Function at 0x445340
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0x5b642c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0
push 0
push 0x20
push 2
push 1
mov dword [ebp - 0x158], eax
mov edi, edx
mov eax, dword [0x5bfbb0]
mov ebx, ecx
push 0x80
mov dword [ebp - 0x16c], eax
lea eax, [ebp - 0x178]
push 0
push eax
lea eax, [ebp - 0x170]
mov dword [ebp - 0x170], 0x18
push eax
push 0x1f01ff
lea eax, [ebp - 0x140]
mov dword [ebp - 0x164], 0x40
push eax
mov dword [ebp - 0x168], edi
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x15c], 0
call dword [sym.imp.ntdll.dll_ZwCreateFile]
mov esi, eax
test esi, esi
jns 0x445424
mov ecx, dword [0x5b7f4c]
cmp ecx, 0x5b7f4c
je 0x445411
test dword [ecx + 0x31c], 0x800
je 0x445411
cmp byte [ecx + 0x319], 2
jb 0x445411
push esi
push edi
push dword [ecx + 0x314]
push dword [ecx + 0x310]
mov ecx, 0xd
call fcn.00444fa0
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0053a033
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x13c]
call fcn.0044dda0
xorps xmm0, xmm0
movlpd qword [ebp - 0x14c], xmm0
nop word [eax + eax]
push 0
lea eax, [ebp - 0x14c]
push eax
push 0x10000
push dword [0x5bfeec]
lea eax, [ebp - 0x154]
push eax
push 0
push 0
push 0
push ebx
call dword [sym.imp.ntdll.dll_ZwReadFile]
mov esi, eax
cmp esi, 0x103
jne 0x445489
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x44551c
mov esi, dword [ebp - 0x154]
test esi, esi
js 0x4455bd
push 0
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 0x150]
lea eax, [ebp - 0x154]
push dword [0x5bfeec]
push eax
push 0
push 0
push 0
push dword [ebp - 0x140]
call dword [sym.imp.ntdll.dll_ZwWriteFile]
mov esi, eax
test esi, esi
js 0x445595
mov esi, dword [ebp - 0x150]
lea ecx, [ebp - 0x13c]
mov edi, dword [0x5bfeec]
mov edx, edi
push esi
call fcn.0044f180
push esi
mov edx, edi
lea ecx, [ebp - 0xe4]
call fcn.0044edf0
test al, al
je 0x445525
push esi
mov edx, edi
lea ecx, [ebp - 0x7c]
call fcn.0044e930
test al, al
je 0x445525
mov eax, dword [ebp - 0x150]
add dword [ebp - 0x14c], eax
adc dword [ebp - 0x148], 0
jmp 0x445440
push ebx
call dword [sym.imp.KERNEL32.dll_CancelIo]
jmp 0x445564
mov eax, dword [0x5b7f4c]
cmp eax, 0x5b7f4c
je 0x445564
test dword [eax + 0x31c], 0x800
je 0x445564
cmp byte [eax + 0x319], 2
jb 0x445564
push dword [eax + 0x314]
mov edx, 0x597c88
mov ecx, 0x10
push dword [eax + 0x310]
call fcn.00443970
add esp, 8
mov edi, 0xc0000001
push dword [ebp - 0x140]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.ntdll.dll_ZwDeleteFile]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0053a033
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5b7f4c]
cmp eax, 0x5b7f4c
je 0x445605
test dword [eax + 0x31c], 0x800
je 0x445605
cmp byte [eax + 0x319], 2
jb 0x445605
mov ecx, 0xf
jmp 0x4455eb
cmp esi, 0xc0000011
je 0x445605
mov eax, dword [0x5b7f4c]
cmp eax, 0x5b7f4c
je 0x445605
test dword [eax + 0x31c], 0x800
je 0x445605
cmp byte [eax + 0x319], 2
jb 0x445605
mov ecx, 0xe
push esi
push dword [eax + 0x314]
mov edx, 0x597c88
push dword [eax + 0x310]
call fcn.004431f0
add esp, 0xc
xor edi, edi
cmp esi, 0xc0000011
cmovne edi, esi
test edi, edi
js 0x445569
mov edx, dword [ebp - 0x158]
lea ecx, [ebp - 0x13c]
call fcn.0044de90
test al, al
jne 0x445675
mov eax, dword [0x5b7f4c]
cmp eax, 0x5b7f4c
je 0x445564
test dword [eax + 0x31c], 0x800
je 0x445564
cmp byte [eax + 0x319], 2
jb 0x445564
push dword [eax + 0x314]
mov edx, 0x597c88
mov ecx, 0x11
push dword [eax + 0x310]
jmp 0x44555c
push dword [ebp - 0x140]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053a033
mov esp, ebp
pop ebp
ret