Function at 0x406e30
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 0x7d8
mov eax, dword [0x57c6c0]
xor eax, esp
mov dword [esp + 0x7d4], eax
mov ecx, dword [0x585374]
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*4]
add eax, eax
push esi
mov edx, ecx
sub edx, eax
push edi
push edx
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x64
mov edx, ecx
sub edx, eax
mov eax, 0x66666667
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x3e8
mov edx, ecx
sub edx, eax
mov eax, 0x51eb851f
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
mov eax, 0x68db8bad
imul ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x2710
mov edx, ecx
sub edx, eax
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
mov eax, 0x14f8b589
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x186a0
sub ecx, eax
mov eax, 0x68db8bad
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
lea edx, [esp + 0x20]
push str._d_d_d_d_d.DAT
push edx
call fcn.00508cf5
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 0x1c
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea eax, [esp + 0x24]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x406f60
mov ecx, esi
call fcn.00407740
test eax, eax
jne 0x406f79
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x7d4]
xor ecx, esp
call fcn.00508869
add esp, 0x7d8
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
test eax, eax
je 0x4071d7
push ebp
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [0x585378]
mov ebp, dword [0x585370]
mov eax, 0x64
cdq
sub ebp, esi
idiv ebp
mov ecx, dword [0x585374]
mov edx, dword [0x585358]
inc ecx
mov dword [0x585374], ecx
sub ecx, esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
imul eax, ecx
push eax
mov eax, dword [edx + 0x178]
push 0x402
push eax
call esi
mov ecx, dword [0x585370]
pop ebp
cmp ecx, dword [0x585374]
jne 0x4070b5
mov edx, dword [0x585358]
mov eax, dword [edx + 0x178]
push 0
push 0x64
push 0x402
push eax
call esi
mov ecx, dword [0x585358]
push 0
add ecx, 0x54c
call fcn.004105e0
mov ecx, dword [0x585358]
push 1
add ecx, 0x1ac
call fcn.004105e0
mov ecx, dword [0x585370]
mov edx, dword [0x585374]
push ecx
push edx
lea eax, [esp + 0x400]
push str.current:__d__latest
push eax
call fcn.00508cf5
mov ecx, dword [0x585358]
add esp, 0x10
push 0
add ecx, 0x668
call fcn.004105e0
lea ecx, [esp + 0x3f8]
push ecx
mov ecx, dword [0x585358]
add ecx, 0x668
call fcn.00410515
mov ecx, dword [0x585358]
push 1
add ecx, 0x668
call fcn.004105e0
mov ecx, dword [0x585358]
push 0
add ecx, 0x5c0
call fcn.004105e0
mov ecx, dword [0x585358]
push 1
add ecx, 0x614
call fcn.004105e0
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push str.PRESENTVERSION.DAT
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4071d7
mov ecx, dword [0x585374]
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*4]
add edx, edx
mov eax, ecx
sub eax, edx
push eax
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x64
mov edx, ecx
sub edx, eax
mov eax, 0x66666667
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x3e8
mov edx, ecx
sub edx, eax
mov eax, 0x51eb851f
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
mov eax, 0x68db8bad
imul ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x2710
mov edx, ecx
sub edx, eax
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
mov eax, 0x14f8b589
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x186a0
sub ecx, eax
mov eax, 0x68db8bad
imul ecx
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
lea edx, [esp + 0x24]
push str._d_d_d_d_d
push edx
call fcn.00508cf5
add esp, 0x1c
push 0
lea eax, [esp + 0x10]
push eax
push 5
lea ecx, [esp + 0x1c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x4071f1
call ebx
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x7d4]
xor ecx, esp
call fcn.00508869
add esp, 0x7d8
ret
cmp dword [esp + 0x10], 5
jne 0x4071d5
call ebx
mov ecx, dword [esp + 0x7e0]
pop ebx
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.00508869
add esp, 0x7d8
ret