Function at 0x41f000
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x44e08e
mov eax, dword fs:[0]
push eax
mov eax, 0x153c
call fcn.00447d40
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x1538], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x1550]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebx + 0x2b8]
mov dword [esp + 0x20], ebx
test ecx, ecx
je 0x41f77e
cmp dword [ebx + 0x1b0], 0
je 0x41f77e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0
shr esi, 0x18
call fcn.0043a6c4
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
jbe 0x41f08e
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00417ed0
call fcn.00435810
lea eax, [ebx + 0x2a4]
push eax
lea ecx, [esp + 0x28]
push ecx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebp, 0x10
mov dword [esp + 0x3c], esp
cmp eax, ebp
jb 0x41f0c7
mov ecx, dword [edi]
jmp 0x41f0c9
mov ecx, edi
cmp ecx, 0x456d08
ja 0x41f102
cmp eax, ebp
jb 0x41f0d9
mov ecx, dword [edi]
jmp 0x41f0db
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x456d08
jbe 0x41f102
cmp eax, ebp
jb 0x41f0ee
mov edi, dword [edi]
push 2
mov eax, 0x456d08
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d80
jmp 0x41f144
cmp eax, 2
jae 0x41f114
mov ecx, dword [esi + 0x14]
push ecx
push 2
mov ecx, esi
call fcn.004034b0
mov ecx, dword [esi + 0x18]
cmp ecx, ebp
jb 0x41f11f
mov eax, dword [edi]
jmp 0x41f121
mov eax, edi
push 2
push 0x456d08
push ecx
push eax
call fcn.00439429
add esp, 0x10
mov dword [esi + 0x14], 2
cmp dword [esi + 0x18], ebp
jb 0x41f140
mov edi, dword [edi]
mov byte [edi + 2], 0
lea esi, [esp + 0xc0]
call fcn.004016b0
mov dword [esp + 0x1560], 2
call fcn.00401850
mov byte [esp + 0x155c], 3
cmp dword [eax + 0x18], ebp
jb 0x41f172
mov eax, dword [eax + 4]
jmp 0x41f175
add eax, 4
lea edx, [ebx + 0x19c]
push edx
mov edi, eax
lea esi, [esp + 0x50]
call fcn.00405500
add esp, 4
push eax
lea edi, [esp + 0x6c]
mov byte [esp + 0x1560], 4
call fcn.004055b0
add esp, 8
push 0xffffffffffffffff
push 0
lea ebp, [ebx + 0x288]
push eax
mov ecx, ebp
mov byte [esp + 0x1564], 5
call fcn.00402d80
cmp dword [esp + 0x7c], 0x10
jb 0x41f1cd
mov eax, dword [esp + 0x68]
push eax
call fcn.004393c9
add esp, 4
mov edi, 0x10
mov esi, 0xf
mov dword [esp + 0x7c], esi
mov dword [esp + 0x78], 0
mov byte [esp + 0x68], 0
cmp dword [esp + 0x60], edi
jb 0x41f1fb
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.004393c9
add esp, 4
mov dword [esp + 0x60], esi
mov dword [esp + 0x5c], 0
mov byte [esp + 0x4c], 0
cmp dword [esp + 0x3c], edi
jb 0x41f21f
mov edx, dword [esp + 0x28]
push edx
call fcn.004393c9
add esp, 4
mov dword [esp + 0x3c], esi
lea esi, [esp + 0x9c]
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
mov dword [esp + 0x1558], 0xffffffff
call fcn.00429e20
call fcn.00435460
test eax, eax
je 0x41f255
call fcn.00417f80
cmp dword [ebp + 0x18], edi
jb 0x41f25f
mov eax, dword [ebp + 4]
jmp 0x41f262
lea eax, [ebp + 4]
xor edi, edi
push edi
push 0x80
push 3
push edi
push edi
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
call fcn.00406570
test eax, eax
je 0x41f28a
call fcn.00418050
cmp esi, 0xffffffff
je 0x41f36d
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
call fcn.004177a0
sub eax, 1
jne 0x41f2af
call fcn.00418100
call fcn.00419840
call fcn.004354c0
test eax, eax
je 0x41f2bd
call fcn.00419f30
call fcn.004174a0
test eax, eax
je 0x41f2d0
call fcn.00418fd0
call fcn.004181a0
lea eax, [esp + 0x40]
push eax
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp eax, edi
je 0x41f36d
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
push 0
push 0x989680
push ecx
push eax
call fcn.00442fe0
sub eax, 0xb6109100
push 0xfff
lea ecx, [esp + 0x551]
sbb edx, 2
push 0
push ecx
mov dword [ebx + 0x280], eax
mov dword [ebx + 0x284], edx
mov byte [esp + 0x558], 0
call fcn.0043fbd0
add esp, 0xc
push 0
lea edx, [esp + 0x1c]
push edx
push 0xa
lea eax, [esp + 0x558]
push eax
push esi
mov dword [esp + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
call fcn.00417360
test eax, eax
je 0x41f35b
call fcn.00418230
test edi, edi
jne 0x41f743
cmp dword [esp + 0x18], edi
jne 0x41f743
test esi, esi
je 0x41f386
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00417360
test eax, eax
je 0x41f386
call fcn.00418300
call fcn.004393a7
cdq
mov ecx, 0xff
idiv ecx
mov edi, edx
shl edi, 8
call fcn.004393a7
cdq
mov ecx, 0xff
idiv ecx
mov esi, edx
add esi, edi
shl esi, 8
call fcn.004393a7
cdq
mov ecx, 0xff
idiv ecx
mov edi, edx
add edi, esi
shl edi, 8
call fcn.004393a7
cdq
mov ecx, 0xff
idiv ecx
push 0x3ff
push 0
mov byte [esp + 0x154], 0
lea esi, [edx + edi]
lea edx, [esp + 0x155]
push edx
mov dword [ebx + 0x1f4], esi
call fcn.0043fbd0
add esp, 0xc
push 0xa
push 0x400
lea eax, [esp + 0x154]
push eax
push esi
call fcn.0043b0b3
lea eax, [esp + 0x15c]
add esp, 0x10
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41f417
sub eax, ecx
push eax
lea ecx, [esp + 0x150]
lea esi, [ebx + 0x1f8]
push ecx
mov ecx, esi
call fcn.004030c0
cmp dword [ebp + 0x18], 0x10
jb 0x41f441
mov eax, dword [ebp + 4]
jmp 0x41f444
lea eax, [ebp + 4]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41f592
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
mov edi, esp
lea edx, [esp + 0x44]
mov esi, ebp
push edx
sub esp, 0x1c
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov esi, esp
mov ebp, 0xf
mov dword [esi + 0x18], ebp
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebx, 0x10
mov dword [esp + 0x58], esp
cmp eax, ebx
jb 0x41f4b0
mov ecx, dword [edi]
jmp 0x41f4b2
mov ecx, edi
cmp ecx, 0x456d98
ja 0x41f4eb
cmp eax, ebx
jb 0x41f4c2
mov ecx, dword [edi]
jmp 0x41f4c4
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x456d98
jbe 0x41f4eb
cmp eax, ebx
jb 0x41f4d7
mov edi, dword [edi]
push 0x26
mov eax, 0x456d98
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d80
jmp 0x41f52d
cmp eax, 0x26
jae 0x41f4fd
mov ecx, dword [esi + 0x14]
push ecx
push 0x26
mov ecx, esi
call fcn.004034b0
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x41f508
mov eax, dword [edi]
jmp 0x41f50a
mov eax, edi
push 0x26
push 0x456d98
push ecx
push eax
call fcn.00439429
add esp, 0x10
mov dword [esi + 0x14], 0x26
cmp dword [esi + 0x18], ebx
jb 0x41f529
mov edi, dword [edi]
mov byte [edi + 0x26], 0
lea esi, [esp + 0xdc]
call fcn.004016b0
mov dword [esp + 0x157c], 6
call fcn.00401930
mov byte [esp + 0x1578], 7
cmp dword [eax + 0x18], ebx
jb 0x41f55b
mov eax, dword [eax + 4]
jmp 0x41f55e
add eax, 4
mov edx, dword [esp + 0x40]
push eax
push 1
push edx
call fcn.0041d220
add esp, 0x2c
cmp dword [esp + 0x3c], ebx
jb 0x41f581
mov eax, dword [esp + 0x28]
push eax
call fcn.004393c9
add esp, 4
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], 0
jmp 0x41f88f
cmp dword [esi + 0x18], 0x10
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 0x20c]
mov dword [esp + 0x1c], 0
jb 0x41f5af
mov esi, dword [esi + 4]
jmp 0x41f5b2
add esi, 4
push 0
lea edx, [esp + 0x20]
push edx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
call fcn.00417360
mov ecx, eax
mov eax, 0x3e0f83e1
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x21
jle 0x41f5f3
push 0x21
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00418100
call fcn.00418370
test esi, esi
je 0x41f602
cmp dword [esp + 0x1c], 0
jne 0x41f731
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
mov edi, esp
mov ecx, 7
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xa0]
push ecx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x58], esp
cmp eax, 0x10
jb 0x41f648
mov ecx, dword [edi]
jmp 0x41f64a
mov ecx, edi
cmp ecx, 0x456dc0
ja 0x41f685
cmp eax, 0x10
jb 0x41f65b
mov ecx, dword [edi]
jmp 0x41f65d
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x456dc0
jbe 0x41f685
cmp eax, 0x10
jb 0x41f671
mov edi, dword [edi]
push 0x24
mov eax, 0x456dc0
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d80
jmp 0x41f6c9
cmp eax, 0x24
jae 0x41f697
mov ecx, dword [esi + 0x14]
push ecx
push 0x24
mov ecx, esi
call fcn.004034b0
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x41f6a3
mov eax, dword [edi]
jmp 0x41f6a5
mov eax, edi
push 0x24
push 0x456dc0
push ecx
push eax
call fcn.00439429
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x24
jb 0x41f6c5
mov edi, dword [edi]
mov byte [edi + 0x24], 0
lea esi, [esp + 0x134]
call fcn.004016b0
mov dword [esp + 0x157c], 8
call fcn.00401770
mov byte [esp + 0x1578], 9
cmp dword [eax + 0x18], 0x10
jb 0x41f6f8
mov eax, dword [eax + 4]
jmp 0x41f6fb
add eax, 4
mov edx, dword [esp + 0x40]
push eax
push 1
push edx
call fcn.0041d220
add esp, 0x2c
lea ecx, [esp + 0x80]
call fcn.00402bd0
lea esi, [esp + 0xf4]
call fcn.00429e20
call fcn.00417390
test eax, eax
je 0x41f731
call fcn.00418440
test ebx, ebx
je 0x41f73c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x41f8a5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x54c]
push eax
lea ecx, [ebx + 0x1f8]
call fcn.00402c00
push 0
lea ecx, [esp + 0x550]
push 0
push ecx
call fcn.0043b3d7
add esp, 0xc
mov dword [ebx + 0x1f4], eax
xor eax, eax
jmp 0x41f8a5
mov eax, dword [ebx + 0x1b0]
push eax
push ecx
lea edx, [esp + 0x2c]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x44], esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebp, 0x10
cmp eax, ebp
jb 0x41f7b8
mov ecx, dword [edi]
jmp 0x41f7ba
mov ecx, edi
cmp ecx, 0x456d74
ja 0x41f7f3
cmp eax, ebp
jb 0x41f7ca
mov ecx, dword [edi]
jmp 0x41f7cc
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x456d74
jbe 0x41f7f3
cmp eax, ebp
jb 0x41f7df
mov edi, dword [edi]
push 0x21
mov eax, 0x456d74
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d80
jmp 0x41f835
cmp eax, 0x21
jae 0x41f805
mov ecx, dword [esi + 0x14]
push ecx
push 0x21
mov ecx, esi
call fcn.004034b0
mov ecx, dword [esi + 0x18]
cmp ecx, ebp
jb 0x41f810
mov eax, dword [edi]
jmp 0x41f812
mov eax, edi
push 0x21
push 0x456d74
push ecx
push eax
call fcn.00439429
add esp, 0x10
mov dword [esi + 0x14], 0x21
cmp dword [esi + 0x18], ebp
jb 0x41f831
mov edi, dword [edi]
mov byte [edi + 0x21], 0
lea esi, [esp + 0xc4]
call fcn.004016b0
xor esi, esi
mov dword [esp + 0x1564], esi
call fcn.00401930
mov byte [esp + 0x1560], 1
cmp dword [eax + 0x18], ebp
jb 0x41f861
mov eax, dword [eax + 4]
jmp 0x41f864
add eax, 4
push eax
push 1
push ebx
call fcn.0041d220
add esp, 0x14
cmp dword [esp + 0x3c], ebp
jb 0x41f883
mov edx, dword [esp + 0x28]
push edx
call fcn.004393c9
add esp, 4
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], esi
lea esi, [esp + 0x9c]
mov byte [esp + 0x28], 0
call fcn.00429e20
mov eax, 0x80004005
mov ecx, dword [esp + 0x1550]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1538]
xor ecx, esp
call fcn.00438dc1
add esp, 0x1548
ret