Function at 0x411be0
Capabilities:
Check if file exists
Create process on windows
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462416
mov eax, dword fs:[0]
push eax
sub esp, 0x2d8
mov eax, dword [0x47a040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2e0], ecx
mov ebx, dword [ebp + 8]
push 0
mov dword [ebp - 0x22c], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x2dc], eax
test eax, eax
js 0x4121e4
mov ecx, dword [ebx + 4]
mov eax, 0xdd67c8a7
sub ecx, dword [ebx]
xorps xmm0, xmm0
imul ecx
movq qword [ebp - 0x228], xmm0
mov dword [ebp - 0x220], 0
add edx, ecx
mov dword [ebp - 0x228], 0
sar edx, 7
mov eax, edx
mov dword [ebp - 0x224], 0
shr eax, 0x1f
mov dword [ebp - 0x220], 0
add eax, edx
je 0x411d64
cmp eax, 0x1bacf91
ja 0x41220c
imul edi, eax, 0x94
test edi, edi
jne 0x411c9d
xor esi, esi
jmp 0x411cd7
cmp edi, 0x1000
jb 0x411ccc
lea eax, [edi + 0x23]
cmp eax, edi
jbe 0x412211
push eax
call fcn.00437bbc
add esp, 4
test eax, eax
je 0x412216
lea esi, [eax + 0x23]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x411cd7
push edi
call fcn.00437bbc
add esp, 4
mov esi, eax
lea ecx, [edi + esi]
mov dword [ebp - 0x228], esi
lea eax, [ebp - 0x228]
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov edi, dword [ebp - 0x22c]
mov ebx, dword [ebx + 4]
movq qword [ebp - 0x238], xmm0
mov dword [ebp - 0x230], 0
mov edi, dword [edi]
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x230], eax
mov byte [ebp - 4], 1
cmp edi, ebx
je 0x411d5e
nop dword [eax]
push edi
mov ecx, esi
call fcn.0040e430
add esi, 0x94
add edi, 0x94
mov dword [ebp - 0x234], esi
cmp edi, ebx
jne 0x411d40
mov dword [ebp - 0x224], esi
lea ecx, [ebp - 0x2d4]
mov dword [ebp - 4], 2
call fcn.0040a660
mov byte [ebp - 4], 3
mov eax, dword [0x47cfec]
test al, 1
jne 0x411db6
or eax, 1
mov dword [0x47cfec], eax
push 0x64
push 0
push 0x47cf88
mov byte [ebp - 4], 4
call fcn.00439ab0
add esp, 0xc
call fcn.0041a7e0
push 0x4654b0
call fcn.00437f3d
add esp, 4
mov byte [ebp - 4], 3
mov edx, dword [0x47cf88]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411dc1
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2d0]
call fcn.00407f50
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x2d4]
mov dword [ebp - 0x2d4], 3
push ecx
cmp eax, dword [ebp - 0x220]
je 0x411e19
mov edx, eax
call fcn.0040e160
mov eax, dword [ebp - 0x224]
add esp, 4
add eax, 0x94
mov dword [ebp - 0x224], eax
jmp 0x411e2b
push eax
lea ecx, [ebp - 0x228]
call fcn.0040dd70
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x2d4]
mov dword [ebp - 0x2d4], 1
push ecx
cmp eax, dword [ebp - 0x220]
je 0x411e5a
mov edx, eax
call fcn.0040e160
add esp, 4
add dword [ebp - 0x224], 0x94
jmp 0x411e66
push eax
lea ecx, [ebp - 0x228]
call fcn.0040dd70
mov eax, dword [0x47cfec]
test al, 1
jne 0x411ea2
or eax, 1
mov dword [0x47cfec], eax
push 0x64
push 0
push 0x47cf88
mov byte [ebp - 4], 5
call fcn.00439ab0
add esp, 0xc
call fcn.0041a7e0
push 0x4654b0
call fcn.00437f3d
add esp, 4
mov byte [ebp - 4], 3
mov edx, dword [0x47cf88]
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411eb0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2b8]
call fcn.00407f50
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x2d4]
mov dword [ebp - 0x2d4], 2
push ecx
cmp eax, dword [ebp - 0x220]
je 0x411f01
mov edx, eax
call fcn.0040e160
add esp, 4
add dword [ebp - 0x224], 0x94
jmp 0x411f0d
push eax
lea ecx, [ebp - 0x228]
call fcn.0040dd70
mov eax, dword [0x47cfec]
test al, 1
jne 0x411f49
or eax, 1
mov dword [0x47cfec], eax
push 0x64
push 0
push 0x47cf88
mov byte [ebp - 4], 6
call fcn.00439ab0
add esp, 0xc
call fcn.0041a7e0
push 0x4654b0
call fcn.00437f3d
add esp, 4
mov byte [ebp - 4], 3
mov edx, dword [0x47cf8c]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411f54
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2d0]
call fcn.00407f50
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x2d4]
mov dword [ebp - 0x2d4], 2
push ecx
cmp eax, dword [ebp - 0x220]
je 0x411fad
mov edx, eax
call fcn.0040e160
mov ecx, dword [ebp - 0x224]
add esp, 4
add ecx, 0x94
mov dword [ebp - 0x224], ecx
jmp 0x411fbf
push eax
lea ecx, [ebp - 0x228]
call fcn.0040dd70
mov ecx, dword [ebp - 0x224]
sub ecx, dword [ebp - 0x228]
xor edx, edx
mov dword [ebp - 0x2d8], edx
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4121b1
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor edi, edi
nop
mov eax, dword [ebp - 0x228]
push ecx
mov ecx, dword [ebp - 0x2e0]
add eax, edi
push eax
call fcn.00412220
mov dword [ebp - 0x2dc], eax
test eax, eax
js 0x41217a
mov ecx, dword [ebp - 0x228]
cmp dword [ecx + edi + 0x8c], 0
je 0x41217a
lea eax, [ecx + 0x7c]
add eax, edi
cmp dword [ecx + edi], 3
jne 0x41210c
cmp dword [eax + 0x14], 7
jbe 0x41203e
mov eax, dword [eax]
push eax
call ebx
test eax, eax
je 0x41217a
mov eax, dword [ebp - 0x228]
add eax, edi
push eax
call fcn.004122f0
call fcn.00404660
mov ecx, eax
test ecx, ecx
je 0x412202
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x22c], eax
push str.barU
lea eax, [ebp - 0x22c]
mov byte [ebp - 4], 7
push str.Task_snPin
push eax
call fcn.00405a50
mov eax, dword [ebp - 0x228]
add esp, 0xc
add eax, 0x7c
add eax, edi
cmp dword [eax + 0x14], 7
jbe 0x4120a4
mov eax, dword [eax]
mov esi, dword [ebp - 0x22c]
push 0
push 0
push 0
push eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x228]
add eax, 0x7c
add eax, edi
cmp dword [eax + 0x14], 7
jbe 0x4120cd
mov eax, dword [eax]
push eax
call ebx
test eax, eax
je 0x4120ee
mov eax, dword [ebp - 0x228]
add eax, 0x7c
add eax, edi
cmp dword [eax + 0x14], 7
jbe 0x4120e7
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 3
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41217a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x41217a
cmp dword [eax + 0x14], 7
jbe 0x412114
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [ebp - 0x228]
cmp dword [esi + edi + 0x2c], 0
je 0x41217a
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.00439ab0
lea eax, [esi + 0x7c]
add esp, 0xc
add eax, edi
cmp dword [eax + 0x14], 7
jbe 0x41214b
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.004421e0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 0x224]
mov eax, 0xdd67c8a7
sub ecx, dword [ebp - 0x228]
add edi, 0x94
inc dword [ebp - 0x2d8]
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x2d8], eax
jb 0x411ff0
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x2d4]
call fcn.0040a1d0
lea ecx, [ebp - 0x228]
call fcn.0040a0d0
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004378e6
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00401920
call fcn.00407d10
call fcn.00406730
call fcn.00441fe0
int3