Function at 0x11184780
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
test byte [edi + 0xc4], 1
mov dword [ebp - 0x420], edi
je 0x111849f6
cmp dword [edi + 0x4b8], 0
je 0x111847c6
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 0x4a0]
push 0
push 0
push eax
push esi
call fcn.11170230
mov ecx, dword [edi + 0x4a4]
test ecx, ecx
je 0x111847e7
cmp dword [edi + 0x4bc], 0
je 0x111847e7
mov edx, dword [ebp + 8]
push 0
push 0
push edx
push esi
call fcn.11170230
movzx eax, word [esi + 4]
movzx ecx, word [esi + 8]
mov dword [ebp - 0x42c], eax
movzx eax, word [esi + 6]
cdq
push ebx
mov ebx, eax
mov eax, dword [0x1127f5dc]
xor ebx, edx
sub ebx, edx
movzx edx, word [esi + 0xa]
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x424], edx
test eax, eax
jne 0x11184832
push str.PCIImage.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1127f5dc], eax
test eax, eax
je 0x111849f5
push str.DecompressPNGToBitmap
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x111849f5
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0x11237890
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x111849e8
lea eax, [ebp - 0x20c]
push 0x111f88e8
push eax
call dword [sym.imp.MSVCR100.dll__wfopen]
add esp, 8
mov dword [ebp - 0x418], eax
test eax, eax
je 0x111849e8
mov ecx, dword [esi + 0xc]
push eax
push ecx
lea edi, [esi + 0x14]
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fwrite]
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 0x14
cmp byte [edi], 0xff
jne 0x111848fa
cmp byte [edi + 1], 0xd8
jne 0x111848fa
cmp byte [edi + 2], 0xff
jne 0x111848fa
mov eax, dword [0x1127f5dc]
push str.DecompressJPEGToBitmap
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x111849e8
lea ecx, [ebp - 0x20c]
push ecx
call eax
jmp 0x11184907
lea edx, [ebp - 0x20c]
push edx
call dword [ebp - 0x41c]
add esp, 4
mov dword [ebp - 0x418], eax
test eax, eax
je 0x111849e8
mov edi, dword [ebp - 0x420]
cmp dword [edi + 0x7e0], 0xffffffff
je 0x11184938
mov eax, dword [ebp + 8]
push eax
push esi
push 0
push 0
call fcn.111845c0
add esp, 0x10
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebp - 0x418]
mov edi, eax
push ecx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x428]
push 0xcc0020
push 0
push 0
push edi
push ebx
push edx
mov edx, dword [ebp - 0x420]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x424]
push eax
mov eax, dword [edx + 0x244]
push ecx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebp - 0x41c]
push ecx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
movzx edx, word [esi + 8]
mov eax, dword [ebp - 0x428]
add eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x420]
mov dword [ebp - 0x43c], edx
movzx edx, word [esi + 0xa]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x438], edx
add eax, ebx
push 0
lea edx, [ebp - 0x43c]
mov dword [ebp - 0x430], eax
call fcn.11176060
add esp, 4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.111d9022
mov esp, ebp
pop ebp
ret