Function at 0x40a0d2
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x48]
call fcn.00402e6f
xor edi, edi
lea ecx, [ebp - 0x64]
push edi
push str.setup.ibt
mov dword [ebp - 0x58], 0x41230c
mov dword [ebp - 0x50], 0x412314
call fcn.0040399e
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], 0x412308
push eax
lea eax, [esi + 0x18]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.0040cc01
add esp, 0xc
lea ecx, [ebp - 0x64]
call fcn.00401b16
push edi
lea eax, [ebp - 0xb4]
sub esp, 0x1c
mov ecx, esp
push 1
push eax
call fcn.00403e2a
lea ecx, [ebp - 0x48]
call fcn.00402ea6
test al, al
je 0x40a159
lea ecx, [ebp - 0x48]
call fcn.0040793b
cmp eax, 0xffffffff
jne 0x40a1ae
lea eax, [ebp - 0x70]
push str.setup.boot
push eax
lea ecx, [ebp - 0xb4]
call fcn.0040c3d0
mov ecx, eax
call fcn.0040ca5e
lea ecx, [ebp - 0x70]
call fcn.00401b16
lea ecx, [ebp - 0x48]
call fcn.0040339f
push edi
lea eax, [ebp - 0xb4]
sub esp, 0x1c
mov ecx, esp
push 1
push eax
call fcn.00403e2a
lea ecx, [ebp - 0x48]
call fcn.00402ea6
test al, al
jne 0x40a1ae
mov esi, 0xfffffed3
jmp 0x40a2aa
push edi
lea ecx, [ebp - 0x48]
push dword [esi + 0xec]
call fcn.00408129
lea ebx, [esi + 0xa8]
lea eax, [ebp - 0x20]
push ebx
push dword [ebp + 8]
push eax
call fcn.0040cc01
add esp, 0xc
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x20]
push eax
call fcn.00404452
lea ecx, [ebp - 0x98]
call fcn.00402e6f
push 2
lea eax, [ebp - 0x20]
sub esp, 0x1c
mov ecx, esp
push 1
push eax
call fcn.00403e2a
lea ecx, [ebp - 0x98]
call fcn.0040348c
test al, al
jne 0x40a212
mov esi, 0xfffffed2
jmp 0x40a282
push dword [esi + 0xe8]
lea ecx, [ebp - 4]
call fcn.0040a361
push dword [esi + 0xe8]
push edi
push dword [ebp - 4]
call fcn.00410410
add esp, 0xc
lea ecx, [ebp - 0x48]
push dword [esi + 0xe8]
push dword [ebp - 4]
call fcn.0040357a
cmp eax, 0xffffffff
jne 0x40a24f
mov esi, 0xfffffed1
jmp 0x40a27a
lea ecx, [ebp + 8]
push edi
push ecx
push eax
push dword [ebp - 4]
push dword [ebp - 0x94]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40a26d
mov eax, dword [ebp + 8]
jmp 0x40a270
or eax, 0xffffffff
cmp eax, 0xffffffff
jne 0x40a2d3
mov esi, 0xfffffed0
lea ecx, [ebp - 4]
call fcn.0040f454
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x98], 0x41234c
call fcn.0040339f
lea ecx, [ebp - 0x90]
call fcn.00401b16
lea ecx, [ebp - 0x20]
call fcn.00401b16
lea ecx, [ebp - 0xb4]
call fcn.00401b16
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], 0x41234c
call fcn.0040339f
lea ecx, [ebp - 0x40]
call fcn.00401b16
mov eax, esi
jmp 0x40a35a
lea ecx, [ebp - 0x98]
call fcn.0040793b
cmp dword [esi + 0xe8], eax
lea ecx, [ebp - 0x98]
je 0x40a309
call fcn.0040339f
lea ecx, [ebp - 0x20]
call fcn.00401ffc
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, 0xfffffecf
jmp 0x40a32a
call fcn.0040339f
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x20]
push eax
call fcn.0040c3d0
push eax
mov ecx, ebx
call fcn.00401ba8
lea ecx, [ebp - 0x70]
call fcn.00401b16
lea ecx, [ebp - 4]
call fcn.0040f454
lea ecx, [ebp - 0x98]
call fcn.00408ddc
lea ecx, [ebp - 0x20]
call fcn.00401b16
lea ecx, [ebp - 0xb4]
call fcn.00401b16
lea ecx, [ebp - 0x48]
call fcn.00408ddc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4