Function at 0x40b0d0
Capabilities:
Delete file
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov eax, 0x93b8
call fcn.0043c1d0
mov eax, dword [0x4630b0]
xor eax, esp
mov dword [esp + 0x93b4], eax
mov eax, dword [esp + 0x93bc]
mov ecx, dword [esp + 0x93e0]
push esi
mov esi, dword [esp + 0x93c4]
push edi
xor edi, edi
push 0x104
lea edx, [esp + 0xba8]
push esi
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x70], esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x20], edi
call fcn.0043cff9
lea eax, [esp + 0xdb8]
push eax
lea ecx, [esp + 0xfc4]
push ecx
lea edx, [esp + 0x9b0]
push edx
lea eax, [esp + 0x7ac]
push eax
lea ecx, [esp + 0xbc0]
push ecx
call fcn.0043ce27
add esp, 0x20
push esi
call dword [sym.imp.GDI32.dll_GetEnhMetaFileA]
cmp eax, edi
mov dword [esp + 0x10], eax
jne 0x40b1a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x93b4]
xor ecx, esp
call fcn.0043b3fc
add esp, 0x93b8
ret
push ebx
push ebp
mov ebp, dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
push edi
push edi
push eax
call ebp
mov esi, eax
cmp esi, 1
jge 0x40b1c6
mov dword [esp + 0x28], 1
jmp 0x40ba09
mov ebx, dword [esp + 0x18]
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileDescriptionA]
push 0
push 0
push ebx
mov edi, eax
call dword [sym.imp.GDI32.dll_GetEnhMetaFilePaletteEntries]
push 0
push 0
push ebx
mov dword [esp + 0x30], eax
call dword [sym.imp.GDI32.dll_GetEnhMetaFileBits]
push esi
push 0x42
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test edi, edi
mov ebx, eax
mov dword [esp + 0x40], ebx
jle 0x40b223
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x24], 0
jle 0x40b249
mov edx, dword [esp + 0x24]
lea eax, [edx*4]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x34]
push ecx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [esp + 0x18]
push ebx
push esi
push edx
mov dword [esp + 0x3c], eax
call ebp
test eax, eax
jne 0x40b27b
mov dword [esp + 0x28], 1
jmp 0x40b980
test edi, edi
jle 0x40b290
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x18]
push eax
push edi
push ecx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileDescriptionA]
push 0x208
lea edx, [esp + 0x84]
push 0
push edx
call fcn.0043b0e0
add esp, 0xc
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x79c]
mov word [esp + eax + 0x80], cx
add eax, 2
test cx, cx
jne 0x40b2b0
lea eax, [esp + 0x9a4]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b2d1
lea edi, [esp + 0x80]
sub eax, edx
add edi, 0xfffffffe
jmp 0x40b2f0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40b2f0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x80]
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b316
sub eax, edx
sar eax, 1
jne 0x40b36f
push str.IMCLIB_TEMP
call fcn.0043cb7b
add esp, 4
test eax, eax
je 0x40b36f
mov ecx, eax
lea esi, [ecx + 2]
lea ecx, [ecx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x40b340
sub ecx, esi
sar ecx, 1
cmp ecx, 0x104
jae 0x40b36f
lea edx, [esp + 0x80]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x40b360
lea eax, [esp + 0x80]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b380
sub eax, edx
sar eax, 1
jne 0x40b3df
push 0x4536dc
call fcn.0043cb7b
add esp, 4
test eax, eax
je 0x40b3df
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x40b3a7
sub ecx, esi
sar ecx, 1
cmp ecx, 0x104
jae 0x40b3df
lea edx, [esp + 0x80]
sub edx, eax
jmp 0x40b3d0
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
test cx, cx
jne 0x40b3d0
lea eax, [esp + 0x80]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b3f0
sub eax, edx
sar eax, 1
je 0x40b465
lea eax, [esp + 0x80]
lea edx, [eax + 2]
jmp 0x40b410
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b410
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x7e], 0x5c
jne 0x40b448
lea eax, [esp + 0x80]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b431
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x7e], 0x2f
je 0x40b465
lea edi, [esp + 0x80]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40b452
mov eax, dword [0x4536d8]
mov dword [edi], eax
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov edx, dword [esp + 0x18]
push ecx
push esi
push edx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileBits]
cmp eax, esi
jne 0x40b604
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
lea eax, [esp + 0x11c4]
lea ecx, [esp + 0x38c]
sub eax, ecx
mov dword [esp + 0x14], eax
lea esp, [esp]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
lea ebx, [eax + edx]
add eax, dword [ebx + 4]
cmp dword [ebx], 0x46
mov dword [esp + 0x2c], eax
jne 0x40b5f6
cmp dword [ebx + 8], 0
jbe 0x40b5f6
cmp dword [ebx + 0xc], 0x935
jne 0x40b5f6
push 0x410
lea eax, [esp + 0x390]
push 0
push eax
call fcn.0043b0e0
add esp, 0xc
xor eax, eax
jmp 0x40b4f0
movzx ecx, word [esp + eax + 0x80]
mov word [esp + eax + 0x38c], cx
add eax, 2
test cx, cx
jne 0x40b4f0
lea eax, [ebx + 0x10]
mov esi, eax
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b510
lea edi, [esp + 0x38c]
sub eax, esi
add edi, 0xfffffffe
jmp 0x40b530
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40b530
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x21c]
lea ecx, [esp + 0x38c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea edx, [esp + 0x3a4]
push edx
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x40b589
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40b5f6
push 0
lea eax, [esp + 0x50]
push eax
push edi
add ebx, 0x220
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
je 0x40b5f0
cmp dword [esp + 0x50], edi
jne 0x40b5f0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x38c]
push ecx
call fcn.0040a7c0
mov edx, dword [esp + 0x18]
add esp, 4
lea eax, [esp + 0x38c]
jmp 0x40b5d0
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
test cx, cx
jne 0x40b5d0
add dword [esp + 0x1c], 1
add edx, 0x208
mov dword [esp + 0x14], edx
jmp 0x40b5f6
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x34]
cmp dword [esp + 0x2c], edx
jb 0x40b4a0
mov esi, dword [esp + 0x24]
test esi, esi
jle 0x40b69c
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x18]
push edi
push esi
push eax
call dword [sym.imp.GDI32.dll_GetEnhMetaFilePaletteEntries]
lea ecx, [esi*4 + 8]
push ecx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
xor ecx, ecx
test esi, esi
mov dword [esp + 0x48], eax
mov word [eax], 0x300
mov word [eax + 2], si
jle 0x40b65f
lea edx, [eax + 4]
mov edi, edi
mov ebx, dword [edi + ecx*4]
mov dword [edx], ebx
add ecx, 1
add edx, 4
cmp ecx, esi
jl 0x40b650
push eax
call dword [sym.imp.GDI32.dll_CreatePalette]
test eax, eax
mov dword [esp + 0x44], eax
jne 0x40b67f
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x28], 1
jmp 0x40b94e
mov esi, dword [esp + 0x20]
push 0
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectPalette]
test eax, eax
mov dword [esp + 0x50], eax
je 0x40b69c
push esi
call dword [sym.imp.GDI32.dll_RealizePalette]
mov ebp, dword [esp + 0x40]
fild dword [ebp + 0x48]
fild dword [ebp + 0x50]
fdiv qword [str.ffffff9__]
fdivp st(1)
fadd qword [0x4533f8]
call fcn.0043b410
mov edx, dword [ebp + 0x18]
mov ecx, eax
imul edx, ecx
mov eax, 0x6734d007
imul edx
sar edx, 0xa
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [ebp + 0x1c]
imul edx, ecx
mov eax, 0x6734d007
imul edx
sar edx, 0xa
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, dword [ebp + 0x20]
mov ebp, dword [ebp + 0x24]
imul edx, ecx
mov eax, 0x6734d007
imul ebp, ecx
imul edx
sar edx, 0xa
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x6734d007
imul ebp
sar edx, 0xa
mov ebp, edx
shr ebp, 0x1f
mov eax, ebx
sub eax, esi
add ebp, edx
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, edi
cmp dword [esp + 0x10], 0
mov dword [esp + 0x24], eax
je 0x40b742
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [eax], edx
mov edx, dword [esp + 0x24]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
cmp dword [esp + 0x93ec], 0
jne 0x40b7bc
xor eax, eax
mov dword [esp + 0x93d8], eax
mov dword [esp + 0x93d4], eax
mov eax, dword [esp + 0x93e4]
shl eax, 8
cdq
idiv dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x93e8]
shl eax, 8
cdq
idiv dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
cmp ecx, eax
jge 0x40b791
mov eax, ecx
mov dword [esp + 0x93ec], ecx
jmp 0x40b798
mov dword [esp + 0x93ec], eax
cmp eax, 1
jge 0x40b7aa
mov dword [esp + 0x93ec], 1
jmp 0x40b7bc
cmp eax, 0x100
jle 0x40b7bc
mov dword [esp + 0x93ec], 0x100
fild dword [esp + 0x93ec]
mov eax, dword [esp + 0x20]
push 2
push eax
fmul qword [0x4535f0]
mov dword [esp + 0x78], esi
mov dword [esp + 0x7c], edi
mov dword [esp + 0x80], ebx
fstp dword [esp + 0x18]
mov dword [esp + 0x84], ebp
fld dword [esp + 0x18]
fst dword [esp + 0x5c]
fldz
fst dword [esp + 0x60]
fstp dword [esp + 0x64]
fstp dword [esp + 0x68]
fild dword [esp + 0x93dc]
fmul dword [esp + 0x5c]
fchs
fstp dword [esp + 0x6c]
fild dword [esp + 0x93e0]
fmul dword [esp + 0x68]
fchs
fstp dword [esp + 0x70]
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x54]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetWorldTransform]
mov eax, dword [esp + 0x6c]
push eax
call fcn.0040b020
add esp, 4
test eax, eax
je 0x40ba7c
push 8
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
xor ebp, ebp
cmp esi, ebp
je 0x40b87c
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x18], ebp
call sub.gdiplus.dll_GdipCreateFromHDC
mov dword [esi + 4], eax
mov eax, dword [esp + 0x10]
mov dword [esi], eax
mov ebx, esi
jmp 0x40b87e
xor ebx, ebx
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
cmp esi, ebp
je 0x40b8b5
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebp
push edx
mov dword [esi], vtable.Gdiplus::Metafile.0
mov dword [esp + 0x1c], ebp
call sub.gdiplus.dll_GdipCreateMetafileFromEmf
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 4], eax
mov edi, esi
mov esi, eax
jmp 0x40b8b9
xor edi, edi
xor esi, esi
mov ecx, dword [ebx]
push ebp
push ebp
push esi
push ecx
call sub.gdiplus.dll_GdipDrawImageI
cmp eax, ebp
je 0x40b8cb
mov dword [ebx + 4], eax
cmp edi, ebp
je 0x40b8d9
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
mov ecx, dword [ebx]
push ecx
call sub.gdiplus.dll_GdipDeleteGraphics
push ebx
call sub.gdiplus.dll_GdipFree
mov ebx, dword [esp + 0x20]
fld1
lea ecx, [esp + 0x54]
fst dword [esp + 0x54]
push ecx
fstp dword [esp + 0x64]
push ebx
fldz
fst dword [esp + 0x6c]
fstp dword [esp + 0x70]
call dword [sym.imp.GDI32.dll_SetWorldTransform]
mov edi, dword [esp + 0x1c]
test edi, edi
jle 0x40b970
lea esi, [esp + 0x11c4]
lea ebx, [ebx]
push esi
call fcn.0040a820
add esp, 4
test eax, eax
je 0x40b943
push 0x103
lea edx, [esp + 0x28c]
push esi
push edx
call fcn.0043cacf
add esp, 0xc
add esi, 0x208
sub edi, 1
jne 0x40b920
cmp dword [esp + 0x1c], 0
jle 0x40b970
push 0xd
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
test eax, eax
je 0x40b970
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x50]
test eax, eax
je 0x40b980
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ebp, dword [esp + 0x40]
test ebp, ebp
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
je 0x40b9a6
push ebp
call esi
push eax
call edi
push ebp
call esi
push eax
call ebx
mov ebp, dword [esp + 0x3c]
test ebp, ebp
je 0x40b9ba
push ebp
call esi
push eax
call edi
push ebp
call esi
push eax
call ebx
mov ebp, dword [esp + 0x38]
test ebp, ebp
je 0x40b9ce
push ebp
call esi
push eax
call edi
push ebp
call esi
push eax
call ebx
mov ebp, dword [esp + 0x48]
test ebp, ebp
je 0x40b9e2
push ebp
call esi
push eax
call edi
push ebp
call esi
push eax
call ebx
mov ebp, dword [esp + 0x30]
test ebp, ebp
je 0x40b9f6
push ebp
call esi
push eax
call edi
push ebp
call esi
push eax
call ebx
mov eax, dword [esp + 0x44]
test eax, eax
je 0x40ba05
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
test edi, edi
jle 0x40ba5f
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, edi
imul ecx, ecx, 0x208
lea esi, [esp + ecx + 0x11c4]
push 0x103
sub esi, 0x208
lea edx, [esp + 0x28c]
push esi
push edx
sub edi, 1
call fcn.0043cacf
add esp, 0xc
push esi
call ebx
test eax, eax
jne 0x40ba5b
call ebp
test edi, edi
jg 0x40ba33
mov ecx, dword [esp + 0x93c4]
mov eax, dword [esp + 0x28]
pop ebp
pop ebx
pop edi
pop esi
xor ecx, esp
call fcn.0043b3fc
add esp, 0x93b8
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
lea edx, [esp + 0x70]
push edx
push eax
push ebx
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
test eax, eax
jne 0x40b8eb
mov dword [esp + 0x28], 1
jmp 0x40b94e