Function at 0x34780690
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 0x658
mov eax, dword [0x347765c8]
xor eax, esp
mov dword [esp + 0x654], eax
mov eax, dword [esp + 0x65c]
push ebx
push ebp
mov ebp, dword [esp + 0x668]
push esi
push edi
push 0x34771820
push 0x34771818
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x67c]
xor esi, esi
push 0x105
lea ecx, [esp + 0x258]
push ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [eax], esi
call fcn.34776b01
mov edi, eax
cmp edi, esi
jl 0x3478098e
push 0x34771820
push 0x34771818
push 0x105
lea edx, [esp + 0x464]
push edx
call fcn.34776b01
mov edi, eax
cmp edi, esi
jl 0x3478098e
mov esi, dword [sym.imp.msvcr80.dll_wcsrchr]
lea eax, [esp + 0x24c]
push 0x5c
push eax
call esi
lea ecx, [esp + 0x460]
push 0x5c
push ecx
call esi
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x34780749
add ebx, 2
jmp 0x34780750
lea ebx, [esp + 0x458]
lea edx, [esp + 0x24]
push edx
call fcn.347e069c
mov edi, eax
test edi, edi
jl 0x3478098e
push 0
push 0x10000080
push 2
push 0
push 0
push 0xc0000000
lea eax, [esp + 0x264]
push eax
call fcn.347e757d
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
jne 0x3478079a
call fcn.347c02fe
mov edi, eax
jmp 0x34780979
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x10
lea edx, [esp + 0x30]
push edx
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x347807bf
call fcn.347c02fe
mov edi, eax
jmp 0x34780979
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x347807d6
call fcn.347c02fe
mov edi, eax
jmp 0x34780979
lea eax, [esp + 0x458]
push eax
call sub.kernel32.dll_DeleteFileW
test eax, eax
jne 0x347807f3
call fcn.347c02fe
mov edi, eax
jmp 0x34780979
push 0x104
lea ecx, [esp + 0x48]
push ecx
push ebp
call dword [sym.imp.MSO.dll_Ordinal_6877]
mov esi, dword [sym.imp.MSO.dll_Ordinal_6873]
push 0x104
lea edx, [esp + 0x48]
push edx
push 0x34771814
call esi
push 0x104
lea eax, [esp + 0x48]
push eax
push ebx
call esi
mov ebx, dword [esp + 0x1c]
lea ecx, [esp + 0x24c]
push ecx
lea edx, [esp + 0x48]
push edx
push ebx
call fcn.34780395
mov edi, eax
test edi, edi
jl 0x3478097f
lea eax, [esp + 0x24c]
push eax
call sub.kernel32.dll_DeleteFileW
test eax, eax
jne 0x34780866
call fcn.347c02fe
mov edi, eax
jmp 0x34780975
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x48]
push edx
push 0x34771804
push ebx
call fcn.34780110
mov esi, dword [esp + 0x14]
mov edi, eax
test edi, edi
jl 0x3478096a
push 0
push 0
push 0
push 0
push esi
call dword [0x347ed2a4]
test eax, eax
jne 0x347808a6
mov edi, 0xfffff8ed
jmp 0x3478096a
push 0
lea eax, [esp + 0x1c]
push eax
push 0x10
lea ecx, [esp + 0x40]
push ecx
push esi
call fcn.3477f8d8
mov edi, eax
test edi, edi
jge 0x347808ca
mov edi, 0xfffff8ed
jmp 0x3478096a
mov eax, 0x10
lea edx, [esp + 0x34]
lea esi, [esp + 0x24]
mov ecx, dword [esi]
cmp ecx, dword [edx]
jne 0x347808ef
sub eax, 4
add edx, 4
add esi, 4
cmp eax, 4
jae 0x347808d7
test eax, eax
je 0x3478094c
movzx ecx, byte [esi]
movzx ebp, byte [edx]
sub ecx, ebp
jne 0x3478093e
sub eax, 1
add edx, 1
add esi, 1
test eax, eax
je 0x3478094c
movzx ecx, byte [esi]
movzx ebp, byte [edx]
sub ecx, ebp
jne 0x3478093e
sub eax, 1
add edx, 1
add esi, 1
test eax, eax
je 0x3478094c
movzx ecx, byte [esi]
movzx ebp, byte [edx]
sub ecx, ebp
jne 0x3478093e
sub eax, 1
add edx, 1
add esi, 1
test eax, eax
je 0x3478094c
movzx ecx, byte [esi]
movzx edx, byte [edx]
sub ecx, edx
je 0x3478094c
test ecx, ecx
mov eax, 1
jg 0x3478094e
or eax, 0xffffffff
jmp 0x3478094e
xor eax, eax
mov edx, dword [esp + 0x20]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [esp + 0x44]
push eax
push ebx
mov dword [edx], ecx
call fcn.347801d7
mov esi, dword [esp + 0x14]
test esi, esi
je 0x34780975
push esi
call dword [0x347ed29c]
mov esi, dword [esp + 0x10]
test edi, edi
jge 0x347809aa
jmp 0x34780983
mov esi, dword [esp + 0x10]
test esi, esi
je 0x3478098e
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
lea ecx, [esp + 0x24c]
push ecx
call sub.kernel32.dll_DeleteFileW
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x44]
push edx
push eax
call fcn.347801d7
mov ecx, dword [esp + 0x664]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.347ea89f
add esp, 0x658
ret 0xc