Function at 0x40e811
Capabilities:
Delete file
Write file on windows

Disassembly:
mov eax, 0x4293f6
call fcn.0041bd3c
sub esp, 0xac
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov ebp, ecx
mov dword [esp + 0x14], ebx
call fcn.0040f0bc
cmp eax, 2
jae 0x40e84e
push ebx
push 1
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x40e84e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0040f0bc
cmp eax, 2
jae 0x40e86f
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x40e86f
push eax
mov byte [eax + 1], 0xef
call fcn.0040c4f8
pop ecx
call fcn.0040f0bc
cmp eax, 2
jae 0x40e888
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x44], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call fcn.0040f0bc
mov ebx, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, 0x1f0001
cmp eax, 3
jae 0x40e8b2
push str.Global793
push 0
push esi
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x40e8b2
push eax
call ebx
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x40e8ee
mov edi, 0x30e
mov esi, edi
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x40e8c5
mov esi, 0x1f0001
call fcn.0040f0bc
cmp eax, 3
jae 0x40e90c
push str.Global215
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x40e90c
push eax
call ebx
call fcn.0040f0bc
cmp eax, 3
jae 0x40e92b
push str.Global748
push 0
push esi
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x40e92b
push eax
call ebx
xor ebx, ebx
push 0xf
pop esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
xor ecx, ecx
inc ecx
mov dword [esp + 0xc4], ecx
mov al, byte [ebp + 0x30]
test al, al
je 0x40eeaf
mov edi, dword [esp + 0xd4]
test edi, edi
je 0x40eeaf
mov esi, dword [esp + 0xdc]
test esi, esi
je 0x40e98d
push esi
lea ecx, [esp + 0x90]
call fcn.004014e6
mov byte [esp + 0xc4], 3
push 2
pop ebx
jmp 0x40e9af
push ecx
push dword [esp + 0xdc]
lea eax, [esp + 0x64]
push dword [edi + 0x14]
push eax
call fcn.00416fc4
add esp, 0x10
push 4
pop ebx
mov dword [esp + 0xc4], ebx
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], ebx
call fcn.0040e4d1
mov dword [esp + 0xc4], 3
test bl, 4
je 0x40e9dd
and ebx, 0xfffffffb
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], ebx
call fcn.0040165f
mov dword [esp + 0xc4], 1
test bl, 2
je 0x40ea00
and ebx, 0xfffffffd
lea ecx, [esp + 0x8c]
mov dword [esp + 0x14], ebx
call fcn.0040165f
test esi, esi
jne 0x40ea96
test byte [edi], 1
je 0x40ea96
cmp dword [esp + 0x2c], esi
je 0x40ea25
cmp dword [esp + 0x30], 0x10
lea esi, [esp + 0x1c]
cmovae esi, dword [esp + 0x1c]
lea eax, [ebp + 0x10]
cmp dword [eax + 0x14], 0x10
jb 0x40ea30
mov eax, dword [eax]
push eax
lea eax, [esp + 0xa8]
push eax
call fcn.00418d65
pop ecx
pop ecx
mov byte [esp + 0xc4], 5
cmp dword [eax + 0x14], 0x10
jb 0x40ea50
mov eax, dword [eax]
push eax
lea eax, [esp + 0x78]
push esi
push eax
call fcn.00418ead
add esp, 0xc
mov byte [esp + 0xc4], 6
push eax
lea ecx, [esp + 0x20]
call fcn.0040e4d1
mov byte [esp + 0xc4], 5
lea ecx, [esp + 0x74]
call fcn.0040165f
mov byte [esp + 0xc4], 1
lea ecx, [esp + 0xa4]
call fcn.0040165f
cmp dword [esp + 0x2c], 0
je 0x40ee72
cmp dword [edi + 4], 0
je 0x40ee7a
cmp dword [esp + 0x30], 0x10
lea eax, [esp + 0x1c]
cmovae eax, dword [esp + 0x1c]
push eax
call fcn.00419813
pop ecx
call fcn.0040f0bc
push 2
pop ebp
cmp eax, ebp
jae 0x40eae8
push str.Local10936
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x40eae8
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.0040f0bc
cmp eax, ebp
jae 0x40eb08
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x40eb08
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0040f0bc
cmp eax, 3
jae 0x40eb21
push str.Local286
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.0040f0bc
cmp eax, 3
jae 0x40eb48
push str.Global869
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x40eb48
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.0040f0bc
cmp eax, ebp
jae 0x40eb67
push str.850850
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x40eb67
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call fcn.0040f0bc
cmp eax, ebp
jae 0x40eb86
push ebp
call fcn.0041a976
pop ecx
test eax, eax
je 0x40eb86
push eax
mov byte [eax + 1], 0x71
call fcn.0040c4f8
pop ecx
mov ecx, dword [0x4387c0]
lea eax, [ecx + 0x54]
push eax
push 1
call fcn.0040dd5c
xor ecx, ecx
cmp dword [eax], ecx
je 0x40ebd6
mov ecx, dword [0x4387c0]
cmp dword [esp + 0x30], 0x10
lea eax, [ecx + 0x54]
push eax
lea esi, [esp + 0x20]
cmovae esi, dword [esp + 0x20]
push 1
call fcn.0040dd5c
push 0
push 0x80
push ebp
push 0
push 1
push 0xc0000000
push esi
call dword [eax]
mov esi, eax
xor ecx, ecx
jmp 0x40ebd8
mov esi, ecx
cmp esi, 0xffffffff
jne 0x40ec0e
mov esi, dword [esp + 0xd0]
or ebx, 1
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ecx
mov byte [esi], cl
mov dword [esp + 0x14], ebx
mov byte [esp + 0xc4], cl
lea ecx, [esp + 0x1c]
call fcn.0040165f
mov eax, esi
jmp 0x40ef14
test dword [edi], 0x100
push 0xfffffffffffffffe
mov dword [esp + 0x1c], ecx
pop ebp
je 0x40ec8f
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ecx
mov byte [esp + 0xc4], 7
push dword [edi + 4]
lea eax, [esp + 0x38]
push dword [edi + 0x24]
push eax
call fcn.004164ae
add esp, 0xc
test al, al
je 0x40ec7c
mov eax, dword [esp + 0x38]
sub eax, dword [esp + 0x34]
push 0
lea ecx, [esp + 0x1c]
push ecx
push eax
push dword [esp + 0x40]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40ec79
mov eax, dword [esp + 0x38]
sub eax, dword [esp + 0x34]
cmp dword [esp + 0x18], eax
jne 0x40ec79
xor ebp, ebp
jmp 0x40ec7c
or ebp, 0xffffffff
mov byte [esp + 0xc4], 1
lea ecx, [esp + 0x34]
call fcn.004079be
jmp 0x40ecb6
push ecx
lea eax, [esp + 0x1c]
push eax
push dword [edi + 4]
push dword [edi + 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40ecb3
mov eax, dword [esp + 0x18]
cmp eax, dword [edi + 4]
jne 0x40ecb3
xor ebp, ebp
jmp 0x40ecb6
or ebp, 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x40ee7a
cmp dword [esp + 0x30], 0x10
lea eax, [esp + 0x1c]
cmovae eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [sym.imp.USER32.dll_IsDialogMessageA]
mov edi, dword [sym.imp.USER32.dll_SetDlgItemInt]
xor ebx, ebx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x40ecfc
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
push ebx
call edi
call fcn.0040f0bc
cmp eax, 2
jae 0x40ed1d
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x40ed1d
push eax
mov byte [eax + 1], 0x54
call fcn.0040c4f8
pop ecx
call fcn.0040f0bc
cmp eax, 2
jae 0x40ed3d
push str.713713
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x40ed3d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x40ed51
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
push ebx
call edi
call fcn.0040f0bc
cmp eax, 2
jae 0x40ed72
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x40ed72
push eax
mov byte [eax + 1], 0xd9
call fcn.0040c4f8
pop ecx
call fcn.0040f0bc
cmp eax, 3
jae 0x40ed89
push str.Local702
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.0040f0bc
cmp eax, 2
jae 0x40eda9
push str.239239
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x40eda9
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x40edd9
mov edi, 0x1b1
mov esi, edi
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
dec esi
jne 0x40edba
call fcn.0040f0bc
cmp eax, 2
jae 0x40edfe
push str.Local10957
push 1
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x40edfe
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.0040f0bc
cmp eax, 3
jae 0x40ee24
push str.Global502
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x40ee24
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.0040f0bc
cmp eax, 2
jae 0x40ee47
push str.Local10962
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x40ee47
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [esp + 0xd0]
or dword [esp + 0x14], 1
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
mov byte [esp + 0xc4], bl
jmp 0x40ebfe
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [esp + 0xd0]
lea eax, [esp + 0x1c]
and dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00407815
or ebx, 1
mov dword [esp + 0x14], ebx
mov byte [esp + 0xc4], 0
jmp 0x40ebfe
push 0xb
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x58], esi
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
mov byte [esp + 0xc4], 2
mov ecx, dword [esp + 0xd0]
lea eax, [esp + 0x44]
push eax
call fcn.0040749e
mov dword [esp + 0x14], 1
mov byte [esp + 0xc4], 1
lea ecx, [esp + 0x44]
call fcn.0040165f
mov byte [esp + 0xc4], bl
lea ecx, [esp + 0x1c]
call fcn.0040165f
mov eax, dword [esp + 0xd0]
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10