Function at 0x40a596
Capabilities:
Delete file
Write file on windows

Disassembly:
mov eax, 0x421f8e
call fcn.0041410c
sub esp, 0x4c
push ebx
xor ebx, ebx
push ebp
mov dword [esp + 8], ebx
mov eax, dword [0x42e174]
push esi
push edi
or eax, 0x16
mov ebp, ecx
inc eax
mov ecx, 0x15f
push 0xf
cmove eax, ecx
pop esi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [0x42e174], eax
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
xor ecx, ecx
inc ecx
mov dword [esp + 0x64], ecx
mov al, byte [ebp + 0x30]
test al, al
je 0x40a986
mov edi, dword [esp + 0x74]
test edi, edi
je 0x40a986
mov esi, dword [esp + 0x7c]
test esi, esi
je 0x40a616
push esi
lea ecx, [esp + 0x48]
call fcn.004013c9
mov byte [esp + 0x64], 3
push 2
pop ebx
jmp 0x40a632
push ecx
push dword [esp + 0x7c]
lea eax, [esp + 0x1c]
push dword [edi + 0x14]
push eax
call fcn.004105e1
add esp, 0x10
push 4
pop ebx
mov dword [esp + 0x64], ebx
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], ebx
call fcn.0040fd82
mov dword [esp + 0x64], 3
test bl, 4
je 0x40a65d
and ebx, 0xfffffffb
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], ebx
call fcn.004016a6
mov dword [esp + 0x64], 1
test bl, 2
je 0x40a67a
and ebx, 0xfffffffd
lea ecx, [esp + 0x44]
mov dword [esp + 0x10], ebx
call fcn.004016a6
mov eax, dword [0x42e170]
mov ecx, eax
not ecx
and ecx, 0x177
neg ecx
sbb ecx, ecx
neg ecx
lea edx, [eax + eax]
or edx, ecx
mov eax, edx
not eax
and eax, 0x177
neg eax
sbb eax, eax
neg eax
add edx, edx
or edx, eax
mov ecx, edx
not ecx
and ecx, 0x177
neg ecx
sbb ecx, ecx
neg ecx
lea eax, [edx + edx]
or eax, ecx
mov dword [0x42e170], eax
mov dword [0x42e174], 0x40033f
test esi, esi
jne 0x40a747
test byte [edi], 1
je 0x40a747
cmp dword [esp + 0x3c], esi
je 0x40a6e8
cmp dword [esp + 0x40], 0x10
lea esi, [esp + 0x2c]
cmovae esi, dword [esp + 0x2c]
lea eax, [ebp + 0x10]
cmp dword [eax + 0x14], 0x10
jb 0x40a6f3
mov eax, dword [eax]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00411e74
pop ecx
pop ecx
mov byte [esp + 0x64], 5
cmp dword [eax + 0x14], 0x10
jb 0x40a70d
mov eax, dword [eax]
push eax
lea eax, [esp + 0x48]
push esi
push eax
call fcn.00411f5a
add esp, 0xc
mov byte [esp + 0x64], 6
push eax
lea ecx, [esp + 0x30]
call fcn.0040fd82
mov byte [esp + 0x64], 5
lea ecx, [esp + 0x44]
call fcn.004016a6
mov byte [esp + 0x64], 1
lea ecx, [esp + 0x14]
call fcn.004016a6
cmp dword [esp + 0x3c], 0
je 0x40a95b
cmp dword [edi + 4], 0
je 0x40a963
cmp dword [esp + 0x40], 0x10
lea eax, [esp + 0x2c]
cmovae eax, dword [esp + 0x2c]
push eax
call fcn.004128fe
pop ecx
mov ecx, dword [0x430e24]
test ecx, ecx
je 0x40a7c9
lea eax, [ecx + 0x470]
push eax
push 1
call fcn.0040e6e9
cmp dword [eax], 0
je 0x40a7c9
mov ecx, dword [0x430e24]
cmp dword [esp + 0x40], 0x10
lea eax, [ecx + 0x470]
push eax
lea esi, [esp + 0x30]
cmovae esi, dword [esp + 0x30]
push 1
call fcn.0040e6e9
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push esi
call dword [eax]
mov ebp, eax
jmp 0x40a7cb
xor ebp, ebp
cmp ebp, 0xffffffff
jne 0x40a7fe
mov esi, dword [esp + 0x70]
and dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
or ebx, 1
mov dword [esp + 0x10], ebx
mov byte [esp + 0x64], 0
lea ecx, [esp + 0x2c]
call fcn.004016a6
mov eax, esi
jmp 0x40a9dc
mov eax, dword [0x42e170]
and dword [esp + 0x74], 0
mov ecx, eax
not ecx
and ecx, 0x177
neg ecx
sbb ecx, ecx
add eax, eax
neg ecx
or eax, ecx
mov dword [0x42e170], eax
mov eax, dword [0x42e174]
push 0xfffffffffffffffe
pop esi
test eax, eax
jne 0x40a843
push 0x44
mov eax, 0x42f66c
push eax
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x42e174]
or eax, 0x325
mov dword [0x42e174], eax
jne 0x40a874
push 0x1eb
mov eax, 0x42f670
push eax
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [0x42e174], 0
jne 0x40a874
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test dword [edi], 0x100
je 0x40a8ea
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov byte [esp + 0x64], 7
push dword [edi + 4]
lea eax, [esp + 0x18]
push dword [edi + 0x24]
push eax
call fcn.0040faaf
add esp, 0xc
test al, al
je 0x40a8da
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x78]
push ecx
push eax
push dword [esp + 0x20]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40a8d7
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x14]
cmp dword [esp + 0x74], eax
jne 0x40a8d7
xor esi, esi
jmp 0x40a8da
or esi, 0xffffffff
mov byte [esp + 0x64], 1
lea ecx, [esp + 0x14]
call fcn.00405040
jmp 0x40a912
push 0
lea eax, [esp + 0x78]
push eax
push dword [edi + 4]
push dword [edi + 0x24]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40a90f
mov eax, dword [esp + 0x74]
cmp eax, dword [edi + 4]
jne 0x40a90f
xor esi, esi
jmp 0x40a912
or esi, 0xffffffff
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40a963
cmp dword [esp + 0x40], 0x10
lea eax, [esp + 0x2c]
cmovae eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [esp + 0x70]
xor eax, eax
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], eax
or ebx, 1
mov byte [esi], al
mov dword [esp + 0x10], ebx
mov byte [esp + 0x64], al
jmp 0x40a7ee
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [esp + 0x70]
lea eax, [esp + 0x2c]
and dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.00404e97
jmp 0x40a7e2
push 0xb
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
mov byte [esp + 0x64], 2
mov ecx, dword [esp + 0x70]
lea eax, [esp + 0x14]
push eax
call fcn.00404be5
mov dword [esp + 0x10], 1
mov byte [esp + 0x64], 1
lea ecx, [esp + 0x14]
call fcn.004016a6
mov byte [esp + 0x64], bl
lea ecx, [esp + 0x2c]
call fcn.004016a6
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10