Function at 0x406dfc
Capabilities:
Delete file
Write file on windows

Disassembly:
mov eax, 0x416828
call fcn.0040c948
sub esp, 0xa58
mov eax, dword [0x418718]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
push ebx
push ebx
push 0x401734
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
je 0x407355
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40171c
push edi
call esi
push 0x40170c
push edi
mov dword [ebp - 0xa44], eax
call esi
push dword [ebp + 8]
lea ecx, [ebp - 0xa30]
mov dword [ebp - 0xa60], eax
mov dword [ebp - 0xa38], ebx
mov dword [ebp - 4], ebx
call fcn.0040a5bd
mov dword [ebp - 0xa54], ebx
mov dword [ebp - 0xa50], ebx
mov dword [ebp - 0xa58], ebx
mov dword [ebp - 0xa4c], ebx
mov dword [ebp - 0xa5c], 0x401654
cmp dword [ebp - 0xa30], ebx
mov byte [ebp - 4], 2
mov dword [ebp - 0xa40], ebx
je 0x406ed3
push dword [ebp - 0xa30]
call fcn.0040cbda
test eax, eax
pop ecx
jbe 0x406ed3
lea eax, [ebp - 0xa5c]
push eax
push 0x3b
push dword [ebp - 0xa30]
call fcn.0040b046
mov eax, dword [ebp - 0xa58]
add esp, 0xc
mov dword [ebp - 0xa40], eax
cmp dword [ebp + 0xc], ebx
jne 0x4071b8
lea eax, [ebp - 0xa2c]
push eax
push 0x104
call dword [0x4182a8]
cmp eax, ebx
mov esi, 0x80004005
jne 0x406efe
push esi
call fcn.0040b6f5
pop ecx
lea eax, [ebp - 0x824]
push eax
push ebx
push 0x401704
lea eax, [ebp - 0xa2c]
push eax
call dword [0x4182ac]
cmp eax, ebx
jne 0x406f23
push esi
call fcn.0040b6f5
pop ecx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
lea eax, [ebp - 0x824]
push eax
call dword [0x4182b8]
cmp eax, 0xffffffff
mov dword [ebp - 0xa38], eax
jne 0x406f51
push esi
call fcn.0040b6f5
pop ecx
push 0x3f
pop ecx
xor eax, eax
mov byte [ebp - 0x214], bl
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x4016d0
stosb byte es:[edi], al
mov esi, pe_nt_image_headers32
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.004049b1
cmp eax, ebx
jge 0x406f89
push eax
call fcn.0040b6ad
pop ecx
lea eax, [ebp - 0x214]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406f92
push ebx
lea ecx, [ebp - 0xa3c]
push ecx
sub eax, edx
push eax
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0xa38]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
jne 0x406fc6
push 0x8000ffff
call fcn.0040b614
pop ecx
cmp dword [ebp - 0xa30], ebx
je 0x407141
push dword [ebp - 0xa30]
call fcn.0040cbda
test eax, eax
pop ecx
jbe 0x407141
mov dword [ebp - 0xa34], ebx
mov eax, dword [ebp - 0xa34]
cmp eax, dword [ebp - 0xa40]
jge 0x407141
push 0x3f
mov byte [ebp - 0x414], bl
pop ecx
push dword [ebp - 0xa34]
xor eax, eax
lea edi, [ebp - 0x413]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0xa5c]
stosb byte es:[edi], al
call fcn.004069ed
mov ecx, eax
call fcn.0040a770
mov dword [ebp - 0xa48], eax
push ebx
push ebx
push esi
lea ecx, [ebp - 0x414]
push ecx
push 0xffffffffffffffff
push eax
push ebx
push ebx
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, ebx
jne 0x407072
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x40705f
call edi
jmp 0x40706b
call edi
and eax, 0xffff
or eax, 0x80070000
push eax
call fcn.0040b614
pop ecx
push 0x3f
pop ecx
xor eax, eax
mov byte [ebp - 0x114], bl
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x4016b0
stosb byte es:[edi], al
push esi
lea eax, [ebp - 0x114]
push eax
call fcn.004049b1
cmp eax, ebx
jge 0x4070a5
push eax
call fcn.0040b6ad
pop ecx
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x114]
push eax
call fcn.00404f02
cmp eax, ebx
jge 0x4070c4
push eax
call fcn.0040b6ad
pop ecx
push 0x4016ac
push esi
lea eax, [ebp - 0x114]
push eax
call fcn.00404f02
cmp eax, ebx
jge 0x4070e1
push eax
call fcn.0040b6ad
pop ecx
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4070ea
push ebx
lea ecx, [ebp - 0xa3c]
push ecx
sub eax, edx
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0xa38]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
jne 0x40711e
push 0x8000ffff
call fcn.0040b614
pop ecx
cmp dword [ebp - 0xa48], ebx
mov byte [ebp - 4], 2
je 0x407136
push dword [ebp - 0xa48]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
inc dword [ebp - 0xa34]
jmp 0x406fec
push 0x3f
pop ecx
xor eax, eax
mov byte [ebp - 0x314], bl
lea edi, [ebp - 0x313]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x401688
stosb byte es:[edi], al
push esi
lea eax, [ebp - 0x314]
push eax
call fcn.004049b1
lea eax, [ebp - 0x314]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x407172
push ebx
lea ecx, [ebp - 0xa3c]
push ecx
sub eax, esi
push eax
lea eax, [ebp - 0x314]
push eax
push dword [ebp - 0xa38]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
jne 0x4071a6
push 0x8000ffff
call fcn.0040b614
pop ecx
push dword [ebp - 0xa38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa38], ebx
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 1
call edi
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 0xa3c], eax
mov dword [ebp - 0xa64], ebx
lea eax, [ebp - 0x824]
je 0x4071e2
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0xa64]
push ecx
push 0x401574
push 0x401584
push 6
push ebx
push eax
push ebx
push ebx
call dword [ebp - 0xa44]
push dword [ebp - 0xa3c]
mov dword [ebp - 0xa44], eax
call edi
cmp dword [ebp - 0xa44], ebx
jl 0x40736e
xor eax, eax
mov word [ebp - 0x61c], bx
mov ecx, 0x81
lea edi, [ebp - 0x61a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xa3c]
push eax
push 0x104
lea eax, [ebp - 0x61c]
push eax
mov dword [ebp - 0xa3c], ebx
call dword [ebp - 0xa60]
cmp eax, ebx
jge 0x40725b
push eax
call fcn.0040b6ad
pop ecx
lea eax, [ebp - 0x61c]
push eax
call fcn.0040cbda
test eax, eax
pop ecx
jbe 0x40733a
lea eax, [ebp - 0x61c]
push 0x401674
push eax
call fcn.0040cbf0
test eax, eax
pop ecx
pop ecx
jne 0x4072fb
xor edi, edi
cmp edi, dword [ebp - 0xa40]
jge 0x40733a
push 0x401670
lea ecx, [ebp - 0xa34]
call fcn.0040a5ee
push edi
lea ecx, [ebp - 0xa5c]
mov byte [ebp - 4], 4
call fcn.004069ed
push dword [eax]
lea ecx, [ebp - 0xa34]
call fcn.0040a6d6
cmp dword [ebp - 0xa34], ebx
je 0x40731a
push 4
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0xa34]
call fcn.0040cd18
add esp, 0xc
test eax, eax
jne 0x40731a
cmp dword [ebp - 0xa34], ebx
je 0x4072fb
push dword [ebp - 0xa34]
call esi
mov dword [ebp - 0xa34], ebx
lea ecx, [ebp - 0xa5c]
call fcn.00406a1a
cmp dword [ebp - 0xa30], ebx
je 0x407316
push dword [ebp - 0xa30]
call esi
mov al, 1
jmp 0x407357
cmp dword [ebp - 0xa34], ebx
mov byte [ebp - 4], 2
je 0x407334
push dword [ebp - 0xa34]
call esi
mov dword [ebp - 0xa34], ebx
inc edi
jmp 0x407289
lea ecx, [ebp - 0xa5c]
call fcn.00406a1a
cmp dword [ebp - 0xa30], ebx
je 0x407355
push dword [ebp - 0xa30]
call esi
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0040b9d1
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp + 0xc], ebx
jne 0x40733a
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40733a