Function at 0x40129f
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x96c
push ebx
xor ebx, ebx
push esi
lea eax, [ebp - 0x1e8]
push eax
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp - 0x1e8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 2
pop esi
cmp dword [ebp - 0x1d8], esi
sbb al, al
inc al
mov byte [ebp + 0x63], al
je 0x40132c
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp + 0x4c], eax
jne 0x401308
mov dword [ebp + 0x64], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x7c]
mov dword [ecx], eax
jmp 0x401785
push str.SHCreateDirectoryExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [ebp + 0x48], eax
jne 0x40132c
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x64], 3
mov dword [eax], ebx
jmp 0x401785
push dword [ebp + 0x70]
call fcn.004010a3
mov esi, eax
cmp esi, ebx
pop ecx
jne 0x401344
mov dword [ebp + 0x64], 4
jmp 0x4012f8
lea eax, [ebp + 0x20]
push eax
push ebx
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
jne 0x40135f
mov dword [ebp + 0x64], 5
jmp 0x4012f8
cmp dword [ebp + 0x3c], ebx
jne 0x40137a
cmp dword [ebp + 0x40], esi
jne 0x40137a
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x64], 6
mov dword [eax], esi
jmp 0x401785
lea eax, [ebp]
push eax
push esi
call fcn.0040106c
lea eax, [ebp]
push eax
push dword [ebp + 0x70]
call fcn.0040632a
add esp, 0x10
cmp eax, ebx
mov dword [ebp + 0x5c], eax
jne 0x4013ab
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x64], 7
mov dword [eax], ebx
jmp 0x40173a
push edi
push eax
call fcn.00405e37
cmp eax, ebx
mov edi, dword [ebp + 0x7c]
pop ecx
mov dword [edi], eax
je 0x4013c8
mov dword [ebp + 0x64], 8
jmp 0x401739
mov dword [ebp + 0x64], ebx
lea eax, [ebp + 0x62]
push eax
lea eax, [ebp - 0x4f4]
push eax
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x5c]
lea esi, [ebp - 0x904]
call fcn.004011f4
add esp, 0x10
cmp eax, ebx
mov dword [edi], eax
jne 0x401424
cmp byte [ebp + 0x62], bl
jne 0x4013fc
mov eax, dword [ebp - 0x34]
add dword [ebp + 0x64], eax
push dword [ebp + 0x5c]
call fcn.00405e79
test eax, eax
pop ecx
je 0x4013cb
push dword [ebp + 0x5c]
call fcn.00405e37
cmp eax, ebx
pop ecx
mov dword [edi], eax
je 0x401430
mov dword [ebp + 0x64], 0xb
jmp 0x401739
mov dword [ebp + 0x64], 9
jmp 0x401739
push 0x40000
call fcn.004017f5
cmp eax, ebx
pop ecx
mov dword [ebp + 0x54], eax
jne 0x40144e
mov dword [ebp + 0x64], 0xa
jmp 0x4016bf
mov dword [ebp + 0x50], ebx
lea eax, [ebp + 0x62]
push eax
lea eax, [ebp - 0x4f4]
push eax
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x5c]
lea esi, [ebp - 0x904]
call fcn.004011f4
add esp, 0x10
cmp eax, ebx
mov dword [edi], eax
jne 0x40167a
cmp byte [ebp + 0x62], bl
jne 0x40164a
push dword [ebp + 0x5c]
call fcn.00406772
cmp eax, ebx
pop ecx
mov dword [edi], eax
jne 0x401686
cmp byte [ebp + 0x63], bl
je 0x401508
push 0x104
lea eax, [ebp - 0x3f0]
push eax
push 0xffffffffffffffff
push dword [ebp + 0x74]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, esi
push eax
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0x6fc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
cmp word [ebp - 0x6fc], bx
je 0x401692
lea eax, [ebp - 0x6fc]
push eax
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
lea eax, [ebp - 0x3f0]
push eax
push ebx
call dword [ebp + 0x48]
jmp 0x40155d
lea eax, [ebp - 0x4f4]
push eax
push dword [ebp + 0x74]
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
cmp byte [ebp - 0x154], bl
je 0x401692
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x2ec]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x2ec]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push ebx
lea eax, [ebp - 0x2ec]
push eax
push ebx
call fcn.004010ff
add esp, 0xc
cmp eax, ebx
mov dword [edi], eax
je 0x401573
cmp eax, 0x50
je 0x401573
cmp eax, 0xb7
jne 0x40169e
cmp byte [ebp + 0x63], bl
push ebx
push 0x80
push 1
push ebx
push ebx
push 0x40000000
je 0x401596
lea eax, [ebp - 0x6fc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x4015a3
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0x58], eax
jne 0x40160a
push 0x40713c
lea eax, [ebp - 0x4f4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x401634
mov dword [ebp + 0x64], 0x10
jmp 0x4016bf
jl 0x4016aa
push ebx
lea eax, [ebp + 0x44]
push eax
push esi
push dword [ebp + 0x54]
push dword [ebp + 0x58]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4016b8
push dword [ebp + 0x64]
push dword [ebp + 0x50]
call dword [ebp + 0x78]
test al, al
pop ecx
pop ecx
je 0x4016c9
add dword [ebp + 0x50], esi
push 0x40000
push dword [ebp + 0x54]
push dword [ebp + 0x5c]
call fcn.004060be
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x4015d4
push dword [ebp + 0x58]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4016d2
push dword [ebp + 0x5c]
mov dword [ebp + 0x58], ebx
call fcn.004062b9
cmp eax, ebx
pop ecx
mov dword [edi], eax
jne 0x401707
push dword [ebp + 0x5c]
call fcn.00405e79
test eax, eax
pop ecx
je 0x401451
push dword [ebp + 0x5c]
call fcn.004064d6
cmp eax, ebx
pop ecx
mov dword [edi], eax
je 0x401731
mov dword [ebp + 0x64], 0x15
jmp 0x401739
mov dword [ebp + 0x64], 0xc
jmp 0x401739
mov dword [ebp + 0x64], 0xe
jmp 0x401739
mov dword [ebp + 0x64], 0xf
jmp 0x401737
mov dword [ebp + 0x64], 0xd
jmp 0x401739
mov dword [ebp + 0x64], 0x11
mov dword [edi], esi
jmp 0x401739
mov dword [ebp + 0x64], 0x12
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
jmp 0x401739
mov dword [ebp + 0x64], 1
jmp 0x401737
mov dword [ebp + 0x64], 0x13
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [ebp + 0x63], bl
mov dword [edi], eax
mov dword [ebp + 0x58], ebx
je 0x4016f8
lea eax, [ebp - 0x6fc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x401739
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x401739
cmp byte [ebp + 0x63], bl
je 0x40171b
lea eax, [ebp - 0x6fc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x401728
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp + 0x64], 0x14
jmp 0x401739
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0x64], ebx
mov dword [edi], ebx
pop edi
cmp dword [ebp + 0x5c], ebx
je 0x401748
push dword [ebp + 0x5c]
call fcn.004064d6
pop ecx
cmp dword [ebp + 0x54], ebx
je 0x401756
push dword [ebp + 0x54]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp + 0x58], ebx
je 0x401785
push dword [ebp + 0x58]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp + 0x63], bl
je 0x401778
lea eax, [ebp - 0x6fc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x401785
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp + 0x4c], ebx
pop esi
pop ebx
je 0x401795
push dword [ebp + 0x4c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp + 0x64]
add ebp, 0x68
leave
ret