Function at 0x404f10
Capabilities:
Delete file
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0xab8
mov eax, dword [ecx]
mov edx, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
mov dword [ebp - 0xa8c], eax
mov eax, dword [ecx + 4]
cmp eax, 0x4e
je 0x4058b0
jbe 0x405328
cmp eax, 0x110
je 0x405390
cmp eax, 0x111
jne 0x40594b
movzx eax, dx
cmp dx, 2
jbe 0x405360
mov ebx, 1
cmp eax, 0xca
jne 0x405315
mov ecx, 0x16
xor eax, eax
mov edx, 0x62
lea edi, [ebp - 0xa78]
lea esi, [ebp - 0xa20]
rep stosd dword es:[edi], eax
jmp 0x404fa7
movzx edx, word [eax + str.backtrace.txt]
mov word [esi + eax], dx
add eax, 2
test dx, dx
jne 0x404fa0
mov eax, dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov dword [esp], 0
lea edi, [ebp - 0x818]
mov dword [ebp - 0xa90], eax
call eax
sub esp, 4
mov dword [esp], eax
mov eax, dword [0x4b083c]
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], edi
mov dword [esp + 4], 0x13
mov dword [ebp - 0xa94], eax
call eax
sub esp, 0x10
cmp word [ebp - 0x818], 0
je 0x405906
mov ebx, edi
lea esi, [esi]
nop
add ebx, 2
cmp word [ebx], 0
jne 0x405010
sub ebx, edi
add ebx, 2
add ebx, edi
xor eax, eax
mov edx, 0x2a
jmp 0x405037
movzx edx, word [eax + str..txt]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x405030
cmp word [ebx], 0
je 0x40591e
mov eax, ebx
nop
add eax, 2
cmp word [eax], 0
jne 0x405050
sub eax, ebx
add eax, 2
add ebx, eax
mov dword [esp], 0
mov eax, dword [ebp - 0xa90]
mov dword [ebp - 0xa7c], ebx
call eax
mov edx, ebx
sub edx, edi
mov ecx, eax
mov eax, 0x400
sub esp, 4
sar edx, 1
mov dword [esp], ecx
sub eax, edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xa94]
mov dword [esp + 4], 0x14
call eax
mov ecx, dword [ebp - 0xa7c]
sub esp, 0x10
cmp word [ecx], 0
je 0x405932
mov eax, ecx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x4050c0
sub eax, ecx
add eax, 2
add ecx, eax
mov edx, 0x2a
xor eax, eax
mov dword [ebp - 0xa7c], ecx
jmp 0x4050e7
movzx edx, word [eax + 0x43bc6e]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x4050e0
mov edx, dword [ebp - 0xa7c]
cmp word [edx], 0
je 0x405928
mov eax, edx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x405108
sub eax, edx
add eax, 2
add edx, eax
mov eax, dword [ebp - 0xa8c]
xor ecx, ecx
mov dword [ebp - 0xa7c], edx
mov word [edx], cx
mov dword [ebp - 0xa74], eax
mov eax, dword [ebp - 0xa90]
mov dword [ebp - 0xa78], 0x58
mov dword [esp], 0
call eax
mov dword [ebp - 0xa6c], edi
mov dword [ebp - 0xa70], eax
sub esp, 4
lea eax, [ebp - 0xa78]
mov dword [ebp - 0xa5c], esi
mov dword [ebp - 0xa58], 0x104
mov dword [ebp - 0xa44], 0x880806
mov dword [ebp - 0xa3c], 0x43bc76
mov dword [esp], eax
call dword [0x4b04b8]
sub esp, 4
test eax, eax
je 0x405374
mov eax, dword [ebp - 0xa5c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x405910
mov edx, dword [sym.imp.ucrtbase.dll_strlen]
mov esi, dword [0x4ac108]
mov dword [ebp - 0xa8c], edx
mov dword [esp], esi
call edx
lea ecx, [ebp - 0xa80]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, dword [ebp - 0xa8c]
sub esp, 0x14
test eax, eax
je 0x40523f
mov eax, dword [0x4ac108]
mov dword [esp], eax
call edx
cmp eax, dword [ebp - 0xa80]
je 0x40593c
mov eax, dword fs:[0x18]
mov esi, dword [eax + 0x34]
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0xa5c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
sub esp, 4
mov dword [esp], 0
mov eax, dword [ebp - 0xa90]
mov ebx, 1
call eax
sub esp, 4
mov dword [esp], eax
mov eax, dword [ebp - 0xa94]
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], edi
mov dword [esp + 4], 0x15
call eax
lea eax, [ebp - 0xa7c]
sub esp, 0x10
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0x1100
call dword [sym.imp.kernel32.dll_FormatMessageW]
mov eax, dword [ebp - 0xa7c]
sub esp, 0x1c
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [0x4b0844]
mov eax, dword [ebp - 0xa7c]
sub esp, 0x10
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LocalFree]
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
cmp eax, 5
je 0x4056c8
cmp eax, 0x24
jne 0x40594b
mov eax, dword [global_min_size]
mov edx, dword [0x4ac044]
mov ebx, 1
mov dword [esi + 0x18], eax
mov eax, ebx
mov dword [esi + 0x1c], edx
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
test eax, eax
je 0x405374
mov dword [esp], 0
call dword [0x4b0850]
sub esp, 4
lea esp, [ebp - 0x10]
mov ebx, 1
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov edi, dword [ebp - 0xa8c]
mov esi, dword [0x4b0854]
mov dword [esp + 0x10], 0
lea ebx, [ebp - 0x818]
mov dword [esp + 0xc], 0
mov dword [esp], edi
mov dword [esp + 8], 0x31
mov dword [esp + 4], 0x67
call esi
sub esp, 0x14
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call dword [0x4b0554]
xor eax, eax
mov byte [ebp - 0x7fd], 1
sub esp, 0xc
mov word [ebp - 0x7fc], ax
mov dword [esp], ebx
call dword [0x4b0550]
sub esp, 4
mov dword [esp], edi
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x30
mov dword [esp + 4], 0x67
call esi
sub esp, 0x14
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0x100
mov dword [esp + 4], 0x16
mov dword [esp], eax
call dword [0x4b083c]
sub esp, 0x10
mov dword [esp + 8], ebx
mov dword [esp], edi
mov dword [esp + 4], 0x67
call dword [0x4b085c]
mov esi, dword [0x4b07f4]
sub esp, 0xc
mov dword [esp], edi
mov dword [esp + 4], 0x67
call esi
mov ebx, dword [0x4b07cc]
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [esp], edi
mov dword [esp + 4], 0xca
call esi
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call ebx
lea ebx, [ebp - 0xa20]
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [0x4b07e4]
mov eax, dword [ebp - 0xa18]
mov dword [ebp - 0xa8c], edi
sub esp, 8
mov dword [global_orig_size], eax
mov eax, dword [ebp - 0xa14]
mov dword [esp + 4], ebx
mov dword [esp], edi
mov edi, dword [0x4b0824]
mov dword [0x4ac04c], eax
call edi
mov eax, dword [ebp - 0xa18]
sub eax, dword [ebp - 0xa20]
mov dword [global_min_size], eax
mov eax, dword [ebp - 0xa14]
sub esp, 8
sub eax, dword [ebp - 0xa1c]
mov dword [esp + 4], 1
mov dword [0x4ac044], eax
mov eax, dword [ebp - 0xa8c]
mov dword [esp], eax
call esi
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], eax
call edi
mov edx, dword [0x4b0840]
mov eax, dword [ebp - 0xa8c]
sub esp, 8
mov dword [ebp - 0xa90], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 2
mov dword [esp + 4], eax
mov dword [esp], 0
call edx
mov eax, dword [ebp - 0xa20]
sub esp, 0x10
mov dword [global_close_pos], eax
mov eax, dword [ebp - 0xa1c]
mov dword [esp + 4], 0xca
mov dword [0x4ac03c], eax
mov eax, dword [ebp - 0xa8c]
mov dword [esp], eax
call esi
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0xa8c]
mov edx, dword [ebp - 0xa90]
sub esp, 8
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 2
mov dword [esp + 4], eax
mov dword [esp], 0
call edx
mov eax, dword [ebp - 0xa20]
sub esp, 0x10
mov dword [global_save_pos], eax
mov eax, dword [ebp - 0xa1c]
mov dword [esp + 4], 0x66
mov dword [0x4ac034], eax
mov eax, dword [ebp - 0xa8c]
mov dword [esp], eax
call esi
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0xa8c]
mov edx, dword [ebp - 0xa90]
sub esp, 8
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 2
mov dword [esp + 4], eax
mov dword [esp], 0
call edx
mov eax, dword [ebp - 0xa20]
sub esp, 0x10
mov dword [global_text_pos], eax
mov eax, dword [ebp - 0xa1c]
mov dword [esp + 4], 0x67
mov dword [0x4ac02c], eax
mov eax, dword [ebp - 0xa8c]
mov dword [esp], eax
call esi
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0xa8c]
mov edx, dword [ebp - 0xa90]
sub esp, 8
mov dword [esp + 8], ebx
mov ebx, 1
mov dword [esp + 0xc], 2
mov dword [esp + 4], eax
mov dword [esp], 0
call edx
mov eax, dword [ebp - 0xa18]
sub eax, dword [ebp - 0xa20]
mov dword [global_edit_size], eax
mov eax, dword [ebp - 0xa14]
sub esp, 0x10
sub eax, dword [ebp - 0xa1c]
mov dword [0x4ac024], eax
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
and edx, 0xfffffffd
mov ebx, 1
jne 0x405315
mov edi, dword [0x4ac03c]
movsx eax, si
sub eax, dword [0x4ac048]
sar esi, 0x10
mov dword [ebp - 0xa9c], eax
sub esi, dword [0x4ac04c]
add eax, dword [0x4ac038]
mov ecx, dword [0x4b07f4]
add edi, esi
mov dword [ebp - 0xa90], esi
mov esi, eax
mov eax, dword [ebp - 0xa8c]
mov dword [esp + 4], 1
mov dword [ebp - 0xa94], ecx
mov dword [esp], eax
call ecx
sub esp, 8
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov esi, dword [0x4b0860]
mov dword [esp + 0x18], 0x15
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0xa8c]
mov edx, dword [ebp - 0xa90]
sub esp, 0x1c
add edx, dword [0x4ac034]
mov ecx, dword [ebp - 0xa94]
mov dword [ebp - 0xa98], edx
mov edi, dword [ebp - 0xa9c]
mov dword [esp + 4], 0xca
add edi, dword [0x4ac030]
mov dword [esp], eax
call ecx
mov edx, dword [ebp - 0xa98]
sub esp, 8
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 0x18], 0x15
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0xa8c]
mov edx, dword [ebp - 0xa90]
sub esp, 0x1c
add edx, dword [0x4ac02c]
mov edi, dword [global_text_pos]
mov ecx, dword [ebp - 0xa94]
mov dword [ebp - 0xa98], edx
mov dword [esp + 4], 0x66
mov dword [esp], eax
call ecx
mov edx, dword [ebp - 0xa98]
sub esp, 8
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 0x18], 0x15
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0xa8c]
mov ecx, dword [ebp - 0xa9c]
sub esp, 0x1c
add ecx, dword [0x4ac020]
mov edi, dword [ebp - 0xa90]
mov dword [esp + 4], 0x67
add edi, dword [0x4ac024]
mov dword [ebp - 0xa90], ecx
mov ecx, dword [ebp - 0xa94]
mov dword [esp], eax
call ecx
mov ecx, dword [ebp - 0xa90]
sub esp, 8
mov dword [esp + 0x18], 0x16
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
sub esp, 0x1c
jmp 0x405315
mov eax, dword [esi + 8]
xor ebx, ebx
and eax, 0xfffffffd
cmp eax, 0xfffffffc
jne 0x405315
cmp edx, 0x66
jne 0x405315
add esi, 0x7c
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], str.open
mov dword [esp], 0
call dword [0x4b06ec]
sub esp, 0x18
jmp 0x405315
mov ebx, 2
jmp 0x40501e
mov eax, dword fs:[0x18]
mov esi, dword [eax + 0x34]
jmp 0x405266
mov eax, 2
jmp 0x40505e
mov eax, 2
jmp 0x405116
mov eax, 2
jmp 0x4050ce
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
push eax
jmp 0x405374
xor ebx, ebx
jmp 0x405315