Function at 0x41c0f0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xa94
mov eax, dword [ebp + 0xc]
cmp eax, 0x4e
je 0x41ca58
jbe 0x41c4e0
cmp eax, 0x110
je 0x41c548
cmp eax, 0x111
jne 0x41cb03
cmp word [ebp + 0x10], 2
movzx eax, word [ebp + 0x10]
jbe 0x41c520
mov ebx, 1
cmp eax, 0xca
jne 0x41c4d2
mov ecx, 0x16
xor eax, eax
mov edx, 0x62
lea edi, [ebp - 0xa6c]
lea esi, [ebp - 0xa14]
rep stosd dword es:[edi], eax
jmp 0x41c167
movzx edx, word [eax + str.backtrace.txt]
mov word [esi + eax], dx
add eax, 2
test dx, dx
jne 0x41c160
mov eax, dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov dword [esp], 0
lea edi, [ebp - 0x80c]
mov dword [ebp - 0xa78], eax
call eax
sub esp, 4
mov dword [esp], eax
mov eax, dword [0x4ac87c]
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], edi
mov dword [esp + 4], 0x13
mov dword [ebp - 0xa7c], eax
call eax
sub esp, 0x10
cmp word [ebp - 0x80c], 0
je 0x41cabb
mov eax, edi
lea esi, cs:[esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x41c1d0
sub eax, edi
add eax, 2
add eax, edi
xor edx, edx
mov ecx, 0x2a
jmp 0x41c1f7
movzx ecx, word [edx + str..txt]
mov word [eax + edx], cx
add edx, 2
test cx, cx
jne 0x41c1f0
cmp word [eax], 0
je 0x41cad6
mov ebx, eax
nop
add ebx, 2
cmp word [ebx], 0
jne 0x41c210
sub ebx, eax
add ebx, 2
add ebx, eax
mov dword [esp], 0
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0xa70], ebx
call eax
mov edx, ebx
sub edx, edi
mov ecx, eax
mov eax, 0x400
sub esp, 4
sar edx, 1
mov dword [esp + 8], ebx
sub eax, edx
mov dword [esp + 4], 0x14
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xa7c]
mov dword [esp], ecx
call eax
mov edx, dword [ebp - 0xa70]
sub esp, 0x10
cmp word [edx], 0
je 0x41caea
mov eax, edx
lea esi, cs:[esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x41c280
sub eax, edx
lea ecx, [eax + 2]
add ecx, edx
xor eax, eax
mov edx, 0x2a
mov dword [ebp - 0xa70], ecx
jmp 0x41c2a7
movzx edx, word [eax + 0x43eb7a]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x41c2a0
mov edx, dword [ebp - 0xa70]
cmp word [edx], 0
je 0x41cae0
mov eax, edx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x41c2c8
sub eax, edx
add eax, 2
add eax, edx
xor edx, edx
mov dword [ebp - 0xa70], eax
mov word [eax], dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa6c], 0x58
mov dword [ebp - 0xa68], eax
mov eax, dword [ebp - 0xa78]
mov dword [esp], 0
call eax
mov dword [ebp - 0xa60], edi
mov dword [ebp - 0xa64], eax
sub esp, 4
lea eax, [ebp - 0xa6c]
mov dword [ebp - 0xa50], esi
mov dword [ebp - 0xa4c], 0x104
mov dword [ebp - 0xa38], 0x880806
mov dword [ebp - 0xa30], 0x43eb82
mov dword [esp], eax
call dword [0x4ac4dc]
sub esp, 4
test eax, eax
je 0x41c534
mov eax, dword [ebp - 0xa50]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x41cac8
mov edx, dword [sym.imp.ucrtbase.dll_strlen]
mov esi, dword [0x43a908]
mov dword [ebp - 0xa80], edx
mov dword [esp], esi
call edx
lea ecx, [ebp - 0xa74]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, dword [ebp - 0xa80]
sub esp, 0x14
test eax, eax
je 0x41c3fc
mov eax, dword [0x43a908]
mov dword [esp], eax
call edx
cmp eax, dword [ebp - 0xa74]
je 0x41caf4
mov eax, dword fs:[0x18]
mov esi, dword [eax + 0x34]
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0xa50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
sub esp, 4
mov dword [esp], 0
mov eax, dword [ebp - 0xa78]
mov ebx, 1
call eax
sub esp, 4
mov dword [esp], eax
mov eax, dword [ebp - 0xa7c]
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], edi
mov dword [esp + 4], 0x15
call eax
lea eax, [ebp - 0xa70]
sub esp, 0x10
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0x1100
call dword [sym.imp.kernel32.dll_FormatMessageW]
mov eax, dword [ebp - 0xa70]
sub esp, 0x1c
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [0x4ac884]
mov eax, dword [ebp - 0xa70]
sub esp, 0x10
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LocalFree]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
cmp eax, 5
je 0x41c870
cmp eax, 0x24
jne 0x41cb03
mov edi, dword [ebp + 0x14]
mov eax, dword [0x43ce88]
mov ebx, 1
mov edx, dword [0x43ce8c]
mov dword [edi + 0x18], eax
mov eax, ebx
mov dword [edi + 0x1c], edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
test eax, eax
je 0x41c534
mov dword [esp], 0
call dword [0x4ac890]
sub esp, 4
lea esp, [ebp - 0xc]
mov ebx, 1
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
mov esi, dword [0x4ac894]
mov dword [esp + 0x10], 0
lea ebx, [ebp - 0x80c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x31
mov dword [esp + 4], 0x67
mov dword [esp], eax
call esi
sub esp, 0x14
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call dword [0x4ac57c]
xor ecx, ecx
mov byte [ebp - 0x7f1], 1
sub esp, 0xc
mov word [ebp - 0x7f0], cx
mov dword [esp], ebx
call dword [0x4ac578]
sub esp, 4
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 1
mov dword [esp + 8], 0x30
mov dword [esp + 4], 0x67
mov dword [esp], eax
call esi
sub esp, 0x14
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0x100
mov dword [esp + 4], 0x16
mov dword [esp], eax
call dword [0x4ac87c]
mov eax, dword [ebp + 8]
sub esp, 0x10
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x67
mov dword [esp], eax
call dword [0x4ac89c]
mov eax, dword [ebp + 8]
mov esi, dword [0x4ac834]
sub esp, 0xc
mov dword [esp + 4], 0x67
mov dword [esp], eax
call esi
mov ebx, dword [0x4ac80c]
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call ebx
mov eax, dword [ebp + 8]
sub esp, 8
mov dword [esp + 4], 0xca
mov dword [esp], eax
call esi
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call ebx
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0xa14]
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [0x4ac824]
mov eax, dword [ebp - 0xa0c]
mov edi, dword [0x4ac864]
sub esp, 8
mov dword [0x43cea8], eax
mov eax, dword [ebp - 0xa08]
mov dword [esp + 4], ebx
mov dword [0x43ceac], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0xa0c]
sub eax, dword [ebp - 0xa14]
mov dword [0x43ce88], eax
mov eax, dword [ebp - 0xa08]
sub esp, 8
sub eax, dword [ebp - 0xa10]
mov dword [esp + 4], 1
mov dword [0x43ce8c], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call esi
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], eax
call edi
mov eax, dword [ebp + 8]
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [0x4ac880]
mov dword [esp + 8], ebx
mov dword [ebp - 0xa78], eax
mov dword [esp + 0xc], 2
mov dword [esp], 0
call eax
mov eax, dword [ebp - 0xa14]
mov ecx, dword [ebp + 8]
sub esp, 0x10
mov dword [0x43a900], eax
mov eax, dword [ebp - 0xa10]
mov dword [esp], ecx
mov dword [0x43a904], eax
mov dword [esp + 4], 0xca
call esi
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], eax
call edi
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xa78]
sub esp, 8
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp + 0xc], 2
mov dword [esp], 0
call eax
mov eax, dword [ebp - 0xa14]
mov ecx, dword [ebp + 8]
sub esp, 0x10
mov dword [0x43cf64], eax
mov eax, dword [ebp - 0xa10]
mov dword [esp], ecx
mov dword [0x43cf68], eax
mov dword [esp + 4], 0x66
call esi
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], eax
call edi
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xa78]
sub esp, 8
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp + 0xc], 2
mov dword [esp], 0
call eax
mov eax, dword [ebp - 0xa14]
mov ecx, dword [ebp + 8]
sub esp, 0x10
mov dword [0x43cfc8], eax
mov eax, dword [ebp - 0xa10]
mov dword [esp], ecx
mov dword [0x43cfcc], eax
mov dword [esp + 4], 0x67
call esi
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], eax
call edi
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 0xa78]
sub esp, 8
mov dword [esp + 8], ebx
mov ebx, 1
mov dword [esp + 4], edi
mov dword [esp + 0xc], 2
mov dword [esp], 0
call eax
mov eax, dword [ebp - 0xa0c]
sub eax, dword [ebp - 0xa14]
mov dword [0x43ad7c], eax
mov eax, dword [ebp - 0xa08]
sub esp, 0x10
sub eax, dword [ebp - 0xa10]
mov dword [0x43ad80], eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov ebx, 1
test dword [ebp + 0x10], 0xfffffffd
jne 0x41c4d2
movsx edx, word [ebp + 0x14]
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], 1
mov edi, dword [0x43a904]
mov esi, dword [0x43a900]
mov ecx, edx
mov edx, dword [ebp + 8]
sub ecx, dword [0x43cea8]
sar eax, 0x10
sub eax, dword [0x43ceac]
add esi, ecx
mov dword [ebp - 0xa80], ecx
mov dword [esp], edx
mov edx, dword [0x4ac834]
add edi, eax
mov dword [ebp - 0xa78], eax
mov dword [ebp - 0xa7c], edx
call edx
sub esp, 8
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov esi, dword [0x4ac8a0]
mov dword [esp + 0x18], 0x15
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xa78]
sub esp, 0x1c
add edx, dword [0x43cf68]
mov edi, dword [ebp - 0xa80]
mov eax, dword [ebp - 0xa7c]
add edi, dword [0x43cf64]
mov dword [esp], ecx
mov dword [ebp - 0xa84], edx
mov dword [esp + 4], 0xca
call eax
mov edx, dword [ebp - 0xa84]
sub esp, 8
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 0x18], 0x15
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xa78]
sub esp, 0x1c
add edx, dword [0x43cfcc]
mov edi, dword [0x43cfc8]
mov dword [esp], ecx
mov eax, dword [ebp - 0xa7c]
mov dword [ebp - 0xa84], edx
mov dword [esp + 4], 0x66
call eax
mov edx, dword [ebp - 0xa84]
sub esp, 8
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 0x18], 0x15
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xa80]
sub esp, 0x1c
add edx, dword [0x43ad7c]
mov edi, dword [ebp - 0xa78]
mov eax, dword [ebp - 0xa7c]
add edi, dword [0x43ad80]
mov dword [ebp - 0xa78], edx
mov dword [esp], ecx
mov dword [esp + 4], 0x67
call eax
mov edx, dword [ebp - 0xa78]
sub esp, 8
mov dword [esp + 0x18], 0x16
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
sub esp, 0x1c
jmp 0x41c4d2
mov eax, dword [ebp + 0x14]
xor ebx, ebx
mov eax, dword [eax + 8]
mov dword [ebp - 0xa78], eax
and eax, 0xfffffffd
cmp eax, 0xfffffffc
jne 0x41c4d2
cmp dword [ebp + 0x10], 0x66
jne 0x41c4d2
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
add eax, 0x7c
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
call dword [0x4ac724]
sub esp, 0x18
jmp 0x41c4d2
mov eax, 2
jmp 0x41c1de
mov eax, dword fs:[0x18]
mov esi, dword [eax + 0x34]
jmp 0x41c423
mov ebx, 2
jmp 0x41c21e
mov eax, 2
jmp 0x41c2d6
mov ecx, 2
jmp 0x41c28e
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
push eax
jmp 0x41c534
xor ebx, ebx
jmp 0x41c4d2