Function at 0x402b9e
Capabilities:
Copy file
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5720
call fcn.0044b790
push ebx
xor ebx, ebx
cmp dword [ebp + 0x20], ebx
push esi
push edi
je 0x402c29
push dword [ebp + 0xc]
call fcn.00402960
test eax, eax
jne 0x402c29
mov esi, 0x3ff
push esi
lea eax, [ebp - 0x71f]
push ebx
push eax
mov byte [ebp - 0x720], bl
call fcn.0043acc0
push dword [ebp + 0xc]
call fcn.0043ae20
push dword [ebp + 0x20]
mov edi, eax
call fcn.0043ae20
lea eax, [edi + eax + 1]
add esp, 0x14
cmp eax, esi
jae 0x402c0c
push dword [ebp + 0x20]
lea eax, [ebp - 0x720]
push dword [ebp + 0xc]
call fcn.0040725a
pop ecx
pop ecx
jmp 0x402c12
mov byte [ebp - 0x720], bl
push dword [ebp + 0x1c]
lea eax, [ebp - 0x720]
push dword [ebp + 0x18]
push eax
call fcn.00403bb9
jmp 0x402ef3
mov eax, dword [ebp + 0x18]
mov esi, 0x104
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x31f]
push ebx
push eax
mov dword [ebp + 0x20], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 0x320], bl
call fcn.0043acc0
add esp, 0xc
cmp dword [ebp + 0x1c], ebx
je 0x402c86
push str.gzip
push dword [ebp + 0x1c]
call fcn.0043b675
test eax, eax
pop ecx
pop ecx
jne 0x402c86
push 0x44f4ac
lea edi, [ebp - 0x320]
mov dword [ebp - 8], 1
call fcn.00406f94
mov eax, edi
pop ecx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
mov eax, edi
and eax, 0xff000000
cmp eax, 0x80000000
jne 0x402d4b
push esi
lea eax, [ebp - 0x217]
push ebx
push eax
mov byte [ebp - 0x218], bl
call fcn.0043acc0
push esi
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.0043acc0
and edi, 0xffffff
push edi
push str.f__6.6x
lea eax, [ebp - 0x218]
push 0x14
push eax
call fcn.0043a806
push dword [ebp + 0xc]
call fcn.0043ae20
mov edi, eax
lea eax, [ebp - 0x218]
push eax
call fcn.0043ae20
lea eax, [edi + eax + 1]
add esp, 0x30
cmp eax, esi
jae 0x402d17
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x110]
call fcn.0040725a
pop ecx
pop ecx
jmp 0x402d1d
mov byte [ebp - 0x110], bl
lea eax, [ebp - 0x110]
push eax
call fcn.004070e1
test eax, eax
pop ecx
je 0x402e1e
push ebx
push dword [ebp - 4]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
mov dword [ebp + 0x20], eax
jmp 0x402e1e
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push dword [ebp - 4]
call fcn.00406b71
cmp eax, 0xffffffff
pop ecx
mov dword [ebp + 0x1c], eax
je 0x402e1e
push 0xfff
lea eax, [ebp - 0x171f]
push ebx
push eax
mov byte [ebp - 0x1720], bl
call fcn.0043acc0
mov eax, dword [ebp + 0x14]
mov ebx, eax
add esp, 0xc
shr ebx, 0xc
mov dword [ebp + 0xc], 0
je 0x402dd7
mov eax, dword [ebp + 0xc]
shl eax, 0xc
push eax
push 0x1000
lea eax, [ebp - 0x1720]
mov edx, edi
mov edi, dword [ebp + 8]
push eax
call fcn.00402efa
push 0x1000
lea eax, [ebp - 0x1720]
push eax
push dword [ebp + 0x1c]
call fcn.0040792d
mov edi, dword [ebp + 0x10]
add esp, 0xc
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], ebx
jb 0x402d95
mov eax, dword [ebp + 0x14]
and eax, 0xfff
mov dword [ebp + 0xc], eax
jbe 0x402e0c
shl ebx, 0xc
push ebx
push eax
lea eax, [ebp - 0x1720]
mov edx, edi
mov edi, dword [ebp + 8]
push eax
call fcn.00402efa
push dword [ebp + 0xc]
lea eax, [ebp - 0x1720]
push eax
push dword [ebp + 0x1c]
call fcn.0040792d
add esp, 0xc
push dword [ebp + 0x1c]
mov dword [ebp + 0x20], 1
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor ebx, ebx
cmp dword [ebp - 8], ebx
je 0x402ef0
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push esi
lea eax, [ebp - 0x217]
push ebx
push eax
mov byte [ebp - 0x218], 0
call fcn.0043acc0
push esi
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], 0
call fcn.0043acc0
lea eax, [ebp - 0x320]
push esi
push eax
lea edi, [ebp - 0x218]
call fcn.00406f13
push esi
push dword [ebp + 0x18]
lea edi, [ebp - 0x110]
call fcn.00406f13
lea eax, [ebp - 0x218]
push eax
call fcn.00436293
mov esi, eax
add esp, 0x2c
cmp esi, ebx
je 0x402edc
mov eax, edi
push 0x44f4b4
push eax
call fcn.0043adfe
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x402ed5
jmp 0x402ebd
je 0x402ece
push edi
push eax
lea eax, [ebp - 0x5720]
push 1
push eax
call fcn.0043d0a3
add esp, 0x10
lea eax, [ebp - 0x5720]
mov ecx, esi
call fcn.004364dc
cmp eax, ebx
jge 0x402ea8
push edi
call fcn.0043b3df
pop ecx
mov eax, esi
call fcn.00436728
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov dword [ebp + 0x20], 1
mov eax, dword [ebp + 0x20]
pop edi
pop esi
pop ebx
leave
ret 0x1c