Function at 0x401870
Capabilities:
Delete file
Get common file path
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1011c
call fcn.00401d60
mov eax, dword [esp + 0x10124]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1012c]
push edi
xor edi, edi
add eax, 0x1000
push edi
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0x10]
push edi
push ecx
lea edx, [esp + 0x20]
push 4
push edx
push esi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
call ebx
test eax, eax
jne 0x4018cc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x1011c
ret
cmp dword [0x407a0c], edi
je 0x4018f5
lea eax, [esp + 0x10]
push edi
push eax
lea ecx, [esp + 0x1c]
push 4
push ecx
push esi
call ebx
test eax, eax
jne 0x4018f5
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x1011c
ret
mov edx, dword [esp + 0x14]
push 1
push edi
push edi
push edx
call fcn.00401c00
mov ecx, dword [esp + 0x18]
xor eax, eax
mov ebx, edx
xor edx, edx
add eax, ecx
adc ebx, edx
mov dword [esp + 0x1c], eax
or eax, ebx
jne 0x401926
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x1011c
ret
mov al, byte [0x407a09]
test al, al
je 0x401941
lea eax, [esp + 0x28]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x401965
lea ecx, [esp + 0x28]
push 0x104
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x28]
push 0x5c
push edx
call fcn.00401e90
add esp, 8
mov byte [eax + 1], 0
mov ebp, dword [esp + 0x10138]
lea eax, [esp + 0x28]
push ebp
push edi
push 0x407110
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x2e
push ebp
call fcn.00401e90
mov edx, eax
add esp, 8
cmp edx, edi
jne 0x4019a2
push edi
push ebp
call fcn.00401c50
add esp, 8
mov edx, eax
mov edi, str._TMP.EXE
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
push 2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push 0
push 0xc0000000
push ebp
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4019ee
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x1011c
ret
xor edi, edi
xor esi, esi
test ebx, ebx
jl 0x401a6b
jg 0x401a00
mov eax, dword [esp + 0x1c]
test eax, eax
jbe 0x401a6b
mov eax, dword [esp + 0x10130]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x134]
push 0x10000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4019e1
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push 0
push ecx
lea edx, [esp + 0x134]
push eax
add edi, eax
push edx
push ebp
adc esi, 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4019e1
mov eax, dword [0x4079f0]
push 0
push 0
push 0x464
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp esi, ebx
jl 0x401a00
jg 0x401a6b
cmp edi, dword [esp + 0x1c]
jb 0x401a00
mov ecx, dword [0x4079f0]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x1011c
ret