0x2d4
push 0x415b58
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40284d
and dword [ebp - 0x22c], 0
cmp dword [ebp + 0xc], 5
jne 0x4027a5
lea eax, [ebp - 0x508]
mov dword [ebp - 0x22c], eax
jmp 0x4027af
mov dword [ebp - 0x22c], 0x415b58
push 0
lea eax, [ebp - 8]
push eax
push 0x2d4
push dword [ebp - 0x22c]
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0xc], 6
je 0x40283a
mov eax, dword [ebp - 0x22c]
add eax, 0xa4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
jne 0x40283a
and dword [ebp - 0x50c], 0
jmp 0x40280b
mov eax, dword [ebp - 0x50c]
inc eax
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x50c], 0xc8
jge 0x40283a
mov eax, dword [ebp - 0x22c]
add eax, 0xa4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
jne 0x402830
jmp 0x40283a
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4027fe
cmp dword [ebp + 0x10], 1
jne 0x40284d
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp + 0xc], 5
jne 0x40285e
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x11c]
leave
ret 0xc