Function at 0x408650
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 0x228
push ebx
push ebp
push esi
xor ebp, ebp
push 0x43a694
push 0x4443a4
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], ebp
call fcn.00423cc0
push 0x438328
push str.FontSize
push ebp
push str.ROCred
push ebp
push 0x4443a4
call fcn.004234f0
push ebp
push 0x4443a4
call fcn.00423890
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0x438320
push 0xa
push ebp
call fcn.00419890
test eax, eax
je 0x408764
xor edx, edx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x1d], edx
lea eax, [esp + 0x24]
mov dword [esp + 0x21], edx
push eax
mov word [esp + 0x29], dx
xor bl, bl
mov byte [esp + 0x2b], dl
mov edx, dword [esp + 0x18]
push ecx
push edx
mov byte [esp + 0x28], bl
call fcn.0041f210
test al, al
je 0x40874e
push 8
lea eax, [esp + 0x20]
push str.bvio:
push eax
call fcn.0040f1e0
push 0x43a66c
push 0x4443a4
call fcn.00423cb0
lea ecx, [esp + 0x1c]
push ecx
push 0x4443a4
call fcn.004239e0
test al, al
je 0x40872d
push ebp
push 0x408a50
push 0x4443a4
call fcn.00423360
mov bl, 1
push 0x43a694
push 0x4443a4
call fcn.00423cb0
lea edx, [esp + 0x24]
push edx
call fcn.0041f040
test bl, bl
jne 0x408863
push 0x4443a4
call fcn.00423ce0
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x228
ret
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0x438310
push 0xa
push ebp
call fcn.00419890
test eax, eax
je 0x408863
lea edx, [esp + 0x130]
push 0x104
push edx
xor bl, bl
call fcn.004195e0
test eax, eax
je 0x40884d
lea eax, [esp + 0x2c]
push 0x104
push eax
push ebp
lea ecx, [esp + 0x13c]
push str.rcd
push ecx
call fcn.004193f0
test eax, eax
je 0x40884d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40884d
push ebp
push ebp
push 3
push ebp
push ebp
lea edx, [esp + 0x40]
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40883e
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push ebp
push eax
push ecx
push edx
push esi
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
je 0x408838
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x2c]
push eax
push 0x4443a4
call fcn.004239e0
test al, al
je 0x40883e
push ebp
push 0x408a50
push 0x4443a4
call fcn.00423360
mov bl, 1
jmp 0x40883e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test bl, bl
jne 0x408863
push 0x4443a4
call fcn.00423ce0
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x228
ret
push 0x438304
push ebp
push 0x104
push 0x4442a0
push ebp
call fcn.004191f0
test al, al
je 0x4088a1
push str.PolicyNoUserConfigList
call fcn.00408600
add esp, 4
test al, al
je 0x40891f
push 0x4442a0
push 0x4443a4
call fcn.004239e0
call fcn.00408a90
test al, al
je 0x408913
lea edx, [esp + 0x130]
push 0x104
push edx
push 1
push ebp
push 0x438304
push str.dev
call fcn.00418de0
mov esi, eax
cmp esi, 0xffffffff
je 0x408913
push 0x162
push 2
push 0xd
push 2
push str.__Elurair__Version__u._u._u._u_r_n__Developer_Configuration_Dump_r_n__r_n_r_n_________r_n_r_n
push esi
call fcn.00419c50
add esp, 0x18
push esi
push 0x408ab0
push 0x4443a4
call fcn.00423360
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push ebp
lea eax, [esp + 0x138]
push ebp
push eax
push ebp
push ebp
call fcn.0041b760
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x228
ret
xor edx, edx
push edi
mov dword [esp + 0x24], edx
lea eax, [esp + 0x20]
mov dword [esp + 0x28], edx
push 0x43a694
push eax
xor bl, bl
mov dword [esp + 0x18], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x34], edx
call fcn.00423cc0
lea ecx, [esp + 0x20]
push 0x4442a0
push ecx
call fcn.004239e0
push str.PolicyNoUserConfigList
call fcn.00408590
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
lea eax, [esp + 0x10]
not ecx
push eax
push ecx
push edx
call fcn.00425370
test al, al
je 0x408a1e
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ebp
push ecx
push ebp
push ebp
push 0x3b
push edx
mov dword [esp + 0x2c], ebp
call fcn.0040f280
mov eax, dword [esp + 0x14]
lea ecx, [eax*4]
push ecx
call fcn.00424e40
mov edi, eax
cmp edi, ebp
je 0x408a10
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push ebp
push edx
push eax
push edi
push 0x3b
push ecx
call fcn.0040f280
test al, al
je 0x408a0a
mov eax, dword [esp + 0x14]
xor esi, esi
cmp eax, ebp
jbe 0x4089f9
mov eax, dword [edi + esi*4]
cmp byte [eax], 0x5f
je 0x4089f0
push eax
push ebp
push str.ROCred
lea edx, [esp + 0x2c]
push ebp
push edx
call fcn.004237c0
mov eax, dword [esp + 0x14]
inc esi
cmp esi, eax
jb 0x4089d6
lea eax, [esp + 0x20]
push eax
push 0x4443a4
call fcn.00423820
mov bl, al
push edi
call fcn.00425310
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], ebp
push eax
call fcn.00425310
lea ecx, [esp + 0x20]
push ecx
call fcn.00423ce0
test bl, bl
pop edi
jne 0x4088a1
push 0x4443a4
call fcn.00423ce0
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x228
ret