Function at 0x410f0e
Capabilities:
Check if file exists
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3130
call fcn.0041b440
push ebx
push esi
push edi
push str.kernel32
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x410f80
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetDllDirectoryW
push edi
call esi
cmp eax, ebx
je 0x410f58
movzx ecx, byte [ebp + 8]
neg ecx
sbb ecx, ecx
and ecx, 0x42b5cc
push ecx
call eax
push str.SetDefaultDllDirectories
push edi
call esi
cmp eax, ebx
je 0x410f80
xor ecx, ecx
cmp byte [ebp + 8], bl
sete cl
dec ecx
and ecx, 0xfffff800
add ecx, 0x1000
push ecx
call eax
mov byte [ebp - 1], 1
mov esi, 0x800
push esi
lea eax, [ebp - 0x1068]
push eax
push ebx
mov dword [ebp - 0x1c], str.version.dll
mov dword [ebp - 0x18], str.DXGIDebug.dll
mov dword [ebp - 0x14], str.sfc_os.dll
mov dword [ebp - 0x10], str.SSPICLI.DLL
mov dword [ebp - 0xc], str.rsaenh.dll
mov dword [ebp - 8], str.UXTheme.dll
mov dword [ebp - 0x68], str.lpk.dll
mov dword [ebp - 0x64], str.usp10.dll
mov dword [ebp - 0x60], str.clbcatq.dll
mov dword [ebp - 0x5c], str.comres.dll
mov dword [ebp - 0x58], str.ws2_32.dll
mov dword [ebp - 0x54], str.ws2help.dll
mov dword [ebp - 0x50], str.psapi.dll
mov dword [ebp - 0x4c], str.ieframe.dll
mov dword [ebp - 0x48], str.ntshrui.dll
mov dword [ebp - 0x44], str.atl.dll
mov dword [ebp - 0x40], str.setupapi.dll
mov dword [ebp - 0x3c], str.apphelp.dll
mov dword [ebp - 0x38], str.userenv.dll
mov dword [ebp - 0x34], str.netapi32.dll
mov dword [ebp - 0x30], str.shdocvw.dll
mov dword [ebp - 0x2c], str.crypt32.dll
mov dword [ebp - 0x28], str.msasn1.dll
mov dword [ebp - 0x24], str.cryptui.dll
mov dword [ebp - 0x20], str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
lea eax, [ebp - 0x1068]
push eax
call fcn.0040a61f
push eax
lea eax, [ebp - 0x3130]
push eax
call fcn.00410bc5
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp + 8], ebx
push esi
push dword [ebp + ebx*4 - 0x1c]
lea eax, [ebp - 0x1068]
push eax
call fcn.0040a789
lea eax, [ebp - 0x1068]
push eax
call edi
cmp eax, 0xffffffff
jne 0x41108d
inc ebx
cmp ebx, 6
jb 0x411066
jmp 0x411094
mov eax, dword [ebp + ebx*4 - 0x1c]
mov dword [ebp + 8], eax
cmp byte [ebp - 1], 0
jne 0x4110ca
xor ebx, ebx
push esi
push dword [ebp + ebx*4 - 0x68]
lea eax, [ebp - 0x1068]
push eax
call fcn.0040a789
lea eax, [ebp - 0x1068]
push eax
call edi
cmp eax, 0xffffffff
jne 0x4110c3
inc ebx
cmp ebx, 0x13
jb 0x41109c
jmp 0x4110ca
mov eax, dword [ebp + ebx*4 - 0x68]
mov dword [ebp + 8], eax
xor esi, esi
cmp dword [ebp + 8], esi
je 0x4111aa
lea eax, [ebp - 0x1068]
push eax
call fcn.0040a837
call fcn.00409c4a
cmp eax, 0x600
lea eax, [ebp - 0x3130]
push eax
lea eax, [ebp - 0x1068]
push eax
push dword [ebp + 8]
jb 0x411139
push 0xf1
call fcn.0040c3e7
push eax
lea eax, [ebp - 0x2130]
push 0x864
push eax
call fcn.00411ca1
add esp, 0x18
push 0x30
push pe_nt_image_headers32
call fcn.0040c3e7
push eax
lea eax, [ebp - 0x2130]
push eax
push esi
call fcn.0041a382
jmp 0x4111a3
push str.Please_remove__s_from__s_folder._It_is_unsecure_to_run__s_until_it_is_done.
lea eax, [ebp - 0x2130]
push 0x864
push eax
call fcn.00411ca1
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
je 0x4111a3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push esi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2130]
push eax
call fcn.0041b107
pop ecx
push eax
lea eax, [ebp - 0x2130]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
leave
ret 4