Function at 0x401560
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xa0c
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.FILEOPEN.EXE
push 0x409da4
call edi
cmp dword [0x408030], 1
jne 0x40158c
push str.FileOpen.api
jmp 0x401591
push str.DocShield.api
push 0x409ba4
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x40a0a4
call ebp
call fcn.00401510
mov esi, dword [esp + 0xa20]
cmp byte [esi], 0x20
jne 0x4015bf
lea eax, [esi + 1]
push eax
push esi
call edi
jmp 0x4015b1
push esi
call ebp
xor ecx, ecx
mov dword [esp + 0x18], eax
test eax, eax
jle 0x4015e8
mov ebx, 0x4099a4
mov edx, esi
sub ebx, esi
mov al, byte [edx]
cmp al, 0x20
je 0x4015e8
mov byte [ebx + edx], al
mov eax, dword [esp + 0x18]
inc ecx
inc edx
cmp ecx, eax
jl 0x4015d5
mov byte [ecx + 0x4099a4], 0
lea ecx, [ecx + esi + 1]
push ecx
push 0x40a6a4
call edi
push 0x4099a4
call ebp
dec eax
test eax, eax
jle 0x401626
mov cl, 0x5c
cmp byte [eax + 0x4099a4], cl
je 0x401618
dec eax
test eax, eax
jg 0x401609
jmp 0x401626
lea edx, [eax + 0x4099a5]
push edx
push 0x4098a4
call edi
push 0x4098a4
call ebp
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x4098a4
push str._sexe
push 0x40a4a4
mov byte [eax + 0x4098a1], 0
call esi
add esp, 0xc
push 0x4099a4
push 0x40b9a0
call edi
push 0x40b9a0
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, 0x40b9a0
sub ecx, 3
push 0x4081dc
push 0x40b9a0
mov byte [eax + ecx], 0
call ebx
push 0x40b9a0
push 0x40a5a4
call edi
push 0x4081d8
push 0x4098a4
call ebx
push 0x40a5a4
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x8000080
push 2
push 0
push 3
push 0x40000000
push 0x40a5a4
call edi
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4016fd
push 0x40a5a4
lea edx, [esp + 0x20]
push str.Cannot_write:__s
push edx
call esi
add esp, 0xc
lea eax, [esp + 0x1c]
push 0
push str.Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa0c
ret
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
push 0x40a0a4
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401759
push 0x40a0a4
lea ecx, [esp + 0x20]
push str.Cannot_read:__s
push ecx
call esi
add esp, 0xc
lea edx, [esp + 0x1c]
push 0
push str.Error
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa0c
ret
lea eax, [esp + 0x10]
push 0
push eax
push 0x1000
push 0x40a6e0
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 0
push ecx
push edx
push 0x40a6e0
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp ecx, eax
jl 0x40179e
cmp eax, 0x1000
jl 0x4017cb
jmp 0x401759
push 0
push 0x4093ec
push str.Disk_Full
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa0c
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push 1
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
push 0x4099a4
mov dword [0x40b6e4], eax
call edi
mov edi, eax
cmp edi, 0xffffffff
jne 0x40183e
push 0x4099a4
lea eax, [esp + 0x20]
push str.Cannot_read:__s
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x1c]
push 0
push str.Error
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebp
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa0c
ret
lea edx, [esp + 0x10]
push 0
push edx
push 0x1000
push 0x40a6e0
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 0
push eax
push ecx
push 0x40a6e0
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp ecx, eax
jl 0x401954
cmp eax, 0x1000
jge 0x40183e
push edi
call ebx
push 1
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x409ba4
push 0x40a3a4
push str._s_s
push 0x409ca4
mov dword [0x40b6e0], eax
call esi
add esp, 0x10
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
push 0x409ca4
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40190f
push 0x409ca4
lea edx, [esp + 0x20]
push str.Cannot_read:__s
push edx
call esi
add esp, 0xc
lea eax, [esp + 0x1c]
push 0
push str.Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebp
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa0c
ret
lea ecx, [esp + 0x10]
push 0
push ecx
push 0x1000
push 0x40a6e0
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push 0
push edx
push eax
push 0x40a6e0
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp ecx, eax
jl 0x401954
cmp eax, 0x1000
jl 0x40197b
jmp 0x40190f
push 0
push 0x4093ec
push str.Disk_Full
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
call ebx
push ebp
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa0c
ret
push edi
call ebx
mov ecx, 0x400
xor eax, eax
mov edi, 0x40a6e0
rep stosd dword es:[edi], eax
mov ecx, dword [0x40b6e4]
push ecx
push str.__ld
push 0x40a6e0
call esi
push 0x4098a4
push 0x408194
push 0x40a6ea
call esi
mov edx, dword [0x40b6e0]
push edx
push 0x408190
push 0x40a760
call esi
push 0x409ba4
push 0x408194
push 0x40a76a
call esi
push 0x40b73d
push 0x408194
push 0x40a77a
call esi
push 0x40b75b
push 0x408194
push 0x40a78f
call esi
add esp, 0x48
push 0x40b76f
push 0x408194
push 0x40a7ac
call esi
push 0x40a6a4
push 0x408194
push 0x40a7e0
call esi
push 0x40b6f0
push 0x408194
push 0x40a7f4
call esi
push 0x40b722
push 0x408194
push 0x40a826
call esi
push 0x40b727
push 0x408194
push 0x40a82b
call esi
push 0x40b72a
push 0x408194
push 0x40a82e
call esi
add esp, 0x48
push 0x40b72d
push 0x408194
push 0x40a831
call esi
push 0x40b730
push 0x408194
push 0x40a834
call esi
push 0x40b733
push 0x408194
push 0x40a837
call esi
add esp, 0x24
lea eax, [esp + 0x14]
push 0
push eax
push 0x200
push 0x40a6e0
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
call ebx
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0c
ret