Function at 0x418b00
Capabilities:
Delete file
Get common file path
Query environment variable
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x617a2a
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x69cffc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x274], edi
cmp dword [0x6aa43c], 0
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x26c], esi
mov dword [ebp - 0x260], ebx
je 0x418b7d
cmp dword [eax], 0xffffffff
je 0x4195e1
or esi, 0xffffffff
xchg dword [eax], esi
push 2
push esi
call dword [sym.imp.WS2_32.dll_shutdown]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x4195e1
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.SYSTEMDRIVE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418ba0
sub ecx, edx
sar ecx, 1
jne 0x418bcc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov word [ebp - 0x212], ax
call fcn.0044a657
mov ecx, eax
test ecx, ecx
je 0x4195ff
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x25c], eax
mov eax, str._SYSTEMDRIVE_Callv2.3_
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x25c]
test eax, 0xffff0000
jne 0x418c0d
movzx eax, ax
push eax
call fcn.00402c80
jmp 0x418c19
push 0x17
push str._SYSTEMDRIVE_Callv2.3_
call fcn.00402df0
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 1
push eax
push str._SYSTEMDRIVE_
lea ecx, [ebp - 0x25c]
call fcn.0040b6b0
mov al, byte [esi]
mov byte [ebp - 0x249], al
push ebx
movzx eax, al
push eax
push ecx
mov esi, esp
mov dword [ebp - 0x254], esi
call fcn.0044a657
mov ecx, eax
test ecx, ecx
je 0x419609
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.Recieved_0x_x__d_bytes
mov byte [ebp - 4], 2
mov ecx, esi
test eax, 0xffff0000
jne 0x418c83
movzx eax, ax
push eax
call fcn.00402c80
jmp 0x418c8f
push 0x16
push str.Recieved_0x_x__d_bytes
call fcn.00402df0
push 0
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 1
push eax
push 0x6aa3bc
call fcn.00409fa0
mov edx, dword [ebp - 0x258]
or ebx, 0xffffffff
add esp, 0x18
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x418cc9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [ebp - 0x249]
mov esi, dword [ebp - 0x25c]
cmp al, 0x43
jne 0x41917b
push 0
call fcn.005ef5a2
add esp, 4
sub eax, dword [edi + 0x10]
sbb edx, dword [edi + 0x14]
mov dword [ebp - 0x260], edx
js 0x419153
jg 0x418d04
cmp eax, 0x3c
jbe 0x419153
mov ecx, dword [ebp - 0x26c]
mov edi, dword [ecx + 1]
lea eax, [edi + 1]
push eax
call fcn.00447f05
lea edx, [edi + 5]
mov dword [ebp - 0x250], eax
mov ecx, 5
add esp, 4
cmp edx, ecx
jbe 0x418d4e
mov ebx, dword [ebp - 0x26c]
mov esi, eax
mov al, byte [ebx + ecx]
mov byte [esi + ecx - 5], al
inc ecx
cmp ecx, edx
jb 0x418d33
mov esi, dword [ebp - 0x25c]
or ebx, 0xffffffff
mov eax, dword [ebp - 0x250]
mov byte [eax + edi], 0
call fcn.0044a657
mov ecx, eax
test ecx, ecx
je 0x419613
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x270], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x270]
push dword [ebp - 0x250]
call fcn.004029a0
mov byte [ebp - 4], 4
push dword [ebp - 0x250]
call fcn.00447f00
mov eax, dword [ebp - 0x26c]
mov al, byte [eax + edi + 5]
mov edi, esp
mov byte [0x69dc00], al
lea eax, [esi - 0x10]
mov dword [ebp - 0x260], edi
push eax
mov dword [ebp - 0x260], eax
call fcn.004027b0
add eax, 0x10
add esp, 4
mov dword [edi], eax
lea eax, [ebp - 0x258]
mov edi, dword [ebp - 0x274]
mov ecx, edi
push eax
call fcn.00418920
mov edx, dword [ebp - 0x258]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x418df2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x250]
mov dword [ebp - 0x258], eax
call fcn.0044a657
mov ecx, eax
test ecx, ecx
je 0x41961d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x250], eax
mov eax, str.1.2.0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x250]
test eax, 0xffff0000
jne 0x418e3c
movzx eax, ax
push eax
call fcn.00402c80
jmp 0x418e48
push 5
push str.1.2.0
call fcn.00402df0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x270]
add eax, 0xfffffff0
push eax
mov dword [ebp - 0x258], eax
call fcn.004027b0
add esp, 4
lea ecx, [eax + 0x10]
mov dword [ebp - 0x26c], ecx
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x250]
test eax, eax
je 0x419627
nop
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x418eae
test dx, dx
je 0x418ea2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x418eae
add ecx, 4
add eax, 4
test dx, dx
jne 0x418e80
mov dword [ebp - 0x254], 0
jmp 0x418eb9
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x254], ecx
mov byte [ebp - 4], 7
mov eax, ebx
mov edx, dword [ebp - 0x26c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x418eda
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
mov eax, ebx
mov edx, dword [ebp - 0x250]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x418efb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x254], 0
je 0x419125
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.004046d0
lea ecx, [ebp - 0x248]
push ecx
push dword [eax]
call fcn.005f1d5d
mov edx, dword [ebp - 0x254]
add esp, 0x14
cmp eax, 0xffffffff
mov eax, ebx
setne byte [ebp - 0x249]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x418f57
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x249], 0
je 0x419091
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.004046d0
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x254]
test eax, eax
mov eax, ebx
sete byte [ebp - 0x249]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x418fac
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x249], 0
je 0x419091
push ecx
mov esi, esp
mov dword [ebp - 0x274], esi
call fcn.0044a657
mov ecx, eax
test ecx, ecx
je 0x419631
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.Delete_failed.
mov byte [ebp - 4], 9
mov ecx, esi
test eax, 0xffff0000
jne 0x418ff8
movzx eax, ax
push eax
call fcn.00402c80
jmp 0x419004
push 0xe
push str.Delete_failed.
call fcn.00402df0
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 4
push eax
push 0x6aa3bc
call fcn.00418280
mov edx, dword [ebp - 0x254]
add esp, 0xc
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x419039
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi]
mov ecx, dword [ebp - 0x268]
push 0
push 0
push 0xf2
push ecx
mov ecx, edi
call dword [eax + 0x14]
mov byte [ebp - 4], 1
mov eax, ebx
mov edx, dword [ebp - 0x258]
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41906e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x260]
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4195e1
mov ecx, dword [edx]
push edx
jmp 0x4195dc
cmp dword [0x6aa438], 0
je 0x4190fc
mov ecx, dword [ebp - 0x268]
cmp dword [ecx], 0xffffffff
je 0x4190bf
mov edi, ebx
xchg dword [ecx], edi
push 2
push edi
call dword [sym.imp.WS2_32.dll_shutdown]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov edi, dword [ebp - 0x274]
xorps xmm0, xmm0
movq qword [ebp - 0x264], xmm0
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 0xa
call fcn.0040af20
push 0
call fcn.005ef5a2
add esp, 4
mov byte [ebp - 4], 4
cmp dword [ebp - 0x260], 0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
jne 0x41963b
jmp 0x419144
cmp dword [edi + 0x20], 0xffffffff
je 0x419144
mov eax, dword [edi]
mov ecx, dword [ebp - 0x268]
push 0
push 0
push 0x10
push ecx
mov ecx, edi
call dword [eax + 0x14]
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x258]
jmp 0x4195b1
mov ecx, dword [ebp - 0x268]
cmp dword [ecx], 0xffffffff
je 0x419144
mov edi, ebx
xchg dword [ecx], edi
push 2
push edi
call dword [sym.imp.WS2_32.dll_shutdown]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x258]
jmp 0x4195b1
mov ecx, dword [ebp - 0x268]
cmp dword [ecx], 0xffffffff
je 0x4195c5
mov edi, ebx
xchg dword [ecx], edi
push 2
push edi
call dword [sym.imp.WS2_32.dll_shutdown]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x4195c5
cmp al, 0x44
jne 0x419437
push 0
call fcn.005ef5a2
mov dword [edi + 0x10], eax
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0x25c]
mov dword [edi + 0x14], edx
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.004046d0
push 0x66ecf0
push dword [eax]
call fcn.005f219b
add esp, 0x18
mov dword [ebp - 0x254], eax
test eax, eax
je 0x4191e6
mov ecx, dword [ebp - 0x260]
push eax
dec ecx
push ecx
mov ecx, dword [ebp - 0x26c]
inc ecx
push 1
push ecx
call fcn.005f2082
push dword [ebp - 0x254]
call fcn.005f1ddf
add esp, 0x14
mov edx, dword [ebp - 0x270]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x419203
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.004046d0
push 0x66ece8
mov dword [ebp - 0x250], 0
push dword [eax]
lea eax, [ebp - 0x250]
push eax
call fcn.005f21b2
mov eax, dword [ebp - 0x250]
add esp, 0x18
test eax, eax
je 0x41927e
push 2
push 0
push eax
call fcn.005f2f57
push dword [ebp - 0x250]
call fcn.005f2c75
push dword [ebp - 0x250]
mov dword [ebp - 0x260], eax
call fcn.005f2525
push dword [ebp - 0x250]
call fcn.005f1ddf
mov eax, dword [ebp - 0x260]
add esp, 0x18
mov edx, dword [ebp - 0x254]
mov dword [ebp - 0x258], eax
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4192a1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x258]
test eax, eax
je 0x419399
push eax
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x270]
push eax
call fcn.004046d0
add esp, 0xc
mov byte [ebp - 4], 0xb
push dword [eax]
push ecx
mov dword [ebp - 0x260], esp
call fcn.0044a657
mov ecx, eax
test ecx, ecx
je 0x419640
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [ebp - 0x260]
add eax, 0x10
mov dword [ecx], eax
mov eax, str.Write_OK.__s__d
mov byte [ebp - 4], 0xc
test eax, 0xffff0000
jne 0x419319
movzx eax, ax
push eax
call fcn.00402c80
jmp 0x419325
push 0xf
push str.Write_OK.__s__d
call fcn.00402df0
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 0xb
push eax
push 0x6aa3bc
call fcn.00418280
mov edx, dword [ebp - 0x254]
add esp, 0x14
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41935a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, ebx
mov edx, dword [ebp - 0x270]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41937b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi]
lea ecx, [ebp - 0x258]
push 4
push ecx
mov ecx, dword [ebp - 0x268]
push 0x11
push ecx
mov ecx, edi
call dword [eax + 0x14]
jmp 0x4195c5
push ecx
mov dword [ebp - 0x260], esp
call fcn.0044a657
mov ecx, eax
test ecx, ecx
je 0x41964a
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [ebp - 0x260]
add eax, 0x10
mov dword [ecx], eax
mov eax, str.Write_failed.
mov byte [ebp - 4], 0xd
test eax, 0xffff0000
jne 0x4193da
movzx eax, ax
push eax
call fcn.00402c80
jmp 0x4193e6
push 0xd
push str.Write_failed.
call fcn.00402df0
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 1
push eax
push 0x6aa3bc
call fcn.00418280
mov edx, dword [ebp - 0x254]
add esp, 0xc
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41941b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi]
mov ecx, dword [ebp - 0x268]
push 0
push 0
push 0xf1
push ecx
mov ecx, edi
call dword [eax + 0x14]
jmp 0x4195c5
cmp al, 0x46
jne 0x4195c5
lea eax, [edi + 4]
mov dword [ebp - 0x258], 0
push eax
mov dword [ebp - 0x270], eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.004046d0
mov byte [ebp - 4], 0xe
push 0x66ece8
push dword [eax]
lea eax, [ebp - 0x250]
mov dword [ebp - 0x250], 0
push eax
call fcn.005f21b2
mov eax, dword [ebp - 0x250]
add esp, 0x18
test eax, eax
jne 0x419498
xor edi, edi
jmp 0x4194f5
push 2
push 0
push eax
call fcn.005f2f57
push dword [ebp - 0x250]
call fcn.005f2c75
push dword [ebp - 0x250]
mov edi, eax
call fcn.005f2525
push edi
call fcn.00447f05
push dword [ebp - 0x250]
mov dword [ebp - 0x258], eax
push edi
push 1
push eax
call fcn.005f23ea
push dword [ebp - 0x250]
mov edi, eax
call fcn.005f1ddf
xor eax, eax
add esp, 0x2c
cmp eax, edi
sbb eax, eax
and eax, edi
mov dword [ebp - 0x260], eax
mov edi, eax
mov byte [ebp - 4], 1
mov eax, ebx
mov edx, dword [ebp - 0x254]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x419516
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor al, al
xor edx, edx
test edi, edi
jle 0x419548
mov esi, dword [ebp - 0x258]
xor al, byte [edx + esi]
mov cl, 8
nop dword [eax]
test al, al
jns 0x419536
xor al, 0xec
add al, al
add cl, 0xff
jne 0x419530
inc edx
cmp edx, edi
jl 0x419524
mov esi, dword [ebp - 0x25c]
mov ecx, dword [ebp - 0x26c]
movzx eax, al
cmp dword [ecx + 1], eax
jne 0x419584
push ecx
lea eax, [esi - 0x10]
mov edi, esp
push eax
mov dword [ebp - 0x260], edi
call fcn.004027b0
mov ecx, dword [ebp - 0x268]
add esp, 4
add eax, 0x10
mov dword [edi], eax
push ecx
mov ecx, dword [ebp - 0x274]
call fcn.00419660
jmp 0x4195c5
push dword [ebp - 0x270]
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.004046d0
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x260]
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4195c5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4195e1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058f0d5
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00403270
push 0x80004005
call fcn.00403270
push 0x80004005
call fcn.00403270
push 0x80004005
call fcn.00403270
push 0x80004005
call fcn.00403270
push 0x80004005
call fcn.00403270
call fcn.005f8fa5
push 0x80004005
call fcn.00403270
push 0x80004005
call fcn.00403270
int3