Function at 0x401380
Capabilities:
Delete directory
Write file on windows

Disassembly:
mov eax, 0x19a58
call fcn.00410a00
mov eax, dword [0x419184]
xor eax, esp
mov dword [esp + 0x19a54], eax
mov eax, dword [esp + 0x19a5c]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [edi]
xor ebx, ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], eax
cmp ecx, ebx
je 0x4017bc
cmp dword [ecx], 1
mov eax, dword [eax]
je 0x4013cc
mov dword [0x41b468], 0x80000
jmp 0x4013db
mov ecx, dword [ecx + 4]
mov esi, ecx
call fcn.00405270
mov dword [0x41b468], eax
mov eax, dword [edi]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x30], ecx
mov word [esp + 0x34], dx
mov dword [esp + 0x25c], ebx
cmp eax, ebx
jne 0x401405
mov edi, 0x10000
mov dword [0x41b468], edi
jmp 0x401492
cmp dword [eax], 1
je 0x401416
mov dword [0x41b468], 0x80000
jmp 0x40148d
mov esi, dword [eax + 4]
mov edi, dword [esi]
or ebp, 0xffffffff
cmp dword [edi + 4], ebp
jg 0x40142a
mov eax, 0x10000
jmp 0x401488
cmp dword [esi + 4], ebp
je 0x401434
call fcn.004050c0
mov eax, dword [esi]
mov dword [esi + 4], ebp
mov ecx, dword [eax + 4]
xor edx, edx
mov dword [esp + 0x30], ecx
mov word [esp + 0x34], dx
mov dword [esp + 0x23c], ebx
mov dword [esp + 0x240], ebx
mov dword [esp + 0x244], ebx
mov dword [esp + 0x248], ebx
mov dword [esp + 0x24c], ebx
mov dword [esp + 0x250], ebx
mov dword [esp + 0x254], ebx
mov dword [esp + 0x258], ebx
mov dword [esp + 0x25c], ebx
xor eax, eax
mov dword [0x41b468], eax
mov edi, 0x10000
mov ebp, ecx
xor esi, esi
cmp ecx, ebx
mov dword [esp + 0x28], ebp
jle 0x4014ed
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
xor ecx, ecx
mov dword [esp + 0x30], ebx
mov word [esp + 0x34], cx
mov dword [esp + 0x25c], ebx
cmp eax, ebx
jne 0x4014c2
mov dword [0x41b468], edi
jmp 0x4014e8
cmp dword [eax], 1
je 0x4014d3
mov dword [0x41b468], 0x80000
jmp 0x4014e8
mov eax, dword [eax + 4]
lea edx, [esp + 0x30]
push edx
push esi
mov ecx, eax
call fcn.004052e0
mov dword [0x41b468], eax
inc esi
cmp esi, ebp
jl 0x40149e
xor ecx, ecx
cmp ebp, ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
jg 0x401516
mov eax, dword [esp + 0x1c]
mov ebx, dword [eax]
test ebx, ebx
jne 0x4017c3
mov dword [0x41b468], edi
jmp 0x401881
xor ecx, ecx
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
xor edx, edx
mov dword [esp + 0x30], ecx
mov word [esp + 0x34], dx
mov dword [esp + 0x25c], ecx
cmp eax, ecx
jne 0x40153a
mov dword [0x41b468], edi
jmp 0x401560
cmp dword [eax], 1
je 0x40154b
mov dword [0x41b468], 0x80000
jmp 0x401560
mov eax, dword [eax + 4]
lea ecx, [esp + 0x30]
push ecx
push ebx
mov ecx, eax
call fcn.004052e0
mov dword [0x41b468], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
lea edx, [esp + 0x34]
push edx
push ecx
lea edx, [esp + 0x268]
push 0x414c10
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x278]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4016db
mov dword [esp + 0x14], 0
jmp 0x4015bd
mov esi, dword [esp + 0x1c]
mov edi, 0x10000
mov eax, dword [esi]
test eax, eax
jne 0x4015cb
mov dword [0x41b468], edi
jmp 0x4015fb
cmp dword [eax], 1
je 0x4015dd
mov edi, 0x80000
mov dword [0x41b468], edi
jmp 0x4015fb
mov eax, dword [eax + 4]
lea ecx, [esp + 0xa60]
push ecx
push ebx
mov ebx, eax
call fcn.004058a0
mov ebx, dword [esp + 0x18]
mov dword [0x41b468], eax
mov edi, eax
mov esi, 0x19000
test edi, edi
jne 0x40160f
mov esi, dword [esp + 0x25c]
sub esi, dword [esp + 0x14]
push 0
lea edx, [esp + 0x30]
push edx
push esi
lea eax, [esp + 0xa6c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
add dword [esp + 0x14], esi
add dword [esp + 0x20], esi
cmp edi, 0x600
je 0x4015b4
lea eax, [esp + 0x34]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401641
sub eax, edx
sar eax, 1
lea ecx, [esp + eax*2 + 0x2c]
push str..exe
push ecx
mov dword [esp + 0x1c], eax
call fcn.004114e3
add esp, 8
test eax, eax
jne 0x4016bb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x64
div ecx
lea esi, [ecx - 0x44]
mov bl, dl
add bl, byte [esp + 0x18]
mov dword [esp + 0x20], edx
push 2
push 0
push 0
push ebp
mov byte [esp + 0xa70], bl
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [esp + 0x18]
push edx
push 1
lea eax, [esp + 0xa6c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, 1
jne 0x401686
mov ebx, dword [esp + 0x18]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov edi, 0x10000
jl 0x401514
jmp 0x4014fb
lea ecx, [esp + 0x260]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebx, dword [esi]
test ebx, ebx
jne 0x4016fc
mov dword [0x41b468], edi
xor eax, eax
jmp 0x401886
cmp dword [ebx], 1
je 0x401712
mov dword [0x41b468], 0x80000
xor eax, eax
jmp 0x401886
mov esi, dword [ebx + 4]
or ebp, 0xffffffff
cmp dword [esi + 4], ebp
je 0x401724
mov edi, dword [esi]
call fcn.004050c0
mov edi, dword [esi]
mov dword [esi + 4], ebp
test edi, edi
je 0x401760
cmp dword [edi + 0x7c], 0
je 0x401738
call fcn.004050c0
mov ebp, dword [edi]
test ebp, ebp
je 0x401757
cmp byte [ebp + 0x10], 0
je 0x40174e
mov edx, dword [ebp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call fcn.00407832
add esp, 4
push edi
call fcn.004079e4
add esp, 4
mov dword [esi], 0
mov eax, dword [esi + 0x23c]
mov dword [0x41b468], 0
test eax, eax
je 0x401783
push eax
call fcn.00407c65
add esp, 4
mov eax, dword [esi + 0x240]
mov dword [esi + 0x23c], 0
test eax, eax
je 0x4017a0
push eax
call fcn.00407c65
add esp, 4
push esi
mov dword [esi + 0x240], 0
call fcn.00407832
add esp, 4
push ebx
call fcn.00407832
add esp, 4
xor eax, eax
jmp 0x401886
cmp dword [ebx], 1
je 0x4017d7
mov dword [0x41b468], 0x80000
jmp 0x401881
mov esi, dword [ebx + 4]
or ebp, 0xffffffff
cmp dword [esi + 4], ebp
je 0x4017e9
mov edi, dword [esi]
call fcn.004050c0
mov edi, dword [esi]
mov dword [esi + 4], ebp
test edi, edi
je 0x401825
cmp dword [edi + 0x7c], 0
je 0x4017fd
call fcn.004050c0
mov ebp, dword [edi]
test ebp, ebp
je 0x40181c
cmp byte [ebp + 0x10], 0
je 0x401813
mov ecx, dword [ebp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call fcn.00407832
add esp, 4
push edi
call fcn.004079e4
add esp, 4
mov dword [esi], 0
mov eax, dword [esi + 0x23c]
mov dword [0x41b468], 0
test eax, eax
je 0x401848
push eax
call fcn.00407c65
add esp, 4
mov eax, dword [esi + 0x240]
mov dword [esi + 0x23c], 0
test eax, eax
je 0x401865
push eax
call fcn.00407c65
add esp, 4
push esi
mov dword [esi + 0x240], 0
call fcn.00407832
add esp, 4
push ebx
call fcn.00407832
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x19a64]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040783d
add esp, 0x19a58
ret 4