Function at 0x413d00
Capabilities:
Check if file exists
Delete file
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4aa190
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
mov eax, dword [0x4c2080]
push ebx
push ebp
mov ebp, dword [esp + 0x58]
push esi
push edi
test ebp, ebp
mov ebx, ecx
mov dword [esp + 0x10], eax
je 0x413d83
mov ecx, ebp
shr ecx, 0x10
jne 0x413d49
mov eax, ebp
lea ecx, [esp + 0x10]
and eax, 0xffff
push eax
call fcn.00405320
jmp 0x413d83
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x413d83
push esi
lea ecx, [esp + 0x14]
call fcn.004056f0
test eax, eax
je 0x413d83
lea ecx, [esi + esi]
lea edx, [esi + esi + 2]
cmp edx, ecx
jb 0x413d83
mov edi, dword [esp + 0x10]
mov eax, ecx
mov esi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x58], 0
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edx, dword [0x4c2080]
mov esi, eax
test esi, esi
mov dword [esp + 0x60], edx
je 0x413def
shr eax, 0x10
jne 0x413dbd
and esi, 0xffff
lea ecx, [esp + 0x60]
push esi
call fcn.00405320
jmp 0x413def
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test edi, edi
je 0x413def
push edi
lea ecx, [esp + 0x64]
call fcn.004056f0
test eax, eax
je 0x413def
mov eax, dword [esp + 0x60]
lea ecx, [edi + edi]
push ecx
lea edx, [edi + edi + 2]
push esi
push edx
push eax
call fcn.00404a40
add esp, 0x10
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x18]
push ebp
rep stosd dword es:[edi], eax
mov ecx, 0xf
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x68]
mov byte [esp + 0x5c], 1
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x1c], 0x40
mov dword [esp + 0x24], str.open
mov dword [esp + 0x28], ebp
mov dword [esp + 0x20], eax
mov dword [esp + 0x34], 5
mov dword [esp + 0x2c], ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x413f27
mov edx, dword [esp + 0x24]
push edx
call fcn.004429a0
add esp, 4
test eax, eax
je 0x413f27
mov eax, dword [esp + 0x24]
push eax
call fcn.00405fc0
add esp, 4
test eax, eax
jne 0x413f27
mov ecx, ebx
call fcn.004131a0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x4d1ad0
call fcn.00403910
mov esi, dword [esp + 0x24]
push 1
call fcn.00442630
push eax
push esi
call fcn.00442880
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x60]
mov edx, dword [0x4c2084]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x413eed
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x413eed
mov edx, dword [esp + 0x60]
add edx, 0xfffffff4
push edx
call fcn.00442ac0
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x4c2084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x413fe4
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x413fe4
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00442ac0
add esp, 4
xor eax, eax
jmp 0x414060
push ebp
call fcn.00405fc0
add esp, 4
test eax, eax
jne 0x413fe8
lea eax, [esp + 0x64]
mov ecx, ebx
push eax
call fcn.00414080
push 0
lea ecx, [esp + 0x64]
push eax
push ecx
push 0x33
mov ecx, 0x4d1ad0
mov byte [esp + 0x68], 2
call fcn.004044d0
mov eax, dword [esp + 0x64]
mov ecx, dword [0x4c2084]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x413f8e
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x413f8e
mov eax, dword [esp + 0x64]
add eax, 0xfffffff4
push eax
call fcn.00442ac0
add esp, 4
mov eax, dword [esp + 0x60]
mov edx, dword [0x4c2084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x413fb9
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x413fb9
mov edx, dword [esp + 0x60]
add edx, 0xfffffff4
push edx
call fcn.00442ac0
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x4c2084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x413fe4
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x413fe4
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00442ac0
add esp, 4
xor eax, eax
jmp 0x414060
lea eax, [esp + 0x14]
push eax
call fcn.00442ab0
mov esi, eax
add esp, 4
test esi, esi
jne 0x414035
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x64]
mov edi, eax
push ecx
mov ecx, ebx
call fcn.00414080
push edi
lea edx, [esp + 0x64]
push eax
push edx
push 0x32
mov ecx, 0x4d1ad0
mov byte [esp + 0x68], 3
call fcn.004044d0
lea ecx, [esp + 0x64]
mov byte [esp + 0x58], 1
call fcn.004056c0
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 0x60]
neg esi
sbb esi, esi
mov byte [esp + 0x58], 0
and esi, eax
call fcn.004056c0
lea ecx, [esp + 0x10]
mov dword [esp + 0x58], 0xffffffff
call fcn.004056c0
mov eax, esi
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c
ret 8