Function at 0x40fd54
Capabilities:
Bypass windows file protection
Get file attributes
Read file on windows
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov eax, 0xb3cc
call fcn.0041d9c0
push ebx
push ebp
push esi
push edi
push str.kernel32
mov byte [esp + 0x17], 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x40fdc9
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.SetDllDirectoryW
push esi
call edi
mov bl, byte [esp + 0xb3e0]
test eax, eax
je 0x40fda1
movzx ecx, bl
neg ecx
sbb ecx, ecx
and ecx, 0x4322e4
push ecx
call eax
push str.SetDefaultDllDirectories
push esi
call edi
test eax, eax
je 0x40fdc9
xor ecx, ecx
test bl, bl
sete cl
dec ecx
and ecx, 0xfffff800
add ecx, 0x1000
push ecx
call eax
mov byte [esp + 0x13], 1
mov eax, dword [str.xlistpos]
or ebp, 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov esi, 0x800
mov dword [esp + 0x18], str.version.dll
mov dword [esp + 0x1c], str.DXGIDebug.dll
cmp byte [eax], 0x78
mov dword [esp + 0x20], str.sfc_os.dll
mov dword [esp + 0x24], str.SSPICLI.DLL
mov dword [esp + 0x28], str.rsaenh.dll
mov dword [esp + 0x2c], str.UXTheme.dll
mov dword [esp + 0x30], str.dwmapi.dll
mov dword [esp + 0x34], str.cryptbase.dll
mov dword [esp + 0x38], str.lpk.dll
mov dword [esp + 0x3c], str.usp10.dll
mov dword [esp + 0x40], str.clbcatq.dll
mov dword [esp + 0x44], str.comres.dll
mov dword [esp + 0x48], str.ws2_32.dll
mov dword [esp + 0x4c], str.ws2help.dll
mov dword [esp + 0x50], str.psapi.dll
mov dword [esp + 0x54], str.ieframe.dll
mov dword [esp + 0x58], str.ntshrui.dll
mov dword [esp + 0x5c], str.atl.dll
mov dword [esp + 0x60], str.setupapi.dll
mov dword [esp + 0x64], str.apphelp.dll
mov dword [esp + 0x68], str.userenv.dll
mov dword [esp + 0x6c], str.netapi32.dll
mov dword [esp + 0x70], str.shdocvw.dll
mov dword [esp + 0x74], str.crypt32.dll
mov dword [esp + 0x78], str.msasn1.dll
mov dword [esp + 0x7c], str.cryptui.dll
mov dword [esp + 0x80], str.wintrust.dll
mov dword [esp + 0x84], str.shell32.dll
mov dword [esp + 0x88], str.secur32.dll
mov dword [esp + 0x8c], str.cabinet.dll
mov dword [esp + 0x90], str.oleaccrc.dll
mov dword [esp + 0x94], str.ntmarta.dll
mov dword [esp + 0x98], str.profapi.dll
mov dword [esp + 0x9c], str.WindowsCodecs.dll
mov dword [esp + 0xa0], str.srvcli.dll
mov dword [esp + 0xa4], str.cscapi.dll
mov dword [esp + 0xa8], str.slc.dll
mov dword [esp + 0xac], str.imageres.dll
mov dword [esp + 0xb0], str.dnsapi.DLL
mov dword [esp + 0xb4], str.iphlpapi.DLL
mov dword [esp + 0xb8], str.WINNSI.DLL
mov dword [esp + 0xbc], str.netutils.dll
mov dword [esp + 0xc0], str.mpr.dll
mov dword [esp + 0xc4], str.devrtl.dll
mov dword [esp + 0xc8], str.propsys.dll
mov dword [esp + 0xcc], str.mlang.dll
mov dword [esp + 0xd0], str.samcli.dll
mov dword [esp + 0xd4], str.samlib.dll
mov dword [esp + 0xd8], str.wkscli.dll
mov dword [esp + 0xdc], str.dfscli.dll
mov dword [esp + 0xe0], str.browcli.dll
mov dword [esp + 0xe4], str.rasadhlp.dll
mov dword [esp + 0xe8], str.dhcpcsvc6.dll
mov dword [esp + 0xec], str.dhcpcsvc.dll
mov dword [esp + 0xf0], str.XmlLite.dll
mov dword [esp + 0xf4], str.linkinfo.dll
mov dword [esp + 0xf8], str.cryptsp.dll
mov dword [esp + 0xfc], str.RpcRtRemote.dll
mov dword [esp + 0x100], str.aclui.dll
mov dword [esp + 0x104], str.dsrole.dll
mov dword [esp + 0x108], str.peerdist.dll
je 0x4100fe
push eax
call fcn.004266d8
mov edi, eax
pop ecx
test edi, edi
je 0x4100fe
push esi
lea eax, [esp + 0x1318]
push eax
push 0
call ebx
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push 0x80000000
lea eax, [esp + 0x132c]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, ebp
je 0x4100f2
push 0
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, edi
jne 0x4100f2
push 0
lea eax, [esp + 0x18]
push eax
push 0x7ffe
lea eax, [esp + 0x33e8]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x4100f2
mov eax, dword [esp + 0x14]
shr eax, 1
xor ecx, ecx
push 0x104
mov word [esp + eax*2 + 0x33e0], cx
lea eax, [esp + 0x110]
push eax
lea eax, [esp + 0x33e4]
push eax
jmp 0x4100e7
lea eax, [esp + 0x10c]
push eax
call fcn.0040fd0a
push 0x104
lea eax, [esp + 0x110]
push eax
push edi
call fcn.0040f85f
mov edi, eax
test edi, edi
jne 0x4100cc
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, 0x800
push esi
lea eax, [esp + 0x318]
push eax
push 0
call ebx
push esi
lea eax, [esp + 0x318]
push eax
call fcn.0040b9d7
push eax
lea eax, [esp + 0x23e4]
push eax
call fcn.0040fadb
mov ebx, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
xor edi, edi
xor esi, esi
call fcn.0040aa30
cmp eax, 0x600
jb 0x410148
push dword [esp + esi*4 + 0x18]
call fcn.0040fd0a
jmp 0x41014a
xor eax, eax
test eax, eax
je 0x41016e
push ebp
push str.DXGIDebug.dll
push ebp
push dword [esp + esi*4 + 0x24]
push 0x1001
push 0x400
call dword [sym.imp.KERNEL32.DLL_CompareStringW]
cmp eax, 2
jne 0x410192
push 0x800
push dword [esp + esi*4 + 0x1c]
lea eax, [esp + 0x31c]
push eax
call fcn.0040ba4d
lea eax, [esp + 0x314]
push eax
call ebx
cmp eax, ebp
jne 0x41019a
inc esi
cmp esi, 8
jb 0x410131
jmp 0x41019e
mov edi, dword [esp + esi*4 + 0x18]
cmp byte [esp + 0x13], 0
jne 0x4101d7
xor esi, esi
push 0x800
push dword [esp + esi*4 + 0x3c]
lea eax, [esp + 0x31c]
push eax
call fcn.0040ba4d
lea eax, [esp + 0x314]
push eax
call ebx
cmp eax, ebp
jne 0x4101d3
inc esi
cmp esi, 0x35
jb 0x4101a7
jmp 0x4101d7
mov edi, dword [esp + esi*4 + 0x38]
test edi, edi
je 0x4102e6
lea eax, [esp + 0x314]
push eax
call fcn.0040ba21
call fcn.0040aa30
cmp eax, 0x600
jb 0x41025e
push str.dwmapi.dll
call fcn.0040fd0a
push str.uxtheme.dll
call fcn.0040fd0a
lea eax, [esp + 0x23dc]
push eax
lea eax, [esp + 0x318]
push eax
push edi
push 0xf1
call fcn.0040da82
push eax
lea eax, [esp + 0x1324]
push 0x864
push eax
call fcn.00403f52
add esp, 0x18
push 0x30
push 0xf0
call fcn.0040da82
push eax
lea eax, [esp + 0x131c]
push eax
push 0
call fcn.004197a8
jmp 0x4102de
lea eax, [esp + 0x23dc]
push eax
lea eax, [esp + 0x318]
push eax
push edi
push str.Please_remove__s_from__s_folder._It_is_unsecure_to_run__s_until_it_is_done.
lea eax, [esp + 0x1324]
push 0x864
push eax
call fcn.00403f52
add esp, 0x18
call dword [sym.imp.KERNEL32.DLL_AllocConsole]
test eax, eax
je 0x4102de
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.DLL_AttachConsole]
push 0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x131c]
push eax
call fcn.00422b93
pop ecx
push eax
lea eax, [esp + 0x1320]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteConsoleW]
push 0x2710
call dword [sym.imp.KERNEL32.DLL_Sleep]
call dword [sym.imp.KERNEL32.DLL_FreeConsole]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb3cc
ret 4