Function at 0x40e280
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x14
mov byte [0x417de8], 1
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebp
push 0x80
push 2
push ebp
push ebp
push 0x40000000
push str.tmp54321.jpg
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x40e2bd
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x1c]
push ebp
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
push 0x80
push 3
push ebp
push ebp
push 0x80000000
push str.tmp54321.jpg
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40e302
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
lea eax, [esp + 0x1c]
push ebp
push eax
lea ecx, [esp + 0x1c]
push 4
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
cmp al, 0xff
jne 0x40e4ad
cmp ah, 0xd8
jne 0x40e4ad
cmp byte [esp + 0x16], 0xff
jne 0x40e4ad
cmp byte [esp + 0x17], 0xe0
jne 0x40e4ad
push ebp
push ebp
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
call sym.mmvem.exe__Init_JPEG_Decompressor_4
lea edx, [esp + 0x20]
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
call sym.mmvem.exe__Start_JPEG_Decompress_16
cmp dword [esp + 0x20], ebp
je 0x40e380
call sym.mmvem.exe__End_JPEG_Decompress_0
call sym.mmvem.exe__Close_JPEG_Decompressor_0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea esi, [eax + eax*2 + 3]
mov eax, dword [0x417dec]
and esi, 0xfffc
cmp eax, ebp
jne 0x40e423
push 0x28
push 0x40
call edi
mov edx, esi
mov dword [0x417dec], eax
imul edx, dword [esp + 0x10]
mov dword [eax + 0x14], edx
mov eax, dword [0x417dec]
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov edx, dword [0x417dec]
mov eax, dword [esp + 0x18]
mov dword [edx + 4], eax
mov ecx, dword [0x417dec]
mov word [ecx + 0xc], 1
mov edx, dword [0x417dec]
mov word [edx + 0xe], 0x18
mov eax, dword [0x417dec]
mov dword [eax], 0x28
mov ecx, dword [0x417dec]
mov eax, 0xf61
mov dword [ecx + 0x10], ebp
mov edx, dword [0x417dec]
mov dword [edx + 0x18], eax
mov ecx, dword [0x417dec]
mov dword [ecx + 0x1c], eax
mov edx, dword [0x417dec]
mov dword [edx + 0x20], ebp
mov eax, dword [0x417dec]
mov dword [eax + 0x24], ebp
cmp dword [0x417df0], ebp
jne 0x40e43e
mov ecx, dword [0x417dec]
mov edx, dword [ecx + 0x14]
push edx
push 0x40
call edi
mov dword [0x417df0], eax
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x40e461
xor edi, edi
mov eax, dword [0x417df0]
lea ecx, [edi + eax]
push ecx
call sym.mmvem.exe__Decompress_One_Line_4
mov eax, dword [esp + 0x10]
inc ebp
add edi, esi
cmp ebp, eax
jl 0x40e448
call sym.mmvem.exe__End_JPEG_Decompress_0
call sym.mmvem.exe__Close_JPEG_Decompressor_0
mov eax, dword [0x417dec]
mov edx, dword [0x417df0]
push 0
push eax
push edx
push 4
push eax
mov eax, dword [esp + 0x3c]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.tmp54321.jpg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, esi
pop edi
pop esi
pop ebp
mov byte [0x417de8], 0
pop ebx
add esp, 0x14
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x14
ret