Function at 0x408190
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 0x228
push ebx
push ebp
push esi
xor ebp, ebp
push 0x4382cc
push 0x44234c
xor bl, bl
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], ebp
call fcn.00421920
push 0x43621c
push str.FontSize
push ebp
push str.ROCred
push ebp
push 0x44234c
call fcn.00421150
push ebp
push 0x44234c
call fcn.004214f0
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
push str.CONFIG
push 0xa
push ebp
call fcn.004178e0
test eax, eax
je 0x4082a5
xor edx, edx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x1d], edx
lea eax, [esp + 0x24]
mov dword [esp + 0x21], edx
push eax
mov word [esp + 0x29], dx
push ecx
mov byte [esp + 0x2f], dl
mov edx, dword [esp + 0x1c]
push edx
mov byte [esp + 0x28], 0
call fcn.0041cf40
test al, al
je 0x40828f
push 8
lea eax, [esp + 0x20]
push str.bvio:
push eax
call fcn.0040e810
push 0x4382a4
push 0x44234c
call fcn.00421910
lea ecx, [esp + 0x1c]
push ecx
push 0x44234c
call fcn.00421640
test al, al
je 0x40826e
push ebp
push 0x408510
push 0x44234c
call fcn.00420fc0
mov bl, 1
push 0x4382cc
push 0x44234c
call fcn.00421910
lea edx, [esp + 0x24]
push edx
call fcn.0041cd70
test bl, bl
jne 0x4083a2
push 0x44234c
call fcn.00421940
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x228
ret
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0x436204
push 0xa
push ebp
call fcn.004178e0
test eax, eax
je 0x4083a2
lea edx, [esp + 0x130]
push 0x104
push edx
call fcn.00417660
test eax, eax
je 0x40838c
lea eax, [esp + 0x2c]
push 0x104
push eax
push ebp
lea ecx, [esp + 0x13c]
push str.rcd
push ecx
call fcn.004174a0
test eax, eax
je 0x40838c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40838c
push ebp
push ebp
push 3
push ebp
push ebp
lea edx, [esp + 0x40]
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40837d
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push ebp
push eax
push ecx
push edx
push esi
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
je 0x408377
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x2c]
push eax
push 0x44234c
call fcn.00421640
test al, al
je 0x40837d
push ebp
push 0x408510
push 0x44234c
call fcn.00420fc0
mov bl, 1
jmp 0x40837d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test bl, bl
jne 0x4083a2
push 0x44234c
call fcn.00421940
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x228
ret
push 0x4361f8
push ebp
push 0x104
push 0x442248
push ebp
call fcn.004172b0
test al, al
je 0x4083dc
push str.PolicyNoUserConfigList
call fcn.00408150
add esp, 4
test al, al
je 0x4083e8
push 0x442248
push 0x44234c
call fcn.00421640
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x228
ret
xor edx, edx
push edi
mov dword [esp + 0x24], edx
lea eax, [esp + 0x20]
mov dword [esp + 0x28], edx
push 0x4382cc
push eax
xor bl, bl
mov dword [esp + 0x18], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x34], edx
call fcn.00421920
lea ecx, [esp + 0x20]
push 0x442248
push ecx
call fcn.00421640
push str.PolicyNoUserConfigList
call fcn.004080e0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
lea eax, [esp + 0x10]
not ecx
push eax
push ecx
push edx
call fcn.00422fb0
test al, al
je 0x4084e7
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ebp
push ecx
push ebp
push ebp
push 0x3b
push edx
mov dword [esp + 0x2c], ebp
call fcn.0040e8b0
mov eax, dword [esp + 0x14]
lea ecx, [eax*4]
push ecx
call fcn.00422aa0
mov edi, eax
cmp edi, ebp
je 0x4084d9
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push ebp
push edx
push eax
push edi
push 0x3b
push ecx
call fcn.0040e8b0
test al, al
je 0x4084d3
mov eax, dword [esp + 0x14]
xor esi, esi
cmp eax, ebp
jbe 0x4084c2
mov eax, dword [edi + esi*4]
cmp byte [eax], 0x5f
je 0x4084b9
push eax
push ebp
push str.ROCred
lea edx, [esp + 0x2c]
push ebp
push edx
call fcn.00421420
mov eax, dword [esp + 0x14]
inc esi
cmp esi, eax
jb 0x40849f
lea eax, [esp + 0x20]
push eax
push 0x44234c
call fcn.00421480
mov bl, al
push edi
call fcn.00422f50
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], ebp
push eax
call fcn.00422f50
lea ecx, [esp + 0x20]
push ecx
call fcn.00421940
test bl, bl
pop edi
jne 0x4083dc
push 0x44234c
call fcn.00421940
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x228
ret