Function at 0x41a892
Capabilities:
Delete file
Get file size
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
and dword [esp + 0x10], 0
push ebx
push esi
push edi
mov edi, eax
lea eax, [esp + 0x1c]
push eax
mov ebx, edi
call fcn.0041a6be
test eax, eax
jne 0x41a90d
lea eax, [edi + 0x80]
cmp dword [eax], 0
jbe 0x41a8cf
push 4
push eax
push 2
push dword [esp + 0x28]
call dword [sym.imp.WININET.dll_InternetSetOptionW]
lea eax, [esp + 0x28]
push eax
lea esi, [edi + 0x30]
push esi
push edi
call fcn.0041bc7e
mov ebx, dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
mov dword [esp + 0x18], eax
test eax, eax
je 0x41a914
push eax
lea eax, [edi + 4]
call fcn.0042d1eb
mov esi, dword [esp + 0x18]
push 0
push dword [esp + 0x20]
call ebx
push dword [esp + 0x1c]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0x28]
push ecx
lea ecx, [esp + 0x30]
push esi
lea eax, [edi + 0x2c]
push ecx
call fcn.0041e7e5
mov esi, dword [esp + 0x38]
add esp, 0xc
cmp dword [esi - 0xc], 0
jne 0x41a953
mov eax, 0xe0000005
mov dword [edi + 0x20], eax
push eax
lea eax, [edi + 4]
call fcn.0042d1eb
mov edi, dword [edi + 0x20]
lea eax, [esi - 0x10]
call fcn.004046a2
mov esi, edi
jmp 0x41a8f9
lea eax, [esi - 0x10]
mov dword [esp + 0x10], eax
call fcn.00409a5a
add eax, 0x10
mov dword [esp + 0xc], eax
push 0x44f430
lea eax, [esp + 0x10]
push eax
call fcn.0040217a
lea esi, [edi + 4]
push 1
mov eax, esi
mov dword [esp + 0x18], esi
call fcn.0042d1d3
and dword [esp + 0x20], 0
cmp byte [edi + 0x4c], 0
je 0x41a99d
lea eax, [esp + 0xc]
call fcn.0041f3f1
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x24]
call fcn.0041ae0f
mov dword [esp + 0x18], eax
mov eax, esi
call fcn.0042d1ff
test al, al
je 0x41a9de
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
call fcn.004046a2
mov eax, dword [esp + 0x10]
call fcn.004046a2
mov esi, 0xe0000008
jmp 0x41a8f9
cmp dword [esp + 0x18], 0
je 0x41aa14
cmp dword [esp + 0x18], 0xe0000013
je 0x41a9fa
push dword [esp + 0x18]
mov eax, esi
call fcn.0042d1eb
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
call fcn.004046a2
mov eax, dword [esp + 0x10]
call fcn.004046a2
jmp 0x41a8f5
mov eax, dword [edi + 0x18]
mov ecx, dword [esi]
mov dword [esp + 0x38], eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], edi
test ecx, ecx
je 0x41aa39
push dword [esp + 0x2c]
mov eax, dword [ecx]
push dword [esp + 0x28]
call dword [eax + 8]
mov eax, esi
call fcn.0042d1ff
test al, al
je 0x41aa80
xor esi, esi
mov dword [edi + 0x84], esi
lea edi, [esp + 0x48]
call fcn.0041c0c5
push esi
push dword [esp + 0x3c]
call ebx
push dword [esp + 0x38]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
call fcn.004046a2
mov eax, dword [esp + 0x10]
call fcn.004046a2
jmp 0x41a8f9
mov eax, dword [esp + 0x24]
test eax, eax
jbe 0x41aab1
cmp eax, dword [esp + 0x20]
jne 0x41aab1
mov esi, dword [esi]
test esi, esi
je 0x41aa9d
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0xc]
and dword [edi + 0x84], 0
lea edi, [esp + 0x48]
call fcn.0041c0c5
xor esi, esi
jmp 0x41aa55
push 0
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0040a533
xor ecx, ecx
add esp, 0xc
mov dword [esp + 0x18], eax
cmp eax, ecx
je 0x41aaf4
push eax
mov eax, esi
call fcn.0042d1eb
lea edi, [esp + 0x48]
call fcn.0041c0c5
push 0
push dword [esp + 0x3c]
call ebx
push dword [esp + 0x38]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x41a9fa
xor eax, eax
cmp eax, dword [esp + 0x20]
push ecx
sbb eax, eax
neg eax
push 0x80
inc eax
inc eax
push eax
push ecx
push ecx
push 0xc0000000
lea esi, [esp + 0x24]
call fcn.004020cd
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x40], eax
cmp eax, 0xffffffff
jne 0x41ab86
mov eax, dword [esp + 0x14]
call fcn.0042d1ff
test al, al
je 0x41ab5c
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [esp + 0x48]
call fcn.0041c0c5
push 0
push dword [esp + 0x3c]
call ebx
push dword [esp + 0x38]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x41a9bf
push edi
call fcn.0041c0b2
mov esi, eax
mov eax, dword [esp + 0x14]
push esi
call fcn.0042d1eb
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [esp + 0x48]
call fcn.0041c0c5
push 0
jmp 0x41aa56
xor esi, esi
cmp dword [esp + 0x20], esi
jbe 0x41aba9
push 2
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
cmp ecx, esi
je 0x41abb9
push dword [esp + 0x20]
jmp 0x41abb4
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
cmp ecx, esi
je 0x41abb9
push esi
mov eax, dword [ecx]
call dword [eax + 0x14]
push 0xc800
call fcn.0042e89a
pop ecx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x20]
push eax
push dword [edi + 0x14]
mov eax, edi
call fcn.0041afb1
and dword [esp + 0x30], 0
mov esi, eax
test esi, esi
jne 0x41ac19
cmp dword [esp + 0x20], eax
jbe 0x41aca1
mov eax, 0xc800
cmp dword [esp + 0x20], eax
jae 0x41abfb
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x30]
push ecx
push eax
push dword [esp + 0x20]
mov eax, edi
push dword [edi + 0x14]
call fcn.0041af12
mov esi, eax
test esi, esi
je 0x41ac9a
cmp esi, 0x2ee2
je 0x41ac39
cmp esi, 0x2efe
je 0x41ac39
cmp esi, 0x2eff
je 0x41ac39
cmp esi, 0x2f83
jne 0x41ac6a
cmp dword [esp + 0x28], 3
je 0x41ac47
cmp dword [esp + 0x28], 4
jne 0x41ac6a
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x48]
mov eax, edi
push dword [esp + 0x28]
call fcn.0041ae96
mov esi, eax
test esi, esi
je 0x41abc8
cmp esi, 0xe0000008
je 0x41ac7c
mov eax, dword [esp + 0x14]
push esi
call fcn.0042d1eb
push dword [esp + 0x18]
call fcn.0042e8a5
cmp dword [esp + 0x44], 0
pop ecx
je 0x41ab76
push dword [esp + 0x40]
jmp 0x41ab70
cmp dword [esp + 0x30], 0
jne 0x41acdf
cmp dword [esp + 0x24], 0
jbe 0x41ad56
push 0
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, dword [esp + 0x24]
jae 0x41ad56
cmp dword [esp + 0x28], 3
je 0x41ac47
cmp dword [esp + 0x28], 4
je 0x41ac47
mov esi, 0xe000000f
jmp 0x41ac72
push 0
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x38]
push dword [esp + 0x24]
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41adf4
mov esi, dword [esp + 0x14]
mov ecx, dword [esi]
test ecx, ecx
je 0x41ad13
push dword [esp + 0x34]
mov eax, dword [ecx]
call dword [eax + 0x14]
lea eax, [edi + 0x44]
push eax
call fcn.0042d216
mov eax, esi
call fcn.0042d1ff
test al, al
je 0x41abc8
push dword [esp + 0x18]
xor esi, esi
mov dword [edi + 0x84], esi
call fcn.0042e8a5
pop ecx
cmp dword [esp + 0x40], esi
je 0x41aa4c
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41aa4c
cmp dword [esp + 0x40], 0
je 0x41ad6c
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esp + 0x40], 0
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp + 0x2c]
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
test ecx, ecx
je 0x41ad96
mov eax, dword [ecx]
push 1
call dword [eax + 0xc]
push dword [edi + 0x68]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [esp + 0x18]
and dword [edi + 0x84], 0
call fcn.0042e8a5
cmp dword [esp + 0x44], 0
pop ecx
je 0x41adc1
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [esp + 0x48]
call fcn.0041c0c5
push 0
push dword [esp + 0x3c]
call ebx
push dword [esp + 0x38]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
lea eax, [esi - 0x10]
call fcn.004046a2
mov eax, dword [esp + 0x10]
call fcn.004046a2
xor esi, esi
jmp 0x41a8f9
push edi
call fcn.0041c0b2
mov dword [edi + 0x20], eax
push eax
mov eax, dword [esp + 0x18]
call fcn.0042d1eb
mov esi, dword [edi + 0x20]
jmp 0x41ac7c