Function at 0x40ea60
Capabilities:
Create thread
Delete file
Encode data using xor
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x448
push ebx
push ebp
push esi
mov esi, dword [esp + 0x45c]
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push 0x40000000
push 3
push ebx
push 1
push 0x80000000
push esi
mov dword [esp + 0x38], 1
call edi
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x40eaa8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x448
ret
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, ebx
mov dword [esp + 0x2c], eax
jne 0x40eb10
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebp
push esi
lea eax, [esp + 0x4c]
push str._s.umz
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [esp + 0x48]
push ebx
push 0x40000080
push 2
push ebx
push ebx
push 0x40000000
push ecx
call edi
cmp eax, 0xffffffff
jne 0x40eafd
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x448
ret
push eax
call ebp
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x448
ret
cmp eax, 0xffffffff
jne 0x40eb29
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x448
ret
shr eax, 0xe
cmp eax, 0x7d0
mov dword [esp + 0x28], eax
jbe 0x40eb50
mov edx, dword [0x549030]
shr eax, 6
push eax
mov eax, dword [edx + 0xc0]
push ebx
push 0x406
push eax
jmp 0x40eb64
mov ecx, dword [0x549030]
push eax
push ebx
push 0x406
mov edx, dword [ecx + 0xc0]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x549030]
push ebx
push ebx
push 0x402
mov ecx, dword [eax + 0xc0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [esp + 0x250]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
lea eax, [esp + 0x4c]
push str._s.umz
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [esp + 0x48]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push ecx
call edi
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x40ebdd
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x448
ret
mov edx, dword [esp + 0x45c]
push edx
call fcn.0040e970
mov ecx, 0x1000
xor eax, eax
mov edi, 0x53cf40
push 0x4000
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [esp + 0x464]
push 0x53cf40
push 3
push eax
call fcn.00406a90
mov edx, dword [str.TeStSw]
mov ax, word [0x41e0b4]
xor ecx, ecx
mov edi, dword [esp + 0x24]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x44], edx
mov edx, dword [0x53cf40]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x4b], edx
mov dword [esp + 0x50], ecx
mov cl, byte [0x41e0ac]
mov word [esp + 0x48], ax
mov al, byte [0x53cf44]
xor edx, edx
add esp, 0x14
mov byte [esp + 0x36], cl
mov ecx, dword [esp + 0x2c]
mov dword [0x538f28], edx
mov byte [esp + 0x3b], al
mov dword [0x538f2c], edx
lea eax, [esp + 0x14]
mov dword [esp + 0x3c], ecx
push 0x538f28
mov dword [0x538f30], edx
push eax
lea ecx, [esp + 0x38]
push 0x10
mov dword [0x538f34], edx
push ecx
push edi
mov dword [0x538f38], edx
mov dword [0x538f30], ebx
mov dword [0x538f34], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
movsx eax, byte [0x53cf45]
cmp eax, 0xffffffff
mov dword [0x534e98], eax
jne 0x40ece4
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
lea edx, [esp + 0x48]
push edx
call dword [sym.imp.MSVCRT.dll__wremove]
add esp, 4
mov eax, 0xfffffffc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x448
ret
mov ecx, dword [0x549030]
push esi
push 0x3eb
call sub.MFC42u.DLL_CWnd::SetDlgItemTextW
xor eax, eax
xor ecx, ecx
mov dword [0x538ef8], eax
xor edx, edx
mov dword [0x538efc], eax
mov dword [0x538f10], ecx
mov dword [0x538f00], eax
mov dword [0x538f28], edx
mov dword [0x538f04], eax
mov dword [0x538f14], ecx
mov dword [0x538f08], eax
mov dword [0x538f2c], edx
lea eax, [esp + 0x18]
push 0x538ef8
mov dword [0x538f18], ecx
mov dword [0x538f30], edx
push eax
push 0x4000
mov dword [0x538f1c], ecx
mov dword [0x538f34], edx
push 0x541028
push ebp
mov dword [0x538f20], ecx
mov dword [0x538f38], edx
mov dword [0x538f00], ebx
mov dword [0x538f04], ebx
xor esi, esi
mov dword [esp + 0x38], 0x10
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x540f48
call fcn.0040de90
mov eax, dword [esp + 0x2c]
add esp, 4
cmp eax, ebx
mov dword [0x54101c], 0x4000
mov dword [0x541020], 1
mov dword [esp + 0x20], ebx
jbe 0x40f05d
mov ecx, dword [0x549030]
cmp dword [ecx + 0xb38], ebx
jne 0x40f059
mov edx, dword [esp + 0x45c]
mov ecx, 0x1000
xor eax, eax
mov edi, 0x53cf40
rep stosd dword es:[edi], eax
push 0x200
push 0x541028
push 2
push edx
stosb byte es:[edi], al
call fcn.00406ba0
add esp, 0x10
cmp eax, 0xffffffff
je 0x40effd
mov edi, 1
mov eax, dword [esp + 0x45c]
push 0x4000
push 0x53cf40
push 3
push eax
call fcn.00406a90
add esp, 0x10
cmp eax, 0xffffffff
je 0x40f02b
mov eax, 0x3ff6
cmp byte [eax + 0x53cf40], 0x5a
je 0x40ee32
xor edi, edi
inc eax
cmp eax, 0x4000
jb 0x40ee27
cmp edi, ebx
jne 0x40edfd
cmp dword [0x541020], ebx
je 0x40effb
mov eax, dword [esp + 0x1c]
add esi, 0x4000
cmp eax, ebx
mov dword [esp + 0x40], esi
je 0x40eeaa
lea ecx, [esp + 0x18]
push 1
push ecx
push 0x538ef8
push ebp
mov dword [0x541018], 0x541028
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ecx, 0x1000
xor eax, eax
mov edi, 0x54502c
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
push 0x538f10
push edx
push 0x4000
mov dword [0x538f18], esi
stosb byte es:[edi], al
mov dword [0x538f1c], ebx
push 0x54502c
jmp 0x40eef6
lea eax, [esp + 0x18]
push 1
push eax
push 0x538f10
push ebp
mov dword [0x541018], 0x54502c
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ecx, 0x1000
xor eax, eax
mov edi, 0x541028
push 0x538ef8
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
mov dword [0x538f00], esi
push ecx
push 0x4000
stosb byte es:[edi], al
mov dword [0x538f04], ebx
push 0x541028
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea edx, [esp + 0x44]
push edx
push ebx
push 0x540fb0
push 0x40ea30
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [esp + 0x1c], ebx
je 0x40ef3b
xor eax, eax
mov cl, byte [eax + 0x541028]
mov dl, byte [eax + 0x53cf40]
xor cl, dl
mov byte [eax + 0x538f3c], cl
inc eax
cmp eax, 0x4000
jb 0x40ef1d
jmp 0x40ef59
xor eax, eax
mov dl, byte [eax + 0x54502c]
mov cl, byte [eax + 0x53cf40]
xor dl, cl
mov byte [eax + 0x538f3c], dl
inc eax
cmp eax, 0x4000
jb 0x40ef3d
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 1
push eax
push 0x538f28
push esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0x14]
push 0x538f28
push ecx
push 0x4000
push 0x538f3c
push esi
mov dword [0x538f30], edi
mov dword [0x538f34], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
add edi, 0x4000
xor edx, edx
cmp ecx, ebx
sete dl
cmp esi, 0x7d0
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], edx
push ebx
jbe 0x40efc8
shr eax, 6
mov ecx, dword [0x549030]
push eax
push 0x402
mov edx, dword [ecx + 0xc0]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x10]
inc eax
cmp eax, esi
mov dword [esp + 0x20], eax
jae 0x40f059
mov esi, dword [esp + 0x40]
jmp 0x40edb2
jmp 0x40effb
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.MSVCRT.dll__wremove]
add esp, 4
mov eax, 0xfffffffd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x448
ret
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.MSVCRT.dll__wremove]
add esp, 4
mov eax, 0xfffffffd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x448
ret
cmp dword [esp + 0x28], ebx
je 0x40f072
lea ecx, [esp + 0x14]
push 1
push ecx
push 0x538f28
push edi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov esi, dword [esp + 0x2c]
and esi, 0x3fff
je 0x40f20a
mov edx, dword [esp + 0x45c]
push 0x200
push 0x541028
push 2
push edx
call fcn.00406ba0
mov eax, dword [esp + 0x46c]
push 0x4000
push 0x53cf40
push 3
push eax
mov edi, 1
call fcn.00406a90
add esp, 0x20
cmp eax, 0xffffffff
je 0x40f0fe
mov eax, 0x3ff6
cmp byte [eax + 0x53cf40], 0x5a
je 0x40f0d1
xor edi, edi
inc eax
cmp eax, 0x4000
jb 0x40f0c6
cmp edi, ebx
je 0x40f115
mov ecx, dword [esp + 0x45c]
push 0x4000
push 0x53cf40
push 3
push ecx
call fcn.00406a90
add esp, 0x10
cmp eax, 0xffffffff
jne 0x40f0c1
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffffd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x448
ret
mov edi, dword [esp + 0x1c]
push 1
cmp edi, ebx
je 0x40f142
lea edx, [esp + 0x1c]
push edx
push 0x538ef8
push ebp
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp dword [0x541020], ebx
jne 0x40f13a
jmp 0x40f138
push esi
push 0x541028
jmp 0x40f163
lea eax, [esp + 0x1c]
push eax
push 0x538f10
push ebp
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp dword [0x541020], ebx
jne 0x40f15d
jmp 0x40f15b
push esi
push 0x54502c
push 0x540f48
call fcn.0040e220
mov ecx, dword [esp + 0x30]
add esp, 0xc
cmp edi, ebx
mov dword [0x538f30], ecx
mov dword [0x538f34], ebx
je 0x40f1b5
xor eax, eax
cmp esi, ebx
jbe 0x40f1a3
mov dl, byte [eax + 0x53cf40]
mov cl, byte [eax + 0x541028]
xor cl, dl
mov byte [eax + 0x541028], cl
inc eax
cmp eax, esi
jb 0x40f18a
lea eax, [esp + 0x14]
push 0x538f28
push eax
push esi
push 0x541028
jmp 0x40f1e4
xor eax, eax
cmp esi, ebx
jbe 0x40f1d4
mov dl, byte [eax + 0x53cf40]
mov cl, byte [eax + 0x54502c]
xor cl, dl
mov byte [eax + 0x54502c], cl
inc eax
cmp eax, esi
jb 0x40f1bb
lea eax, [esp + 0x14]
push 0x538f28
push eax
push esi
push 0x54502c
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push 1
push edx
push 0x538f28
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov edi, dword [esp + 0x10]
push 0x540f48
push 0x538f3c
call fcn.0040e350
mov ecx, dword [esp + 0x2c]
add esp, 8
lea edx, [esp + 0x14]
add ecx, esi
push 0x538f28
push edx
push 0x20
push 0x538f3c
push edi
mov dword [0x538f30], ecx
mov dword [0x538f34], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x14]
push 1
push eax
push 0x538f28
push edi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ecx, dword [0x549030]
push ebx
push ebx
push 0x402
mov edx, dword [ecx + 0xc0]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
mov eax, dword [esp + 0x45c]
push 0x4000
push 0x541028
push 8
push eax
mov byte [0x541028], 0x40
mov byte [0x541029], bl
call fcn.00406ba0
add esp, 0x10
push ebp
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x448
ret