Function at 0x48ea4c
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x48ea55
mov eax, dword [ebp - 4]
add esp, 0xffffffbc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x8048], ebx
mov dword [ebp - 0x8044], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], eax
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
call fcn.00403e28
mov ebx, 0x6690a0
xor eax, eax
push ebp
push 0x48edfc
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x19], 0
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov byte [ebp - 0x3d], 0
xor esi, esi
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x14], 0
je 0x48eac9
mov eax, dword [0x672610]
cmp byte [eax], 0
jne 0x48ead6
lea eax, [ebp - 0x14]
mov edx, 0x48ee14
call fcn.004038bc
push dword [ebp - 0x14]
push 0x48ee24
push dword [ebp - 0x10]
push 0x48ee30
push dword [ebp - 0x18]
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00403b88
push ebp
call fcn.0048e904
pop ecx
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x8044]
mov eax, 0x48ee34
call fcn.0065ca3c
mov eax, dword [ebp - 0x8044]
push eax
call dword [0x674a7c]
mov dword [ebp - 4], eax
mov byte [ebp - 0x3e], 0
push 0
push 0x800
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [0x674a80]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x48edb2
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 4
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x20000005
mov eax, dword [ebp - 8]
push eax
call dword [0x674a84]
test eax, eax
jne 0x48eb81
mov dword [ebp - 0x3c], 0x7fffffff
test esi, esi
je 0x48eba3
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x38]
jne 0x48eba1
push 0
push 0
push 0
push esi
mov eax, dword [ebp - 8]
push eax
call dword [0x674a88]
inc eax
jne 0x48eba3
xor esi, esi
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
test byte [ebp + 8], 4
je 0x48ebc4
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov eax, edi
call fcn.00639c4c
mov edx, esi
mov eax, edi
call fcn.00639bd0
test byte [ebp + 8], 8
je 0x48ebe4
mov eax, edi
xor edx, edx
mov dword [eax + 0x23c], edx
mov edx, dword [ebp - 0x38]
mov dword [eax + 0x240], edx
mov edx, esi
call fcn.004f9e50
mov eax, dword [ebp + 0x10]
call fcn.00660d7c
mov dword [ebp - 0x24], eax
test esi, esi
jle 0x48ec02
push 2
push 0
push 0
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_SetFilePointer
lea eax, [ebp - 0x30]
push eax
push 0x8000
lea eax, [ebp - 0x803e]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [0x674a8c]
test eax, eax
je 0x48ecf7
cmp dword [ebp - 0x30], 0
jne 0x48ec49
mov byte [ebp - 0x19], 1
call sub.kernel32.dll_GetCurrentThreadId
mov edx, dword [0x6729b4]
cmp eax, dword [edx]
je 0x48ed6b
mov byte [ebx], 3
jmp 0x48ed6b
push 0
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x803e]
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_WriteFile
test eax, eax
je 0x48ec9e
test byte [ebp + 8], 4
je 0x48ec80
mov eax, edi
call fcn.00639ba0
mov edx, eax
add edx, dword [ebp - 0x30]
mov eax, edi
call fcn.00639bd0
test byte [ebp + 8], 8
je 0x48ec96
mov eax, edi
mov edx, dword [eax + 0x244]
add edx, dword [ebp - 0x30]
call fcn.004f9e50
add esi, dword [ebp - 0x30]
jmp 0x48ed54
mov al, byte [ebx]
mov byte [ebp - 9], al
test byte [ebp + 8], 1
jne 0x48ecd5
lea ecx, [ebp - 0x8048]
mov eax, 0x48ee4c
mov edx, dword [ebp + 0x10]
call fcn.0065d968
mov eax, dword [ebp - 0x8048]
mov cx, word [0x48ee68]
mov dl, 1
call fcn.0048e89c
cmp eax, 4
je 0x48eced
mov byte [ebp - 0x3d], 1
call sub.kernel32.dll_GetCurrentThreadId
mov edx, dword [0x6729b4]
cmp eax, dword [edx]
je 0x48ed54
mov byte [ebx], 4
jmp 0x48ed54
mov al, byte [ebp - 9]
mov byte [ebx], al
jmp 0x48ec49
push ebp
call fcn.0048e904
pop ecx
mov al, byte [ebx]
mov byte [ebp - 9], al
test byte [ebp + 8], 1
jne 0x48ed40
lea ecx, [ebp - 0x8048]
mov eax, 0x48ee6c
mov edx, dword [ebp - 0x10]
call fcn.0065d968
mov eax, dword [ebp - 0x8048]
mov cx, word [0x48ee68]
mov dl, 1
call fcn.0048e89c
cmp eax, 4
jne 0x48ed40
mov al, byte [ebp - 9]
mov byte [ebx], al
mov byte [ebp - 0x3e], 1
jmp 0x48ed6b
call sub.kernel32.dll_GetCurrentThreadId
mov edx, dword [0x6729b4]
cmp eax, dword [edx]
je 0x48ed6b
mov byte [ebx], 4
jmp 0x48ed6b
cmp byte [ebx], 2
je 0x48ed54
cmp byte [ebp - 0x3d], 0
jne 0x48ed6b
mov al, byte [ebx]
add al, 0xfd
sub al, 2
jae 0x48ec02
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_CloseHandle
cmp byte [ebp - 0x3e], 0
jne 0x48eaf6
cmp byte [ebp - 0x19], 0
jne 0x48ed8d
mov eax, dword [ebp + 0x10]
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebp - 8]
push eax
call dword [0x674a90]
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x48edc1
push ebp
call fcn.0048e93c
pop ecx
test al, al
jne 0x48eaf6
push ebp
call fcn.0048e904
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ee03
lea eax, [ebp - 0x8048]
call fcn.00403274
lea eax, [ebp - 0x8044]
call fcn.00403880
lea eax, [ebp - 0x20]
call fcn.00403880
lea eax, [ebp - 0x14]
call fcn.00403880
ret