Function at 0x4144a0
Capabilities:
Delete file
Get disk information
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x417c4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf7c
push ebx
mov ebx, dword [esp + 0x40]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
cmp esi, 0x1c428
jge 0x4144e5
call ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, 0x1ea07db9
jle 0x4144fd
cmp edi, 0xad121a
je 0x4144fd
cmp ebx, 0x8c67878
jne 0x414506
inc esi
cmp esi, 0x8c70231e
jb 0x4144d5
cmp dword [0x7dd864], 0x12
jne 0x41454a
push 0
call fcn.0040806b
add esp, 4
push 0
call fcn.0040809b
add esp, 4
lea eax, [esp + 0x80]
push eax
call fcn.00405e10
push 0
mov dword [esp + 0xf98], 0
call fcn.004081c9
add esp, 4
call fcn.004081eb
mov eax, 0x38d6
add dword [0x7dd864], eax
mov ecx, dword [0x7dd864]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
mov edi, dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
mov dword [0x7da8c4], eax
mov eax, dword [0x7dd864]
mov dword [esp + 0x10], 0x963510
mov edi, edi
cmp eax, 3
jne 0x4145a2
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, dword [0x7dd864]
cmp eax, 0xbc5
jne 0x4146cf
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
call ebp
push 0
lea edx, [esp + 0x78c]
push edx
call ebx
push 0x403fd8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x404040
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
push 0
push 0
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0
push 0
push 0
call edi
lea eax, [esp + 0x68]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnfix]
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
xor eax, eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x44]
push edx
push eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
push 0x404068
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0x404080
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobSet]
push 0x404178
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x4041bc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
lea eax, [esp + 0x14]
push eax
push 0
push 0x4041cc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
xor eax, eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
mov eax, dword [0x7dd864]
dec dword [esp + 0x10]
jne 0x414590
xor esi, esi
test eax, eax
je 0x414700
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
call fcn.004141e0
mov eax, dword [0x7dd864]
cmp eax, 0x29
jne 0x4146fb
call edi
mov eax, dword [0x7dd864]
inc esi
cmp esi, eax
jb 0x4146e5
cmp eax, 0x19c
jne 0x41476c
push 0
lea edx, [esp + 0x14]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0x404208
call dword [sym.imp.KERNEL32.dll_FindAtomW]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x404238
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeExA]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0x4042a8
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push 0
push 0x4042c8
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edi, dword [sym.imp.USER32.dll_GetMenu]
mov esi, 0x8dc
push 0
call edi
dec esi
jne 0x414777
mov esi, dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
mov edi, 0x250a9
mov ebx, 0x92
mov edi, edi
cmp dword [0x7dd864], ebx
jne 0x4147a1
push 0x4042ec
push 0
call esi
dec edi
jne 0x414790
mov byte [0x43d760], 0
call fcn.00413cf0
call fcn.00414470
call fcn.004141c0
mov edi, dword [sym.imp.USER32.dll_DefDlgProcW]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, 0xf2b8b
mov ebp, 0x21
cmp dword [0x7dd864], ebp
jne 0x4147e6
push 0
push 0
push 0
push 0
call edi
push 0
call esi
dec ebx
jne 0x4147d0
call fcn.004142a0
cmp dword [0x7dd864], 0xd5c
mov byte [0x43d761], 0x73
jne 0x4148ae
lea edx, [esp + 0x128]
push edx
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push edi
lea ecx, [esp + 0x38c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
push edi
lea edx, [esp + 0x78c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
push 0x404304
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push edi
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push 0x404320
call esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
lea eax, [esp + 0x268]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseActCtx]
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
call fcn.004141d0
mov ecx, dword [esp + 0xf8c]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret