Function at 0x437f04
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x437f0d
mov eax, dword [ebp - 4]
add esp, 0xffffffbc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x8048], ebx
mov dword [ebp - 0x8044], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], eax
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
call fcn.00403e18
mov ebx, 0x65f210
xor eax, eax
push ebp
push 0x4382f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x19], 0
cmp dword [0x672560], 0
jne 0x437f80
call sub.kernel32.dll_GetCurrentThreadId
mov edx, dword [0x670370]
cmp eax, dword [edx]
je 0x4382c3
mov byte [ebx], 4
jmp 0x4382c3
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov byte [ebp - 0x3d], 0
xor esi, esi
xor eax, eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x14], 0
je 0x437fa5
mov eax, dword [0x66f91c]
cmp byte [eax], 0
jne 0x437fb2
lea eax, [ebp - 0x14]
mov edx, 0x438310
call fcn.004038bc
push dword [ebp - 0x14]
push 0x438320
push dword [ebp - 0x10]
push 0x43832c
push dword [ebp - 0x18]
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00403b78
push ebp
call fcn.00437e28
pop ecx
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x8044]
mov eax, dword [0x66fabc]
mov eax, dword [eax]
call fcn.00654d58
mov eax, dword [ebp - 0x8044]
push eax
call dword [0x672564]
mov dword [ebp - 4], eax
mov byte [ebp - 0x3e], 0
push 0
push 0x800
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [0x672568]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4382ad
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 4
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x20000005
mov eax, dword [ebp - 8]
push eax
call dword [0x67256c]
test eax, eax
jne 0x43805f
mov dword [ebp - 0x3c], 0x7fffffff
test esi, esi
je 0x438081
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x38]
jne 0x43807f
push 0
push 0
push 0
push esi
mov eax, dword [ebp - 8]
push eax
call dword [0x672570]
inc eax
jne 0x438081
xor esi, esi
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
test byte [ebp + 8], 4
je 0x4380a2
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov eax, edi
call fcn.00633580
mov edx, esi
mov eax, edi
call fcn.00633508
test byte [ebp + 8], 8
je 0x4380c2
mov eax, edi
xor edx, edx
mov dword [eax + 0x258], edx
mov edx, dword [ebp - 0x38]
mov dword [eax + 0x25c], edx
mov edx, esi
call fcn.004ff60c
lea edx, [ebp - 0x8044]
mov eax, dword [ebp + 0x10]
call fcn.00655234
mov eax, dword [ebp - 0x8044]
call fcn.006219e4
mov eax, dword [ebp + 0x10]
call fcn.00658f24
mov dword [ebp - 0x24], eax
test esi, esi
jle 0x4380f9
push 2
push 0
push 0
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_SetFilePointer
lea eax, [ebp - 0x30]
push eax
push 0x8000
lea eax, [ebp - 0x803e]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [0x672574]
test eax, eax
je 0x4381f0
cmp dword [ebp - 0x30], 0
jne 0x438140
mov byte [ebp - 0x19], 1
call sub.kernel32.dll_GetCurrentThreadId
mov edx, dword [0x670370]
cmp eax, dword [edx]
je 0x438266
mov byte [ebx], 3
jmp 0x438266
push 0
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x803e]
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_WriteFile
test eax, eax
je 0x438195
test byte [ebp + 8], 4
je 0x438177
mov eax, edi
call fcn.006334e0
mov edx, eax
add edx, dword [ebp - 0x30]
mov eax, edi
call fcn.00633508
test byte [ebp + 8], 8
je 0x43818d
mov eax, edi
mov edx, dword [eax + 0x260]
add edx, dword [ebp - 0x30]
call fcn.004ff60c
add esi, dword [ebp - 0x30]
jmp 0x43824f
mov al, byte [ebx]
mov byte [ebp - 9], al
test byte [ebp + 8], 1
jne 0x4381ce
lea ecx, [ebp - 0x8048]
mov eax, dword [0x670040]
mov eax, dword [eax]
mov edx, dword [ebp + 0x10]
call fcn.00655be8
mov eax, dword [ebp - 0x8048]
mov cx, word [0x438330]
mov dl, 1
call fcn.00437dc0
cmp eax, 4
je 0x4381e6
mov byte [ebp - 0x3d], 1
call sub.kernel32.dll_GetCurrentThreadId
mov edx, dword [0x670370]
cmp eax, dword [edx]
je 0x43824f
mov byte [ebx], 4
jmp 0x43824f
mov al, byte [ebp - 9]
mov byte [ebx], al
jmp 0x438140
push ebp
call fcn.00437e28
pop ecx
mov al, byte [ebx]
mov byte [ebp - 9], al
test byte [ebp + 8], 1
jne 0x43823b
lea ecx, [ebp - 0x8048]
mov eax, dword [0x66eb0c]
mov eax, dword [eax]
mov edx, dword [ebp - 0x10]
call fcn.00655be8
mov eax, dword [ebp - 0x8048]
mov cx, word [0x438330]
mov dl, 1
call fcn.00437dc0
cmp eax, 4
jne 0x43823b
mov al, byte [ebp - 9]
mov byte [ebx], al
mov byte [ebp - 0x3e], 1
jmp 0x438266
call sub.kernel32.dll_GetCurrentThreadId
mov edx, dword [0x670370]
cmp eax, dword [edx]
je 0x438266
mov byte [ebx], 4
jmp 0x438266
cmp byte [ebx], 2
je 0x43824f
cmp byte [ebp - 0x3d], 0
jne 0x438266
mov al, byte [ebx]
add al, 0xfd
sub al, 2
jae 0x4380f9
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_CloseHandle
cmp byte [ebp - 0x3e], 0
jne 0x437fd2
cmp byte [ebp - 0x19], 0
jne 0x438288
mov eax, dword [ebp + 0x10]
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebp - 8]
push eax
call dword [0x672578]
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4382bc
push ebp
call fcn.00437e60
pop ecx
test al, al
jne 0x437fd2
push ebp
call fcn.00437e28
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4382fe
lea eax, [ebp - 0x8048]
call fcn.00403274
lea eax, [ebp - 0x8044]
call fcn.00403880
lea eax, [ebp - 0x20]
call fcn.00403880
lea eax, [ebp - 0x14]
call fcn.00403880
ret