Function at 0x10004869
Capabilities:
Delete file
Get common file path
Move file
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [0x1002f060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push 0x20
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
cmp eax, ebx
je 0x100048ca
push str.MoveFileExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x100048ca
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 4
push ebx
push edi
call esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, ebx
jne 0x10004b08
cmp dword [ebp + 8], ebx
je 0x10004b08
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec eax
cmp eax, 0xf5
ja 0x10004b08
push str.wininit.ini
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
lea eax, [ebp - 0x310]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
dec eax
cmp eax, 0x102
ja 0x10004b08
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x310]
push eax
call edi
or dword [ebp - 0x320], 0xffffffff
lea esi, [eax + 0x1b]
mov dword [ebp - 0x31c], eax
lea eax, [ebp - 0x320]
push eax
push esi
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x314], ebx
call fcn.10004171
add esp, 0x10
mov dword [ebp - 0x318], eax
cmp eax, ebx
jne 0x1000498f
push 0x10033210
push esi
call fcn.10017ff4
mov dword [ebp - 0x318], eax
pop ecx
xor eax, eax
pop ecx
cmp dword [ebp - 0x318], ebx
je 0x10004b08
jmp 0x10004995
mov eax, dword [ebp - 0x314]
mov ecx, dword [ebp - 0x318]
lea ebx, [ecx + eax]
mov eax, str._rename_
mov byte [ebx], 0
call fcn.10015f20
mov esi, eax
test esi, esi
jne 0x100049cf
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str._r_n_rename__r_nNUL
push ebx
call esi
lea eax, [ebp - 0x310]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x10004a18
add esi, 8
push esi
mov dword [ebp - 0x314], esi
call edi
mov ecx, dword [ebp - 0x31c]
inc eax
push eax
lea ebx, [ecx + esi + 8]
push esi
push ebx
call fcn.10019f30
add esp, 0xc
push 0x10026de2
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call esi
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x314]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov word [ebx - 2], 0xa0d
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
push str..tmp
lea eax, [ebp - 0x20c]
push eax
call edi
lea ecx, [ebp - 0x20c]
sub ecx, 4
add eax, ecx
push eax
call esi
xor esi, esi
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x314], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10004abe
push esi
lea eax, [ebp - 0x31c]
push eax
push dword [ebp - 0x318]
mov dword [ebp - 0x31c], esi
call edi
push eax
push dword [ebp - 0x318]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10004ab1
push dword [ebp - 0x318]
call edi
mov dword [ebp - 0x314], 1
cmp eax, dword [ebp - 0x31c]
je 0x10004ab7
mov dword [ebp - 0x314], esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x318]
call fcn.10017a6b
cmp dword [ebp - 0x320], 0xffffffff
pop ecx
je 0x10004adf
push dword [ebp - 0x320]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x314], esi
je 0x10004b08
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10017a76
leave
ret