Function at 0x1004a3fa
Capabilities:
Delete file
Resolve function by parsing pe exports
Write file on windows

Disassembly:
sub esp, 0x464
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0x488]
lea eax, [ebp - 1]
cmp eax, 0x1f
ja case.0x1004a3f3.2
movzx eax, byte [eax + 0x1004aa34]
jmp dword [eax*4 + 0x1004aa2c]
mov eax, 1
push ebx
push esi
push edi
cmp ebp, 8
jg 0x1004a472
mov esi, eax
mov ecx, ebp
shl esi, cl
mov eax, ebp
lea ecx, [esi*4 + 0x36]
sub eax, 1
je 0x1004a445
sub eax, 3
je 0x1004a436
mov edx, dword [esp + 0x480]
sub eax, 4
jne 0x1004a430
mov eax, edx
jmp 0x1004a45f
mov eax, dword [esp + 0x18]
jmp 0x1004a45f
mov eax, dword [esp + 0x480]
inc eax
cdq
sub eax, edx
sar eax, 1
jmp 0x1004a458
mov eax, dword [esp + 0x480]
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
mov edx, dword [esp + 0x480]
lea ebx, [eax + 3]
and ebx, 0xfffffffc
mov dword [esp + 0x14], ebx
jne 0x1004a494
mov ebx, 4
jmp 0x1004a490
mov edx, dword [esp + 0x480]
mov ebx, ebp
mov esi, dword [esp + 0x18]
mov ecx, 0x36
shr ebx, 3
imul ebx, edx
add ebx, 3
and ebx, 0xfffffffc
mov dword [esp + 0x14], ebx
mov edi, ebx
mov dword [esp + 0x46], ecx
imul edi, dword [esp + 0x484]
mov eax, 0x4d42
xor ebx, ebx
mov word [esp + 0x3c], ax
xorps xmm0, xmm0
mov dword [esp + 0x42], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
lea eax, [edi + ecx]
mov dword [esp + 0x24], ebx
mov ecx, dword [esp + 0x484]
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x54], ecx
mov ecx, 1
mov word [esp + 0x58], cx
mov ecx, dword [esp + 0x478]
mov dword [esp + 0x3e], eax
mov dword [esp + 0x4c], 0x28
mov dword [esp + 0x50], edx
mov word [esp + 0x5a], bp
mov dword [esp + 0x60], edi
movq qword [esp + 0x1c], xmm0
test ecx, ecx
je 0x1004a54d
push 0
push pe_nt_image_headers32
push 2
push 0
push 1
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ecx, ecx
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
setne cl
mov dword [esp + 0x10], ecx
jne 0x1004a561
mov ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
add esp, 0x464
ret
push 1
push eax
call fcn.1004ea60
mov dword [esp + 0x20], eax
test eax, eax
je 0x1004aa11
push 0xe
lea eax, [esp + 0x40]
xor ecx, ecx
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x18], ecx
push eax
call fcn.1004aa60
add esp, 0xc
test eax, eax
je 0x1004a9b1
push 0x28
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.1004aa60
add esp, 0xc
test eax, eax
je 0x1004a9b1
cmp ebp, 1
je 0x1004a831
cmp ebp, 4
je 0x1004a831
cmp ebp, 8
je 0x1004a831
mov eax, dword [esp + 0x498]
cmp eax, 0x18
je 0x1004a5cb
cmp eax, 0x20
jne 0x1004a605
test byte [esp + 0x48c], 2
je 0x1004a605
cmp dword [esp + 0x488], ebx
jne 0x1004a605
push edi
push dword [esp + 0x480]
lea eax, [esp + 0x24]
push eax
call fcn.1004aa60
add esp, 0xc
test eax, eax
je 0x1004a9b1
mov ebx, 1
jmp 0x1004a9b5
push ebx
push 8
push dword [0x101df4f0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0x28], edx
test edx, edx
je 0x1004a9b1
mov ecx, 1
xor esi, esi
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x484]
mov dword [esp + 0x30], esi
test ecx, ecx
jle 0x1004a818
mov eax, dword [esp + 0x48c]
lea edi, [ecx - 1]
and eax, 2
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x24]
add eax, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x38], 0
mov eax, esi
mov ecx, edx
cmove eax, edi
mov edi, dword [esp + 0x47c]
imul eax, dword [esp + 0x488]
add edi, eax
mov eax, dword [esp + 0x480]
test eax, eax
jle 0x1004a791
cmp dword [esp + 0x498], 0x20
jne 0x1004a758
mov ebx, dword [esp + 0x494]
mov ebp, eax
movzx esi, byte [edi + 2]
lea edi, [edi + 4]
movzx eax, byte [edi - 1]
sub esi, 0xff
imul esi, eax
mov eax, 0x80808081
add esi, 0xfe01
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [ecx + 2], al
movzx esi, byte [edi - 3]
movzx eax, byte [edi - 1]
sub esi, 0xff
imul esi, eax
mov eax, 0x80808081
add esi, 0xfe01
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [ecx + 1], al
movzx esi, byte [edi - 4]
movzx eax, byte [edi - 1]
sub esi, 0xff
imul esi, eax
mov eax, 0x80808081
add esi, 0xfe01
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [ecx], al
cmp ebx, 0x20
jne 0x1004a73b
mov byte [ecx + 3], 0
add ecx, 4
jmp 0x1004a73e
add ecx, 3
sub ebp, 1
jne 0x1004a6a4
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x494]
mov esi, dword [esp + 0x30]
jmp 0x1004a78d
mov edx, eax
nop word [eax + eax]
movzx eax, byte [edi + 2]
lea edi, [edi + 3]
mov byte [ecx + 2], al
movzx eax, byte [edi - 2]
mov byte [ecx + 1], al
movzx eax, byte [edi - 3]
mov byte [ecx], al
cmp ebp, 0x20
jne 0x1004a785
mov byte [ecx + 3], 0
add ecx, 4
jmp 0x1004a788
add ecx, 3
sub edx, 1
jne 0x1004a760
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1004a7cc
push 0
lea ecx, [esp + 0x1c]
push ecx
push ebx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1004a7b3
cmp dword [esp + 0x18], ebx
je 0x1004a7e1
mov edx, dword [esp + 0x28]
xor ebx, ebx
push edx
push ebx
push dword [0x101df4f0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1004a9b5
mov edi, dword [esp + 0x2c]
push ebx
push edx
push edi
call fcn.10025090
add esp, 0xc
add edi, ebx
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x34]
inc esi
mov edx, dword [esp + 0x28]
dec edi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], edi
cmp esi, dword [esp + 0x484]
jl 0x1004a661
mov ebx, dword [esp + 0x10]
push edx
push 0
push dword [0x101df4f0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1004a9b5
push edx
push 0
push dword [0x101df4f0]
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1004a9b5
push dword [esp + 0x490]
mov eax, dword [esp + 0x484]
push ebp
push dword [esp + 0x490]
mov ebp, dword [esp + 0x490]
push dword [esp + 0x4a4]
push ebp
push eax
push dword [esp + 0x494]
call fcn.1004b02f
add esp, 0x1c
mov dword [esp + 0x14], eax
xor edx, edx
test esi, esi
jle 0x1004a893
lea ecx, [eax + 0x51]
movzx eax, byte [ecx + 1]
lea ecx, [ecx + 4]
mov byte [esp + edx*4 + 0x76], al
movzx eax, byte [ecx - 4]
mov byte [esp + edx*4 + 0x75], al
movzx eax, byte [ecx - 5]
mov byte [esp + edx*4 + 0x74], al
inc edx
cmp edx, esi
jl 0x1004a873
lea eax, [esi*4]
push eax
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.1004aa60
mov ecx, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
mov eax, 1
cmovne ecx, eax
test byte [esp + 0x48c], 2
mov dword [esp + 0x10], ecx
je 0x1004a947
xor esi, esi
test ebp, ebp
jle 0x1004a99f
mov edi, dword [esp + 0x20]
add edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
nop
push esi
push dword [esp + 0x18]
call fcn.1004b23f
add esp, 8
test ebp, ebp
je 0x1004a91e
push 0
lea ecx, [esp + 0x1c]
push ecx
push ebx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1004a90b
cmp dword [esp + 0x18], ebx
je 0x1004a92b
push dword [esp + 0x14]
xor ebx, ebx
call fcn.1004b1f3
add esp, 4
jmp 0x1004a9b5
push ebx
push eax
push edi
call fcn.10025090
add esp, 0xc
add edi, ebx
inc esi
cmp esi, dword [esp + 0x484]
jl 0x1004a8e0
push dword [esp + 0x14]
mov ebx, dword [esp + 0x14]
call fcn.1004b1f3
add esp, 4
jmp 0x1004a9b5
lea esi, [ebp - 1]
test esi, esi
js 0x1004a99f
mov edi, dword [esp + 0x20]
add edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
nop word [eax + eax]
push esi
push dword [esp + 0x18]
call fcn.1004b23f
add esp, 8
test ebp, ebp
je 0x1004a98d
push 0
lea ecx, [esp + 0x1c]
push ecx
push ebx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1004a90b
cmp dword [esp + 0x18], ebx
jne 0x1004a90b
jmp 0x1004a99a
push ebx
push eax
push edi
call fcn.10025090
add esp, 0xc
add edi, ebx
sub esi, 1
jns 0x1004a960
push dword [esp + 0x14]
mov ebx, dword [esp + 0x14]
call fcn.1004b1f3
add esp, 4
jmp 0x1004a9b5
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x478]
test esi, esi
je 0x1004a9e6
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x1004a540
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
add esp, 0x464
ret
test ebx, ebx
je 0x1004a9fb
mov ebx, dword [esp + 0x20]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x464
ret
push dword [esp + 0x20]
call fcn.1004eb10
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
add esp, 0x464
ret
pop edi
xor ebx, ebx
pop esi
mov eax, ebx
pop ebx
pop ebp
add esp, 0x464
ret
xor eax, eax
pop ebp
add esp, 0x464
ret