Function at 0x40a6cc
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x70]
call fcn.00402d86
xor edi, edi
lea ecx, [ebp - 0x8c]
push edi
push str.setup.ibt
mov dword [ebp - 0x80], 0x412314
mov dword [ebp - 0x78], 0x41231c
call fcn.00403a2f
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x8c], 0x412310
push eax
lea eax, [esi + 0x18]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.00404ce8
add esp, 0xc
lea ecx, [ebp - 0x8c]
call fcn.00401b39
push edi
lea eax, [ebp - 0xb4]
sub esp, 0x1c
mov ecx, esp
push 1
push eax
call fcn.00403fc0
lea ecx, [ebp - 0x70]
call fcn.00402dbd
test al, al
je 0x40a75f
lea ecx, [ebp - 0x70]
call fcn.00408613
cmp eax, 0xffffffff
jne 0x40a7ba
lea eax, [ebp - 0x98]
push str.setup.boot
push eax
lea ecx, [ebp - 0xb4]
call fcn.0040c6d9
mov ecx, eax
call fcn.0040cc7f
lea ecx, [ebp - 0x98]
call fcn.00401b39
lea ecx, [ebp - 0x70]
call fcn.004032b6
push edi
lea eax, [ebp - 0xb4]
sub esp, 0x1c
mov ecx, esp
push 1
push eax
call fcn.00403fc0
lea ecx, [ebp - 0x70]
call fcn.00402dbd
test al, al
jne 0x40a7ba
mov esi, 0xfffffed3
jmp 0x40a8a4
push edi
lea ecx, [ebp - 0x70]
push dword [esi + 0xec]
call fcn.0040740c
lea ebx, [esi + 0xa8]
lea eax, [ebp - 0x48]
push ebx
push dword [ebp + 8]
push eax
call fcn.00404ce8
add esp, 0xc
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x48]
push eax
call fcn.004045e8
lea ecx, [ebp - 0x2c]
call fcn.00402d86
push 2
lea eax, [ebp - 0x48]
sub esp, 0x1c
mov ecx, esp
push 1
push eax
call fcn.00403fc0
lea ecx, [ebp - 0x2c]
call fcn.004033eb
test al, al
jne 0x40a818
mov esi, 0xfffffed2
jmp 0x40a885
push dword [esi + 0xe8]
lea ecx, [ebp - 4]
call fcn.0040a977
push dword [esi + 0xe8]
push edi
push dword [ebp - 4]
call fcn.004108c0
add esp, 0xc
lea ecx, [ebp - 0x70]
push dword [esi + 0xe8]
push dword [ebp - 4]
call fcn.004034d9
cmp eax, 0xffffffff
jne 0x40a855
mov esi, 0xfffffed1
jmp 0x40a87d
lea ecx, [ebp + 8]
push edi
push ecx
push eax
push dword [ebp - 4]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40a870
mov eax, dword [ebp + 8]
jmp 0x40a873
or eax, 0xffffffff
cmp eax, 0xffffffff
jne 0x40a8cd
mov esi, 0xfffffed0
lea ecx, [ebp - 4]
call fcn.0040ac57
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x412354
call fcn.004032b6
lea ecx, [ebp - 0x24]
call fcn.00401b39
lea ecx, [ebp - 0x48]
call fcn.00401b39
lea ecx, [ebp - 0xb4]
call fcn.00401b39
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x70], 0x412354
call fcn.004032b6
lea ecx, [ebp - 0x68]
call fcn.00401b39
mov eax, esi
jmp 0x40a970
lea ecx, [ebp - 0x2c]
call fcn.00408613
cmp dword [esi + 0xe8], eax
lea ecx, [ebp - 0x2c]
je 0x40a91c
call fcn.004032b6
lea ecx, [ebp - 0x48]
call fcn.00402077
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 4]
call fcn.0040ac57
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x412354
call fcn.004032b6
lea ecx, [ebp - 0x24]
call fcn.00401b39
mov edi, 0xfffffecf
jmp 0x40a953
call fcn.004032b6
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x48]
push eax
call fcn.0040c6d9
push eax
mov ecx, ebx
call fcn.00401bcb
lea ecx, [ebp - 0x98]
call fcn.00401b39
lea ecx, [ebp - 4]
call fcn.0040ac57
lea ecx, [ebp - 0x2c]
call fcn.004096db
lea ecx, [ebp - 0x48]
call fcn.00401b39
lea ecx, [ebp - 0xb4]
call fcn.00401b39
lea ecx, [ebp - 0x70]
call fcn.004096db
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4