Function at 0x40b35c
Capabilities:
Delete file
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x610
xor eax, eax
push ebx
cmp dword [ebp + 8], eax
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
je 0x40b643
cmp dword [ebp + 0xc], eax
je 0x40b643
mov edi, 0x100
push edi
push eax
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll_memset
mov ebx, str.user_pref__browser.search.defaultenginename____
lea eax, [ebp - 0x208]
push ebx
push eax
call sub.MSVCRT.dll_strcpy
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll_strcat
mov esi, 0x40feb0
lea eax, [ebp - 0x208]
push esi
push eax
call sub.MSVCRT.dll_strcat
push edi
lea eax, [ebp - 0x108]
push 0
push eax
call sub.MSVCRT.dll_memset
mov edi, str.user_pref__browser.search.selectedEngine____
lea eax, [ebp - 0x108]
push edi
push eax
call sub.MSVCRT.dll_strcpy
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x40
lea eax, [ebp - 0x108]
push esi
push eax
call sub.MSVCRT.dll_strcat
mov esi, 0x104
lea eax, [ebp - 0x30c]
push esi
push 0
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x410]
push 0
push eax
call sub.MSVCRT.dll_memset
push dword [ebp + 0xc]
lea eax, [ebp - 0x30c]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x30c]
push str.prefs.js
push eax
call sub.MSVCRT.dll_strcat
push dword [ebp + 0xc]
lea eax, [ebp - 0x410]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x410]
push str.prefs_copy.js
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x40
lea eax, [ebp - 0x30c]
push 0x40fe60
push eax
call sub.MSVCRT.dll_fopen
pop ecx
mov dword [ebp + 0xc], eax
test eax, eax
pop ecx
je 0x40b643
lea eax, [ebp - 0x410]
push 0x40fe5c
push eax
call sub.MSVCRT.dll_fopen
pop ecx
mov dword [ebp + 8], eax
test eax, eax
pop ecx
je 0x40b643
mov esi, 0x200
lea eax, [ebp - 0x610]
push esi
push 0
push eax
call sub.MSVCRT.dll_memset
push dword [ebp + 0xc]
lea eax, [ebp - 0x610]
push esi
push eax
call sub.MSVCRT.dll_fgets
add esp, 0x18
test eax, eax
je 0x40b5ba
lea eax, [ebp - 0x610]
push eax
call sub.MSVCRT.dll_strlen
cmp eax, 1
pop ecx
jbe 0x40b59a
push ebx
call sub.MSVCRT.dll_strlen
push eax
lea eax, [ebp - 0x610]
push ebx
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0x10
test eax, eax
jne 0x40b535
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x208]
push 1
push eax
call sub.MSVCRT.dll_fwrite
add esp, 0x10
mov dword [ebp - 4], 1
jmp 0x40b59a
push edi
call sub.MSVCRT.dll_strlen
push eax
lea eax, [ebp - 0x610]
push edi
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0x10
test eax, eax
push dword [ebp + 8]
jne 0x40b57b
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x108]
push 1
push eax
call sub.MSVCRT.dll_fwrite
add esp, 0x10
mov dword [ebp - 8], 1
jmp 0x40b59a
lea eax, [ebp - 0x610]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x610]
push 1
push eax
call sub.MSVCRT.dll_fwrite
add esp, 0x10
push dword [ebp + 0xc]
lea eax, [ebp - 0x610]
push esi
push eax
call sub.MSVCRT.dll_fgets
add esp, 0xc
test eax, eax
jne 0x40b4d9
cmp dword [ebp - 4], eax
jne 0x40b5dc
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x208]
push 1
push eax
call sub.MSVCRT.dll_fwrite
add esp, 0x10
cmp dword [ebp - 8], 0
jne 0x40b604
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x108]
push 1
push eax
call sub.MSVCRT.dll_fwrite
add esp, 0x10
push dword [ebp + 0xc]
call sub.MSVCRT.dll_fclose
push dword [ebp + 8]
call sub.MSVCRT.dll_fclose
lea eax, [ebp - 0x30c]
push eax
call sub.MSVCRT.dll_remove
add esp, 0xc
test eax, eax
jne 0x40b643
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x410]
push eax
call sub.MSVCRT.dll_rename
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
jmp 0x40b645
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret