Function at 0x408600
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 0x228
push ebx
push ebp
push esi
xor ebp, ebp
push 0x43a634
push 0x444364
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], ebp
call fcn.004235d0
push 0x438308
push str.FontSize
push ebp
push str.ROCred
push ebp
push 0x444364
call fcn.00422e00
push ebp
push 0x444364
call fcn.004231a0
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
push str.CONFIG
push 0xa
push ebp
call fcn.00419200
test eax, eax
je 0x408714
xor edx, edx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x1d], edx
lea eax, [esp + 0x24]
mov dword [esp + 0x21], edx
push eax
mov word [esp + 0x29], dx
xor bl, bl
mov byte [esp + 0x2b], dl
mov edx, dword [esp + 0x18]
push ecx
push edx
mov byte [esp + 0x28], bl
call fcn.0041eb30
test al, al
je 0x4086fe
push 8
lea eax, [esp + 0x20]
push str.bvio:
push eax
call fcn.0040f190
push 0x43a60c
push 0x444364
call fcn.004235c0
lea ecx, [esp + 0x1c]
push ecx
push 0x444364
call fcn.004232f0
test al, al
je 0x4086dd
push ebp
push 0x408a00
push 0x444364
call fcn.00422c70
mov bl, 1
push 0x43a634
push 0x444364
call fcn.004235c0
lea edx, [esp + 0x24]
push edx
call fcn.0041e960
test bl, bl
jne 0x408813
push 0x444364
call fcn.004235f0
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x228
ret
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0x4382f0
push 0xa
push ebp
call fcn.00419200
test eax, eax
je 0x408813
lea edx, [esp + 0x130]
push 0x104
push edx
xor bl, bl
call fcn.00418f50
test eax, eax
je 0x4087fd
lea eax, [esp + 0x2c]
push 0x104
push eax
push ebp
lea ecx, [esp + 0x13c]
push str.rcd
push ecx
call fcn.00418d60
test eax, eax
je 0x4087fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4087fd
push ebp
push ebp
push 3
push ebp
push ebp
lea edx, [esp + 0x40]
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4087ee
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push ebp
push eax
push ecx
push edx
push esi
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
je 0x4087e8
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x2c]
push eax
push 0x444364
call fcn.004232f0
test al, al
je 0x4087ee
push ebp
push 0x408a00
push 0x444364
call fcn.00422c70
mov bl, 1
jmp 0x4087ee
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test bl, bl
jne 0x408813
push 0x444364
call fcn.004235f0
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x228
ret
push 0x4382e4
push ebp
push 0x104
push 0x444260
push ebp
call fcn.00418b60
test al, al
je 0x408851
push str.PolicyNoUserConfigList
call fcn.004085b0
add esp, 4
test al, al
je 0x4088cf
push 0x444260
push 0x444364
call fcn.004232f0
call fcn.00408a40
test al, al
je 0x4088c3
lea edx, [esp + 0x130]
push 0x104
push edx
push 1
push ebp
push 0x4382e4
push str.dev
call fcn.00418750
mov esi, eax
cmp esi, 0xffffffff
je 0x4088c3
push 0x15e
push 1
push 0xd
push 2
push str.__Elurair__Version__u._u._u._u_r_n__Developer_Configuration_Dump_r_n__r_n_r_n_________r_n_r_n
push esi
call fcn.004195c0
add esp, 0x18
push esi
push 0x408a60
push 0x444364
call fcn.00422c70
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push ebp
lea eax, [esp + 0x138]
push ebp
push eax
push ebp
push ebp
call fcn.0041b0b0
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x228
ret
xor edx, edx
push edi
mov dword [esp + 0x24], edx
lea eax, [esp + 0x20]
mov dword [esp + 0x28], edx
push 0x43a634
push eax
xor bl, bl
mov dword [esp + 0x18], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x34], edx
call fcn.004235d0
lea ecx, [esp + 0x20]
push 0x444260
push ecx
call fcn.004232f0
push str.PolicyNoUserConfigList
call fcn.00408540
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
lea eax, [esp + 0x10]
not ecx
push eax
push ecx
push edx
call fcn.00424c80
test al, al
je 0x4089ce
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ebp
push ecx
push ebp
push ebp
push 0x3b
push edx
mov dword [esp + 0x2c], ebp
call fcn.0040f230
mov eax, dword [esp + 0x14]
lea ecx, [eax*4]
push ecx
call fcn.00424750
mov edi, eax
cmp edi, ebp
je 0x4089c0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push ebp
push edx
push eax
push edi
push 0x3b
push ecx
call fcn.0040f230
test al, al
je 0x4089ba
mov eax, dword [esp + 0x14]
xor esi, esi
cmp eax, ebp
jbe 0x4089a9
mov eax, dword [edi + esi*4]
cmp byte [eax], 0x5f
je 0x4089a0
push eax
push ebp
push str.ROCred
lea edx, [esp + 0x2c]
push ebp
push edx
call fcn.004230d0
mov eax, dword [esp + 0x14]
inc esi
cmp esi, eax
jb 0x408986
lea eax, [esp + 0x20]
push eax
push 0x444364
call fcn.00423130
mov bl, al
push edi
call fcn.00424c20
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], ebp
push eax
call fcn.00424c20
lea ecx, [esp + 0x20]
push ecx
call fcn.004235f0
test bl, bl
pop edi
jne 0x408851
push 0x444364
call fcn.004235f0
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x228
ret