Function at 0x43c130
Capabilities:
Delete file
Get file attributes
Get file size
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4e362c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
dec eax
mov dword [ebp - 0x28], esi
push edi
cmp eax, 3
ja case.default.0x43c151
jmp dword [eax*4 + 0x43c4c4]
mov ebx, 0x4e6768
mov dword [ebp - 0x24], ebx
jmp 0x43c192
mov ebx, 0x4e6970
mov dword [ebp - 0x24], ebx
jmp 0x43c192
mov ebx, 0x4e6b78
mov dword [ebp - 0x24], ebx
jmp 0x43c192
mov ebx, 0x4e6d80
mov dword [ebp - 0x24], ebx
jmp 0x43c192
mov ebx, 0x4e6560
mov edi, 0x4e6548
mov dword [ebp - 0x24], ebx
cmp eax, 3
ja case.default.0x43c197
mov edi, 0x4e6548
jmp dword [eax*4 + 0x43c4d4]
mov edi, 0x4e6534
jmp case.default.0x43c197
mov edi, 0x4e64f8
jmp case.default.0x43c197
mov edi, 0x4e650c
jmp case.default.0x43c197
mov edi, 0x4e6520
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, 0x400
je 0x43c1cd
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push ebx
call fcn.0043d780
add esp, 8
mov dword [ebp - 0x2c], eax
cmp eax, 0xffffffff
je 0x43c4a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x43c222
push 1
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x43c222
push 0
push 0
push 1
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x43c222
lea eax, [ebp - 0x18]
push eax
push 4
push ebx
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
push 2
push 0
push 0
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [edi + 0x10], esi
jbe 0x43c479
nop word [eax + eax]
mov ecx, dword [edi + 8]
mov eax, dword [edi + 4]
dec ecx
mov edx, dword [edi + 0xc]
and ecx, edx
mov ebx, dword [eax + ecx*4]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x20], eax
jb 0x43c272
mov ebx, dword [ebx]
cmp eax, 8
jae 0x43c287
movups xmm0, xmmword [ebx]
mov dword [ebp - 8], 7
movups xmmword [ebp - 0x1c], xmm0
jmp 0x43c2c9
mov esi, eax
lea ecx, [ebp - 0x1c]
or esi, 7
mov eax, 0x7ffffffe
cmp esi, 0x7ffffffe
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.00414370
mov ecx, eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
lea eax, [eax*2 + 2]
push eax
push ebx
push ecx
call fcn.00470170
mov eax, dword [ebp - 0x20]
add esp, 0xc
mov edx, dword [edi + 0xc]
mov dword [ebp - 8], esi
mov ecx, dword [edi + 8]
mov dword [ebp - 0xc], eax
dec ecx
mov eax, dword [edi + 4]
and ecx, edx
push dword [eax + ecx*4]
push edi
call fcn.0043af20
add esp, 8
add dword [edi + 0x10], 0xffffffff
jne 0x43c2f0
mov dword [edi + 0xc], 0
jmp 0x43c2f3
inc dword [edi + 0xc]
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push 0
cmovae eax, dword [ebp - 0x1c]
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
mov dword [ebp - 0x38], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x30], eax
lea ebx, [eax + 1]
lea eax, [ebx + 8]
cmp ebx, eax
sbb ecx, ecx
and ecx, eax
je 0x43c412
cmp ecx, 0x400
ja 0x43c353
mov eax, ecx
call fcn.0046e060
mov esi, esp
test esi, esi
je 0x43c412
mov dword [esi], 0xcccc
jmp 0x43c36c
push ecx
call fcn.0047a020
mov esi, eax
add esp, 4
test esi, esi
je 0x43c412
mov dword [esi], 0xdddd
add esi, 8
test esi, esi
je 0x43c412
push ebx
push 0
push esi
call fcn.00470010
add esp, 0xc
mov dword [ebp - 0x20], 0
cmp dword [ebp - 8], 8
lea ebx, [ebp - 0x1c]
cmovae ebx, dword [ebp - 0x1c]
push 0
push 0
push dword [ebp - 0x30]
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x43c3e6
mov edx, dword [ebp - 0x30]
test edx, edx
je 0x43c3e6
mov ecx, ebx
lea eax, [ecx + 2]
mov dword [ebp - 0x28], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43c3c3
sub ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
sar ecx, 1
push ecx
push ebx
push edx
push esi
push eax
call fcn.00478df2
mov eax, dword [ebp - 0x20]
add esp, 0x14
push 0
lea ecx, [ebp - 0x38]
push ecx
push eax
push esi
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esi, 0xfffffff8
mov ebx, eax
mov dword [ebp - 0x28], ebx
cmp dword [esi], 0xdddd
jne 0x43c420
push esi
call fcn.00479a10
add esp, 4
jmp 0x43c420
push str.FlushQueuedLogMessages_ALT:_memory_allocation_failed__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, dword [ebp - 0x28]
test ebx, ebx
jne 0x43c436
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [ebp - 8]
cmp edx, 8
jb 0x43c46c
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43c462
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43c4bf
push edx
push ecx
call fcn.0046d73e
add esp, 8
cmp dword [edi + 0x10], 0
ja 0x43c240
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x34]
push eax
push edi
mov dword [ebp - 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push dword [ebp - 0x34]
push esi
call fcn.0043b850
add esp, 0xc
mov esi, 1
mov eax, esi
lea esp, [ebp - 0x44]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046d700
mov esp, ebp
pop ebp
ret
call fcn.00479239
pop eax
rol dword [ebx], 98
rol dword [ebx], 0x6c
rol dword [ebx], 0x76
rol dword [ebx], 0x9e
rol dword [ebx], 0xa5
rol dword [ebx], 0xac
rol dword [ebx], 0xb3
rol dword [ebx], 0xcc
int3