Function at 0x4097f8
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
mov eax, 0x420263
call fcn.00412bcc
sub esp, 0x464
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x10], ebx
push 0xf
pop esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov ebp, ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x47c], 1
call fcn.00409cba
cmp eax, 3
jae 0x409850
lea eax, [esp + 0x60]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov al, byte [ebp + 0x30]
test al, al
je 0x409bcb
mov edi, dword [esp + 0x48c]
test edi, edi
je 0x409bcb
mov esi, dword [esp + 0x494]
test esi, esi
je 0x40988c
push esi
lea ecx, [esp + 0x4c]
call fcn.004013ed
mov byte [esp + 0x47c], 3
push 2
pop ebx
jmp 0x4098af
push 1
push dword [esp + 0x494]
lea eax, [esp + 0x38]
push dword [edi + 0x14]
push eax
call fcn.0040f3ab
add esp, 0x10
push 4
pop ebx
mov dword [esp + 0x47c], ebx
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], ebx
call fcn.0040959e
mov dword [esp + 0x47c], 3
test bl, 4
je 0x4098dd
and ebx, 0xfffffffb
lea ecx, [esp + 0x30]
mov dword [esp + 0x10], ebx
call fcn.004015ab
mov dword [esp + 0x47c], 1
test bl, 2
je 0x4098fd
and ebx, 0xfffffffd
lea ecx, [esp + 0x48]
mov dword [esp + 0x10], ebx
call fcn.004015ab
test esi, esi
jne 0x409989
test byte [edi], 1
je 0x409989
cmp dword [esp + 0x28], esi
je 0x40991e
cmp dword [esp + 0x2c], 0x10
lea esi, [esp + 0x18]
cmovae esi, dword [esp + 0x18]
lea eax, [ebp + 0x10]
cmp dword [eax + 0x14], 0x10
jb 0x409929
mov eax, dword [eax]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.004107d0
pop ecx
pop ecx
mov byte [esp + 0x47c], 5
cmp dword [eax + 0x14], 0x10
jb 0x409946
mov eax, dword [eax]
push eax
lea eax, [esp + 0x4c]
push esi
push eax
call fcn.00410899
add esp, 0xc
mov byte [esp + 0x47c], 6
push eax
lea ecx, [esp + 0x1c]
call fcn.0040959e
mov byte [esp + 0x47c], 5
lea ecx, [esp + 0x48]
call fcn.004015ab
mov byte [esp + 0x47c], 1
lea ecx, [esp + 0x30]
call fcn.004015ab
cmp dword [esp + 0x28], 0
je 0x409b74
cmp dword [edi + 4], 0
je 0x409b7c
cmp dword [esp + 0x2c], 0x10
lea eax, [esp + 0x18]
cmovae eax, dword [esp + 0x18]
push eax
call fcn.00410ef7
pop ecx
mov ecx, dword [0x42e66c]
lea eax, [ecx + 0x54]
push eax
push 1
call fcn.00404c3d
xor ecx, ecx
cmp dword [eax], ecx
je 0x409a04
mov ecx, dword [0x42e66c]
cmp dword [esp + 0x2c], 0x10
lea eax, [ecx + 0x54]
push eax
lea esi, [esp + 0x1c]
cmovae esi, dword [esp + 0x1c]
push 1
call fcn.00404c3d
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push esi
call dword [eax]
mov ebp, eax
xor ecx, ecx
jmp 0x409a06
mov ebp, ecx
cmp ebp, 0xffffffff
jne 0x409a3c
mov esi, dword [esp + 0x488]
or ebx, 1
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ecx
mov byte [esi], cl
mov dword [esp + 0x10], ebx
mov byte [esp + 0x47c], cl
lea ecx, [esp + 0x18]
call fcn.004015ab
mov eax, esi
jmp 0x409c30
test dword [edi], 0x100
push 0xfffffffffffffffe
mov dword [esp + 0x18], ecx
pop esi
je 0x409abd
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
mov byte [esp + 0x47c], 7
push dword [edi + 4]
lea eax, [esp + 0x34]
push dword [edi + 0x24]
push eax
call fcn.0040ea84
add esp, 0xc
test al, al
je 0x409aaa
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x30]
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esp + 0x3c]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x409aa7
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x30]
cmp dword [esp + 0x14], eax
jne 0x409aa7
xor esi, esi
jmp 0x409aaa
or esi, 0xffffffff
mov byte [esp + 0x47c], 1
lea ecx, [esp + 0x30]
call fcn.004095d6
jmp 0x409ae4
push ecx
lea eax, [esp + 0x18]
push eax
push dword [edi + 4]
push dword [edi + 0x24]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x409ae1
mov eax, dword [esp + 0x14]
cmp eax, dword [edi + 4]
jne 0x409ae1
xor esi, esi
jmp 0x409ae4
or esi, 0xffffffff
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00409cba
cmp eax, 3
jae 0x409b12
push str.Global60
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x409b12
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00409cba
cmp eax, 3
jae 0x409b2c
lea eax, [esp + 0x60]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test esi, esi
je 0x409b7c
cmp dword [esp + 0x2c], 0x10
lea eax, [esp + 0x18]
cmovae eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [esp + 0x488]
xor eax, eax
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], eax
or ebx, 1
mov byte [esi], al
mov dword [esp + 0x10], ebx
mov byte [esp + 0x47c], al
jmp 0x409a2c
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.00409cba
cmp eax, 3
jae 0x409b96
lea eax, [esp + 0x60]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [esp + 0x488]
lea eax, [esp + 0x18]
and dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00404f10
or ebx, 1
mov dword [esp + 0x10], ebx
mov byte [esp + 0x47c], 0
jmp 0x409a2c
push 0xb
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
mov byte [esp + 0x47c], 2
mov ecx, dword [esp + 0x488]
lea eax, [esp + 0x30]
push eax
call fcn.00404d26
mov dword [esp + 0x10], 1
mov byte [esp + 0x47c], 1
lea ecx, [esp + 0x30]
call fcn.004015ab
mov byte [esp + 0x47c], bl
lea ecx, [esp + 0x18]
call fcn.004015ab
mov eax, dword [esp + 0x488]
mov ecx, dword [esp + 0x474]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10