Function at 0x4015e6
Capabilities:
Check os version
Delete file
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
push ebx
push esi
push edi
push 7
xor ebx, ebx
pop ecx
push ebx
push ebx
xor eax, eax
push 1
mov dword [esp + 0x64], ebx
lea edi, [esp + 0x68]
rep stosd dword es:[edi], eax
mov edi, dword [0x409858]
push ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x409864], eax
cmp eax, ebx
je 0x401662
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x409850], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebx
push 0x47a
mov dword [0x40984c], eax
mov dword [0x409858], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x409848], eax
cmp eax, ebx
jne 0x40165e
or dword [0x409848], 0xffffffff
xor eax, eax
jmp 0x401668
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x401a35
mov dword [esp + 0x18], ebx
xor eax, eax
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x30], 0x14
call dword [sym.imp.USER32.dll_GetCursorInfo]
mov eax, dword [esp + 0x3c]
sub eax, esi
sub eax, edi
add eax, dword [esp + 0x38]
push eax
call fcn.00404530
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
cmp eax, 0xc
je 0x401683
cmp eax, ebx
jne 0x401a35
mov eax, dword [0x409848]
push ebx
call fcn.0040365f
test eax, eax
je 0x4016de
mov dword [0x409854], 1
mov dword [esp + 0x14], 8
push 1
lea eax, [esp + 0x10]
push eax
push dword [0x409858]
call fcn.00404025
test eax, eax
jne 0x401737
mov edi, dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push ebx
push ebx
push dword [esp + 0x14]
call edi
mov esi, eax
cmp esi, ebx
je 0x40172e
lea eax, [esi + esi + 2]
push eax
call fcn.0040112e
mov dword [0x409860], eax
cmp eax, ebx
je 0x40172e
push esi
push eax
push dword [esp + 0x14]
call edi
push dword [esp + 0xc]
call fcn.00401143
jmp 0x401737
mov eax, dword [esp + 0xc]
mov dword [0x409860], eax
push ebx
push 0x80
push 3
xor eax, eax
push ebx
inc eax
push eax
push 0x80000000
push 0x40a674
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401782
push ebx
lea eax, [esp + 0x1c]
push eax
push 4
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40177b
mov dword [esp + 0xc], ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0xc], ebx
je 0x401799
call section..text
cmp eax, ebx
je 0x401799
push 0x32
pop eax
jmp 0x401a35
call fcn.004014bd
mov ecx, dword [0x4098a4]
xor ecx, eax
push ecx
mov dword [0x409814], eax
call fcn.00402b19
mov dword [0x409868], eax
cmp eax, ebx
jne 0x4017d2
push dword [0x40984c]
call fcn.00402b19
mov dword [0x409868], eax
cmp eax, ebx
je 0x4019e2
xor eax, 0xcf8558fc
mov dword [0x409868], eax
call fcn.00401158
test eax, eax
je 0x4019e2
call fcn.004042d3
cmp eax, ebx
jne 0x4019dd
cmp dword [0x409860], ebx
je 0x401807
call fcn.00401240
test eax, eax
jne 0x401856
lea eax, [esp + 0xc]
push eax
call fcn.00404355
test eax, eax
jne 0x401856
cmp dword [esp + 0xc], 0x1000
jne 0x401856
call fcn.00401471
test eax, eax
jne 0x401856
cmp dword [0x409860], ebx
jne 0x401846
push dword [esp + 0x74]
push dword [esp + 0x74]
call fcn.0040309e
mov dword [0x409860], eax
cmp eax, ebx
je 0x401856
push dword [esp + 0x5c]
call fcn.0040314b
push 5
jmp 0x401793
lea esi, [esp + 0x40]
call fcn.0040132c
test eax, eax
jne 0x40186a
push 0xb
jmp 0x401793
cmp byte [0x409850], 5
push ebx
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x28], 0xc
mov dword [esp + 0x30], ebx
push 1
jbe 0x40188e
push section..bss
jmp 0x401893
push 0x40a0d3
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA
push dword [0x40980c]
lea eax, [esp + 0x24]
push ebx
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edi, eax
mov esi, 0xb7
cmp edi, ebx
je 0x4018e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jne 0x4018da
push edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x58]
push eax
mov eax, dword [esp + 0x18]
and al, 8
movzx eax, al
neg eax
sbb eax, eax
and eax, 0xffffff00
add eax, 0x200
call fcn.0040441e
cmp eax, esi
je 0x40192b
cmp eax, ebx
jne 0x4019d1
push dword [0x409860]
call fcn.00404148
push eax
push dword [esp + 0x5c]
call fcn.00402f9e
test eax, eax
je 0x4019d1
mov eax, dword [ebp + 8]
xor esi, esi
cmp eax, ebx
je 0x401982
mov edi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x22
add eax, 2
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x401982
push 0x20
push esi
call edi
mov esi, eax
cmp esi, ebx
je 0x401982
push esi
xor eax, eax
call fcn.004029a6
mov esi, eax
cmp esi, ebx
je 0x401982
push 0x4073ac
push esi
call dword [sym.imp.SHLWAPI.dll_StrTrimW]
cmp word [esi], bx
jne 0x401982
push esi
push ebx
push dword [0x409808]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x14], esi
call fcn.0040416a
cmp eax, ebx
jne 0x4019dd
push dword [0x409810]
lea eax, [esp + 0x24]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
cmp esi, ebx
je 0x4019d1
or dword [esp + 0x1c], 0xffffffff
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
push esi
mov dword [esp + 0x30], 0xff676980
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
cmp eax, 0xffffffff
jne 0x4019e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x10], ebx
je 0x401a35
mov esi, 0xbb8
push 0x80
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x401a14
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x401a33
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x401a24
cmp eax, 0x20
jne 0x401a33
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esi, 0x64
cmp esi, ebx
jg 0x4019f3
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4