Function at 0x40a3f4
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x70]
call fcn.00402dc3
xor edi, edi
lea ecx, [ebp - 0x8c]
push edi
push str.setup.ibt
mov dword [ebp - 0x80], 0x412314
mov dword [ebp - 0x78], 0x41231c
call fcn.00403a6c
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x8c], 0x412310
push eax
lea eax, [esi + 0x18]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.00404ce8
add esp, 0xc
lea ecx, [ebp - 0x8c]
call fcn.00401b39
push edi
lea eax, [ebp - 0xb4]
sub esp, 0x1c
mov ecx, esp
push 1
push eax
call fcn.00403fc0
lea ecx, [ebp - 0x70]
call fcn.00402dfa
test al, al
je 0x40a487
lea ecx, [ebp - 0x70]
call fcn.00408617
cmp eax, 0xffffffff
jne 0x40a4e2
lea eax, [ebp - 0x98]
push str.setup.boot
push eax
lea ecx, [ebp - 0xb4]
call fcn.0040c6b9
mov ecx, eax
call fcn.0040cc5f
lea ecx, [ebp - 0x98]
call fcn.00401b39
lea ecx, [ebp - 0x70]
call fcn.004032f3
push edi
lea eax, [ebp - 0xb4]
sub esp, 0x1c
mov ecx, esp
push 1
push eax
call fcn.00403fc0
lea ecx, [ebp - 0x70]
call fcn.00402dfa
test al, al
jne 0x40a4e2
mov esi, 0xfffffed3
jmp 0x40a5cc
push edi
lea ecx, [ebp - 0x70]
push dword [esi + 0xec]
call fcn.00407117
lea ebx, [esi + 0xa8]
lea eax, [ebp - 0x48]
push ebx
push dword [ebp + 8]
push eax
call fcn.00404ce8
add esp, 0xc
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x48]
push eax
call fcn.004045e8
lea ecx, [ebp - 0x2c]
call fcn.00402dc3
push 2
lea eax, [ebp - 0x48]
sub esp, 0x1c
mov ecx, esp
push 1
push eax
call fcn.00403fc0
lea ecx, [ebp - 0x2c]
call fcn.00403428
test al, al
jne 0x40a540
mov esi, 0xfffffed2
jmp 0x40a5ad
push dword [esi + 0xe8]
lea ecx, [ebp - 4]
call fcn.0040ac46
push dword [esi + 0xe8]
push edi
push dword [ebp - 4]
call fcn.004108c0
add esp, 0xc
lea ecx, [ebp - 0x70]
push dword [esi + 0xe8]
push dword [ebp - 4]
call fcn.00403516
cmp eax, 0xffffffff
jne 0x40a57d
mov esi, 0xfffffed1
jmp 0x40a5a5
lea ecx, [ebp + 8]
push edi
push ecx
push eax
push dword [ebp - 4]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40a598
mov eax, dword [ebp + 8]
jmp 0x40a59b
or eax, 0xffffffff
cmp eax, 0xffffffff
jne 0x40a5f5
mov esi, 0xfffffed0
lea ecx, [ebp - 4]
call fcn.0040ac5b
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x412354
call fcn.004032f3
lea ecx, [ebp - 0x24]
call fcn.00401b39
lea ecx, [ebp - 0x48]
call fcn.00401b39
lea ecx, [ebp - 0xb4]
call fcn.00401b39
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x70], 0x412354
call fcn.004032f3
lea ecx, [ebp - 0x68]
call fcn.00401b39
mov eax, esi
jmp 0x40a698
lea ecx, [ebp - 0x2c]
call fcn.00408617
cmp dword [esi + 0xe8], eax
lea ecx, [ebp - 0x2c]
je 0x40a644
call fcn.004032f3
lea ecx, [ebp - 0x48]
call fcn.00401f9d
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 4]
call fcn.0040ac5b
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x412354
call fcn.004032f3
lea ecx, [ebp - 0x24]
call fcn.00401b39
mov edi, 0xfffffecf
jmp 0x40a67b
call fcn.004032f3
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x48]
push eax
call fcn.0040c6b9
push eax
mov ecx, ebx
call fcn.00401bcb
lea ecx, [ebp - 0x98]
call fcn.00401b39
lea ecx, [ebp - 4]
call fcn.0040ac5b
lea ecx, [ebp - 0x2c]
call fcn.0040958b
lea ecx, [ebp - 0x48]
call fcn.00401b39
lea ecx, [ebp - 0xb4]
call fcn.00401b39
lea ecx, [ebp - 0x70]
call fcn.0040958b
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4