Function at 0x401000
Capabilities:
Delete file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd04
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xd00], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
push 0x1040
push 0x403170
push 0x40317c
push 0
mov dword [esp + 0x28], esi
call dword [sym.imp.USER32.dll_MessageBoxW]
test esi, esi
je 0x401340
xor eax, eax
cmp ax, word [esi]
je 0x401340
push 0x4031b8
push esi
mov esi, dword [sym.imp.MSVCR90.dll_wcstok]
call esi
push 0x4031b8
push 0
mov edi, eax
call esi
push 0x4031b8
push 0
mov dword [esp + 0x24], eax
call esi
mov esi, eax
add esp, 0x18
mov dword [esp + 0x28], esi
mov ecx, 0x4031bc
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4010ad
test dx, dx
je 0x4010a9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4010ad
add eax, 4
add ecx, 4
test dx, dx
jne 0x401087
xor eax, eax
jmp 0x4010b2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4010c9
mov ecx, dword [esp + 0x18]
push eax
push eax
push ecx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401340
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x404440
push 0x67
push ebx
call edi
push 0x64
push 0x404378
push 0x6d
push ebx
call edi
mov eax, ebx
call fcn.00401360
mov eax, ebx
call fcn.004013f0
test eax, eax
je 0x401340
push 0x6d
push ebx
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.MSVCR90.dll__wtoi]
add esp, 4
mov edi, eax
xor eax, eax
push 0x3fe
push eax
lea ecx, [esp + 0x112]
push ecx
mov word [esp + 0x114], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
push edi
push esi
push str.File:__s_r_nSize:__d
lea edx, [esp + 0x114]
push 0x200
push edx
call dword [sym.imp.MSVCR90.dll_swprintf_s]
add esp, 0x14
push 0
call dword [sym.imp.MSVCR90.dll__time64]
mov ebx, dword [sym.imp.MSVCR90.dll__localtime64_s]
mov dword [esp + 0x14], eax
add esp, 4
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x1c], edx
call ebx
add esp, 8
or esi, 0xffffffff
test eax, eax
jne 0x40118c
mov edx, dword [esp + 0x30]
mov dword [esp + 0x20], edx
jmp 0x401190
mov dword [esp + 0x20], esi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x7c]
push ecx
call ebx
add esp, 8
test eax, eax
jne 0x4011ad
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x24], edx
jmp 0x4011b1
mov dword [esp + 0x24], esi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xe8]
push ecx
call ebx
add esp, 8
test eax, eax
jne 0x4011d4
mov edx, dword [esp + 0xec]
mov dword [esp + 0x1c], edx
jmp 0x4011d8
mov dword [esp + 0x1c], esi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc4]
push ecx
call ebx
add esp, 8
test eax, eax
jne 0x401201
mov edx, dword [esp + 0xd4]
add edx, 0x76c
mov dword [esp + 0xc], edx
jmp 0x401209
mov dword [esp + 0xc], 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x58]
push ecx
call ebx
add esp, 8
test eax, eax
jne 0x401223
mov esi, dword [esp + 0x64]
inc esi
jmp 0x401225
xor esi, esi
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xa0]
push eax
call ebx
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x1c]
neg eax
sbb eax, eax
push ecx
not eax
and eax, dword [esp + 0xbc]
push edx
push esi
push eax
call fcn.00401770
mov ebx, dword [esp + 0x48]
mov eax, dword [esp + 0x38]
push edi
push ebx
push eax
call fcn.00401770
add esp, 0x2c
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
jne 0x4012a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401770
add esp, 4
jmp 0x401340
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0x512]
push edx
mov word [esp + 0x514], cx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0
lea eax, [esp + 0x30]
push eax
push edi
lea ecx, [esp + 0x514]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4012f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00401770
add esp, 4
jmp 0x401340
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x2c]
push edi
push edx
call fcn.00401770
add esp, 8
xor esi, esi
mov edi, edi
push edi
lea eax, [esp + 0x50c]
call fcn.004016c0
test eax, eax
jne 0x401327
inc esi
cmp esi, 3
jl 0x401310
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40133b
push ebx
call fcn.00401770
add esp, 4
call fcn.00401770
mov ecx, dword [esp + 0xd0c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00401778
mov esp, ebp
pop ebp
ret 0x10