Function at 0x403f2c
Capabilities:
Delete file
Get common file path
Get disk size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
push edi
mov al, byte [0x41dbc4]
mov byte [ebp - 0x208], al
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
sub ecx, 0x1d0
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp + 0x14]
xor eax, eax
mov al, byte [edx + 0xd]
cmp eax, 1
jne 0x403fbb
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00409710
add esp, 4
mov dword [ebp - 0x848], eax
push 4
push 0x1000
mov edx, dword [ebp - 0x848]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x848]
push eax
mov ecx, dword [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00409690
add esp, 0x10
mov dword [ebp + 0x10], eax
lea ecx, [ebp - 0x638]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x404001
cmp dword [ebp - 0x634], 0
jae 0x404001
mov edx, dword [ebp - 0x638]
cmp edx, dword [ebp + 0x10]
jae 0x404001
push 0x10
push 0x417724
push 0x41772c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x404329
mov dword [ebp - 0x214], 0
push 0x104
lea eax, [ebp - 0x424]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
cmp dword [0x41d4e4], 0
je 0x40408d
mov ecx, dword [ebp + 0x14]
xor edx, edx
mov dl, byte [ecx + 0x1cc]
cmp edx, 1
jne 0x40408d
push 0x5c
lea eax, [ebp - 0x424]
push eax
call fcn.0040a720
add esp, 8
mov dword [ebp - 0x630], eax
mov ecx, dword [ebp - 0x630]
add ecx, 1
mov dword [ebp - 0x630], ecx
mov edx, dword [ebp - 0x630]
mov byte [edx], 0
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x62c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40413d
lea edx, [ebp - 0x844]
push edx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x844]
push eax
call fcn.0040a910
add esp, 4
mov dword [ebp - 0x84c], eax
mov ecx, dword [ebp - 0x84c]
movsx edx, byte [ebp + ecx - 0x845]
cmp edx, 0x5c
je 0x4040db
push 0x417748
lea eax, [ebp - 0x844]
push eax
call fcn.0040a830
add esp, 8
push 0x5c
lea ecx, [ebp - 0x424]
push ecx
call fcn.0040a720
add esp, 8
mov dword [ebp - 0x630], eax
mov edx, dword [ebp - 0x630]
add edx, 1
push edx
lea eax, [ebp - 0x844]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x2e
lea ecx, [ebp - 0x844]
push ecx
call fcn.0040a720
add esp, 8
mov dword [ebp - 0x630], eax
mov edx, dword [ebp - 0x630]
mov byte [edx], 0
lea eax, [ebp - 0x844]
push eax
lea ecx, [ebp - 0x62c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x62c]
push edx
call fcn.0040a6ef
add esp, 4
lea eax, [ebp - 0x62c]
push eax
call fcn.0040a7e8
add esp, 4
mov ecx, 1
test ecx, ecx
je 0x404248
mov edx, dword [ebp - 0x214]
push edx
push 0x41774c
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x62c]
push ecx
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x417750
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.yztenc
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [ebp + 0x14]
add ecx, 0x1b8
push ecx
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x214]
add ecx, 1
mov dword [ebp - 0x214], ecx
push 0
push 0
push 2
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 0xffffffff
je 0x404230
jmp 0x404248
cmp dword [ebp - 0x214], 0xff
jle 0x404243
xor eax, eax
jmp 0x404329
jmp 0x40415b
mov eax, dword [ebp + 0x14]
xor ecx, ecx
mov cl, byte [eax + 0xd]
cmp ecx, 1
jne 0x40427e
push 0
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x20c]
push ecx
mov edx, dword [ebp - 0x63c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x210], eax
jmp 0x4042a2
push 0
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x63c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jne 0x4042d0
push 0x10
push str.Error
push str.Cant_write_file.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 0x63c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x404329
mov edx, dword [ebp + 0x14]
xor eax, eax
mov al, byte [edx + 0xd]
cmp eax, 1
jne 0x4042f1
push 0x8000
push 0
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [ebp - 0x63c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x41dbbc], 0
je 0x404313
mov eax, dword [0x41dbc0]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret