Function at 0x41bae0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4714b7
mov eax, dword fs:[0]
push eax
mov eax, 0x6b44
call fcn.0046fc30
mov eax, dword [0x4d100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x6b48], edx
mov esi, ecx
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x6b40], ebx
mov byte [ebp - 0x6b12], 0
mov dword [ebp - 0x6b28], 0
test ebx, ebx
je 0x41bb58
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
mov eax, dword [ebx]
mov ecx, ebx
push esi
push 0
push 0
push 0
push 0
mov dword [ebx + 0x2c], 0
call dword [eax + 4]
push 0x60
call fcn.004511c8
add esp, 4
mov dword [ebp - 0x6b4c], eax
push ebx
push edi
push esi
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.0041a6e0
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x6b18], esi
cmp byte [esi + 8], 0
je 0x41bcaa
push 0
push 0
push 2
push 0
push 3
push 2
push dword [ebp - 0x6b48]
xorps xmm0, xmm0
movlpd qword [ebp - 0x6b50], xmm0
movlpd qword [ebp - 0x401c], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x6b3c], eax
cmp eax, 0xffffffff
je 0x41bcaa
xor ebx, ebx
push 0x8000
push 1
mov dword [ebp - 0x6b24], ebx
mov dword [ebp - 0x6b0c], ebx
call fcn.00454560
add esp, 8
mov dword [ebp - 0x6b28], eax
test eax, eax
je 0x41bc8c
mov edi, dword [ebp - 0x6b4c]
mov esi, dword [ebp - 0x6b50]
mov byte [ebp - 0x6b11], 1
mov dword [ebp - 0x6b2c], 0xffffffff
mov ecx, dword [ebp - 0x6b18]
lea edx, [ebp - 0x4010]
mov eax, 0x4000
add edx, esi
sub eax, esi
push eax
call fcn.0041b5c0
add esp, 4
test eax, eax
je 0x41bc86
cmp eax, 0xffffffff
je 0x41bc86
add esi, eax
mov dword [ebp - 0x6b34], esi
adc edi, ebx
mov dword [ebp - 0x6b44], edi
jne 0x41bc52
cmp esi, 0x1e
jb 0x41bc77
movzx eax, word [ebp - 0x3ff6]
movzx ecx, word [ebp - 0x3ff4]
add eax, 0x1e
add eax, ecx
test edi, edi
ja 0x41bcfc
jb 0x41bc77
cmp esi, eax
jae 0x41bcfc
mov ecx, 0x4000
mov eax, ebx
sub ecx, esi
sbb eax, edi
or ecx, eax
jne 0x41bc14
mov esi, dword [ebp - 0x6b18]
push dword [ebp - 0x6b3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x6b48]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, dword [ebp - 0x6b40]
test ebx, ebx
je 0x41bcb5
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
mov eax, dword [ebp - 0x6b28]
test eax, eax
je 0x41bcc8
push eax
call fcn.004605b8
add esp, 4
mov ecx, esi
call fcn.0041b480
push 0x60
push esi
call fcn.00451449
mov al, byte [ebp - 0x6b12]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00450db2
mov esp, ebp
pop ebp
ret
movzx eax, word [ebp - 0x4008]
mov edx, dword [ebp - 0x401c]
mov dword [ebp - 0x6b4c], eax
mov eax, dword [ebp - 0x4018]
mov dword [ebp - 0x6b30], eax
mov dword [ebp - 0x6b20], edx
jmp 0x41bd2f
mov esi, dword [ebp - 0x6b34]
mov edx, dword [ebp - 0x6b20]
cmp byte [ebp - 0x6b11], 0
lea eax, [ebp - 0x4010]
mov dword [ebp - 0x6b1c], eax
mov edi, 2
je 0x41bd9a
movzx ecx, word [ebp - 0x3ff4]
lea edx, [ebp - 0x4010]
movzx eax, word [ebp - 0x3ff6]
add ecx, 0x1e
add eax, ecx
mov byte [ebp - 0x6b11], 0
mov ecx, dword [ebp - 0x3ffe]
add edx, eax
mov dword [ebp - 0x6b2c], ecx
mov ecx, esi
mov esi, dword [ebp - 0x6b2c]
sub ecx, eax
mov eax, dword [ebp - 0x6b30]
cmp esi, ecx
mov dword [ebp - 0x6b1c], edx
cmovae esi, ecx
mov ecx, dword [ebp - 0x6b20]
jmp 0x41be04
mov eax, dword [ebp - 0x6b2c]
mov ecx, 0x4000
sub eax, edx
lea edx, [ebp - 0x4010]
cmp eax, ecx
cmovb ecx, eax
push ecx
mov ecx, dword [ebp - 0x6b18]
call fcn.0041b5c0
mov esi, eax
add esp, 4
test esi, esi
je 0x41bf98
cmp esi, 0xffffffff
je 0x41bc86
add dword [ebp - 0x6b34], esi
mov ecx, dword [ebp - 0x6b20]
adc dword [ebp - 0x6b44], 0
add ecx, esi
mov eax, dword [ebp - 0x6b30]
mov edx, dword [ebp - 0x6b1c]
adc eax, 0
mov dword [ebp - 0x6b20], ecx
mov dword [ebp - 0x6b30], eax
test esi, esi
je 0x41bd23
nop dword [eax]
test edi, edi
je 0x41bf98
mov edi, 0x8000
sub edi, ebx
cmp word [ebp - 0x6b4c], 0
mov ebx, esi
mov dword [ebp - 0x4014], edi
mov dword [ebp - 0x6b10], ebx
je 0x41be98
test eax, eax
ja 0x41be4c
jb 0x41be45
cmp ecx, dword [ebp - 0x6b2c]
jae 0x41be4c
mov eax, 2
jmp 0x41be4e
xor eax, eax
mov ecx, dword [ebp - 0x6b24]
mov edi, dword [ebp - 0x6b28]
add ecx, edi
push eax
lea eax, [ebp - 0x4014]
push eax
push ecx
lea eax, [ebp - 0x6b10]
push edi
push eax
lea ecx, [ebp - 0x6b0c]
call fcn.00416330
add esp, 0x14
mov dword [ebp - 0x6b38], eax
cmp eax, 0xffffffff
je 0x41bc86
mov edi, dword [ebp - 0x4014]
mov ebx, dword [ebp - 0x6b10]
jmp 0x41bee3
cmp esi, edi
jae 0x41bea8
mov edi, esi
mov eax, esi
mov dword [ebp - 0x4014], edi
jmp 0x41beb4
mov eax, edi
jbe 0x41beb4
mov ebx, edi
mov dword [ebp - 0x6b10], ebx
mov ecx, dword [ebp - 0x6b24]
mov edx, dword [ebp - 0x6b1c]
add ecx, dword [ebp - 0x6b28]
push eax
push edx
push ecx
call fcn.00453fa0
xor ecx, ecx
add esp, 0xc
cmp esi, ebx
mov eax, 2
cmove eax, ecx
mov dword [ebp - 0x6b38], eax
mov edx, dword [ebp - 0x6b1c]
sub esi, ebx
add edx, ebx
mov ebx, dword [ebp - 0x6b24]
mov dword [ebp - 0x6b1c], edx
test edi, edi
je 0x41bf6e
push 0
lea eax, [ebp - 0x4018]
mov dword [ebp - 0x4018], 0
push eax
mov eax, dword [ebp - 0x6b28]
push edi
add eax, ebx
push eax
push dword [ebp - 0x6b3c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x4018]
mov eax, dword [ebp - 0x4014]
cmp ecx, eax
jne 0x41bc86
mov edx, dword [ebp - 0x6b40]
test edx, edx
je 0x41bf5a
mov eax, dword [edx]
push 0
push 0
push ecx
push 0
push 0
mov ecx, edx
call dword [eax + 4]
mov eax, dword [ebp - 0x4014]
mov edx, dword [ebp - 0x6b1c]
add ebx, eax
and ebx, 0x7fff
mov dword [ebp - 0x6b24], ebx
mov edi, dword [ebp - 0x6b38]
mov ecx, dword [ebp - 0x6b20]
mov eax, dword [ebp - 0x6b30]
test esi, esi
jne 0x41be10
mov esi, dword [ebp - 0x6b34]
mov edx, ecx
test edi, edi
jne 0x41bd2f
push dword [ebp - 0x6b3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x6b18]
lea edx, [ebp - 0x4010]
push 0x4000
mov ecx, esi
call fcn.0041b5c0
add esp, 4
test eax, eax
je 0x41bfe1
cmp eax, 0xffffffff
je 0x41bfe1
push 0x4000
lea edx, [ebp - 0x4010]
mov ecx, esi
call fcn.0041b5c0
add esp, 4
test eax, eax
jne 0x41bfc3
mov byte [ebp - 0x6b12], 1
jmp 0x41bca4