Function at 0x438acc
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x438ad5
mov eax, dword [ebp - 4]
add esp, 0xffffffbc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x8048], ebx
mov dword [ebp - 0x8044], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], eax
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
call fcn.00403e28
mov ebx, 0x66221c
xor eax, eax
push ebp
push 0x438ebf
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x19], 0
cmp dword [0x675564], 0
jne 0x438b48
call sub.kernel32.dll_GetCurrentThreadId
mov edx, dword [0x6733d0]
cmp eax, dword [edx]
je 0x438e8b
mov byte [ebx], 4
jmp 0x438e8b
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov byte [ebp - 0x3d], 0
xor esi, esi
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x14], 0
je 0x438b6d
mov eax, dword [0x672980]
cmp byte [eax], 0
jne 0x438b7a
lea eax, [ebp - 0x14]
mov edx, 0x438ed8
call fcn.004038bc
push dword [ebp - 0x14]
push 0x438ee8
push dword [ebp - 0x10]
push 0x438ef4
push dword [ebp - 0x18]
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00403b88
push ebp
call fcn.004389f0
pop ecx
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x8044]
mov eax, dword [0x672b20]
mov eax, dword [eax]
call fcn.00658380
mov eax, dword [ebp - 0x8044]
push eax
call dword [0x675568]
mov dword [ebp - 4], eax
mov byte [ebp - 0x3e], 0
push 0
push 0x800
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [0x67556c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x438e75
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 4
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x20000005
mov eax, dword [ebp - 8]
push eax
call dword [0x675570]
test eax, eax
jne 0x438c27
mov dword [ebp - 0x3c], 0x7fffffff
test esi, esi
je 0x438c49
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x38]
jne 0x438c47
push 0
push 0
push 0
push esi
mov eax, dword [ebp - 8]
push eax
call dword [0x675574]
inc eax
jne 0x438c49
xor esi, esi
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
test byte [ebp + 8], 4
je 0x438c6a
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov eax, edi
call fcn.006365f4
mov edx, esi
mov eax, edi
call fcn.00636578
test byte [ebp + 8], 8
je 0x438c8a
mov eax, edi
xor edx, edx
mov dword [eax + 0x258], edx
mov edx, dword [ebp - 0x38]
mov dword [eax + 0x25c], edx
mov edx, esi
call fcn.00501fb8
lea edx, [ebp - 0x8044]
mov eax, dword [ebp + 0x10]
call fcn.0065885c
mov eax, dword [ebp - 0x8044]
call fcn.00624f1c
mov eax, dword [ebp + 0x10]
call fcn.0065c55c
mov dword [ebp - 0x24], eax
test esi, esi
jle 0x438cc1
push 2
push 0
push 0
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_SetFilePointer
lea eax, [ebp - 0x30]
push eax
push 0x8000
lea eax, [ebp - 0x803e]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [0x675578]
test eax, eax
je 0x438db8
cmp dword [ebp - 0x30], 0
jne 0x438d08
mov byte [ebp - 0x19], 1
call sub.kernel32.dll_GetCurrentThreadId
mov edx, dword [0x6733d0]
cmp eax, dword [edx]
je 0x438e2e
mov byte [ebx], 3
jmp 0x438e2e
push 0
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x803e]
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_WriteFile
test eax, eax
je 0x438d5d
test byte [ebp + 8], 4
je 0x438d3f
mov eax, edi
call fcn.00636548
mov edx, eax
add edx, dword [ebp - 0x30]
mov eax, edi
call fcn.00636578
test byte [ebp + 8], 8
je 0x438d55
mov eax, edi
mov edx, dword [eax + 0x260]
add edx, dword [ebp - 0x30]
call fcn.00501fb8
add esi, dword [ebp - 0x30]
jmp 0x438e17
mov al, byte [ebx]
mov byte [ebp - 9], al
test byte [ebp + 8], 1
jne 0x438d96
lea ecx, [ebp - 0x8048]
mov eax, dword [0x6730a4]
mov eax, dword [eax]
mov edx, dword [ebp + 0x10]
call fcn.00659210
mov eax, dword [ebp - 0x8048]
mov cx, word [0x438ef8]
mov dl, 1
call fcn.00438988
cmp eax, 4
je 0x438dae
mov byte [ebp - 0x3d], 1
call sub.kernel32.dll_GetCurrentThreadId
mov edx, dword [0x6733d0]
cmp eax, dword [edx]
je 0x438e17
mov byte [ebx], 4
jmp 0x438e17
mov al, byte [ebp - 9]
mov byte [ebx], al
jmp 0x438d08
push ebp
call fcn.004389f0
pop ecx
mov al, byte [ebx]
mov byte [ebp - 9], al
test byte [ebp + 8], 1
jne 0x438e03
lea ecx, [ebp - 0x8048]
mov eax, dword [0x671b74]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
call fcn.00659210
mov eax, dword [ebp - 0x8048]
mov cx, word [0x438ef8]
mov dl, 1
call fcn.00438988
cmp eax, 4
jne 0x438e03
mov al, byte [ebp - 9]
mov byte [ebx], al
mov byte [ebp - 0x3e], 1
jmp 0x438e2e
call sub.kernel32.dll_GetCurrentThreadId
mov edx, dword [0x6733d0]
cmp eax, dword [edx]
je 0x438e2e
mov byte [ebx], 4
jmp 0x438e2e
cmp byte [ebx], 2
je 0x438e17
cmp byte [ebp - 0x3d], 0
jne 0x438e2e
mov al, byte [ebx]
add al, 0xfd
sub al, 2
jae 0x438cc1
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_CloseHandle
cmp byte [ebp - 0x3e], 0
jne 0x438b9a
cmp byte [ebp - 0x19], 0
jne 0x438e50
mov eax, dword [ebp + 0x10]
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebp - 8]
push eax
call dword [0x67557c]
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x438e84
push ebp
call fcn.00438a28
pop ecx
test al, al
jne 0x438b9a
push ebp
call fcn.004389f0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438ec6
lea eax, [ebp - 0x8048]
call fcn.00403274
lea eax, [ebp - 0x8044]
call fcn.00403880
lea eax, [ebp - 0x20]
call fcn.00403880
lea eax, [ebp - 0x14]
call fcn.00403880
ret