Function at 0x4021e0
Capabilities:
Check if file exists
Create process on windows
Delete file
Get file attributes
Hide graphical window
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
cmp byte [0x4044a4], 0
jne 0x402209
push 5
push dword [0x404460]
call sub.USER32.DLL_ShowWindow
push 0
push dword [0x404464]
call sub.USER32.DLL_ShowWindow
push 0
push 0
push 0x184
push dword [0x404460]
call sub.USER32.DLL_SendMessageA
push 0x40434a
call fcn.00401360
push 0x404299
call fcn.00401360
call fcn.004011b0
push 1
push 3
call fcn.00401050
test eax, eax
je 0x4023e7
mov dword [ebp - 4], eax
jmp 0x402267
lea esp, [esp]
inc ecx
push ecx
push 3
call fcn.00401050
or eax, eax
je 0x402262
cmp eax, dword [ebp - 4]
jne 0x402267
jmp 0x4023e7
mov dword [ebp - 8], 0
mov ecx, dword [0x404424]
push ecx
mov esi, eax
lea eax, [esi + 0x22]
push 0x40435b
call fcn.00401360
movzx ebx, byte [esi + 1]
push ebx
push dword [esi + 6]
push eax
call fcn.00401490
test eax, eax
je 0x40239d
mov eax, dword [esi + 2]
or eax, eax
je 0x4022c6
cmp dword [0x4048ad], eax
je 0x4022ba
push 0x40413f
call fcn.00401360
jmp 0x40239d
push 0x404162
call fcn.00401360
jmp 0x4022d0
push 0x40416f
call fcn.00401360
cmp dword [esi + 0xa], 0
je 0x402309
push dword [0x4048b1]
push dword [0x4048ad]
call section..nsp0
cmp dword [esi + 0xa], eax
je 0x4022fd
push 0x404107
call fcn.00401360
jmp 0x40239d
push 0x40411b
call fcn.00401360
jmp 0x402313
push 0x40412b
call fcn.00401360
cmp byte [esi + 1], 1
jne 0x402362
mov eax, 0x22e
add eax, dword [0x404420]
push esi
push eax
push 3
push dword [0x4048b1]
call fcn.00402760
or eax, eax
jne 0x40234f
push 0x4041af
call fcn.00401360
push dword [0x4048ad]
pop dword [0x4048b9]
jmp 0x402360
push 0x4041c4
call fcn.00401360
mov dword [ebp - 8], 1
jmp 0x40239d
mov eax, dword [esi + 0x16]
lea esi, [eax + esi]
mov edi, dword [0x4048b1]
mov edi, edi
cmp dword [esi], 0
jne 0x40237c
cmp word [esi + 4], 0
je 0x40239d
lodsd eax, dword [esi]
xchg ecx, eax
lodsb al, byte [esi]
cmp byte [ecx + edi], al
je 0x402390
push 0x404187
call fcn.00401360
jmp 0x40239d
lodsb al, byte [esi]
mov byte [ecx + edi], al
mov dword [ebp - 8], 1
jmp 0x40236e
cmp dword [ebp - 8], 0
jne 0x4023bb
push dword [0x4048ad]
pop dword [0x4048b9]
push 0x404225
call fcn.00401360
jmp 0x4023c5
push 0x404236
call fcn.00401360
push dword [ebp - 8]
call fcn.00401650
push 0x404290
call fcn.00401360
push 0x404299
call fcn.00401360
pop ecx
jmp 0x40224c
push 1
push 4
call fcn.00401050
test eax, eax
je 0x402537
mov dword [ebp - 4], eax
jmp 0x402417
lea ecx, [ecx]
inc ecx
push ecx
push 4
call fcn.00401050
or eax, eax
je 0x402412
cmp eax, dword [ebp - 4]
jne 0x402417
jmp 0x402537
mov dword [ebp - 8], 0
mov ecx, dword [0x404424]
push ecx
mov esi, eax
lea eax, [esi + 0x22]
push 0x40436a
call fcn.00401360
movzx ebx, byte [esi + 1]
push ebx
push dword [esi + 6]
push eax
call fcn.00401490
test eax, eax
je 0x4024f9
cmp byte [esi + 1], 1
jne 0x402499
mov eax, 0x22e
add eax, dword [0x404420]
push esi
push eax
push 4
push dword [0x4048b1]
call fcn.00402760
or eax, eax
jne 0x402486
push 0x4041af
call fcn.00401360
push dword [0x4048ad]
pop dword [0x4048b9]
jmp 0x402497
push 0x4041c4
call fcn.00401360
mov dword [ebp - 8], 1
jmp 0x4024f9
mov eax, dword [esi + 0x16]
lea esi, [eax + esi]
nop
mov ecx, dword [esi]
mov ebx, dword [esi + 4]
push ebx
push dword [0x4048ad]
push ecx
lea eax, [esi + ecx*2 + 8]
add eax, ecx
push eax
lea eax, [esi + ecx*2 + 8]
push eax
lea eax, [ecx + esi + 8]
push eax
lea eax, [esi + 8]
push eax
push dword [0x4048b1]
call fcn.004028a0
pushal
test eax, eax
jne 0x4024e8
cmp dword [esi + ecx*4 + 8], 0
je 0x4024e5
push 0x4041d5
call fcn.00401360
jmp 0x4024ef
popal
jmp 0x4024f9
mov dword [ebp - 8], 1
popal
lea esi, [esi + ecx*4 + 8]
cmp dword [esi], 0
jne 0x40249f
cmp dword [ebp - 8], 0
jne 0x40250b
push 0x404225
call fcn.00401360
jmp 0x402515
push 0x404236
call fcn.00401360
push dword [ebp - 8]
call fcn.00401650
push 0x404290
call fcn.00401360
push 0x404299
call fcn.00401360
pop ecx
jmp 0x4023fd
push 1
push 5
call fcn.00401050
test eax, eax
je 0x4025f4
mov dword [ebp - 4], eax
xor esi, esi
jmp 0x402567
nop
inc ecx
push ecx
push 5
call fcn.00401050
or eax, eax
je 0x402562
cmp eax, dword [ebp - 4]
jne 0x402567
jmp 0x4025f4
mov ecx, dword [0x404424]
push ecx
mov esi, eax
lea eax, [esi + 9]
push 0x404383
call fcn.00401360
push dword [esi + 1]
push eax
push 0x404249
call fcn.00402c84
test eax, eax
je 0x4025ba
mov edi, 0x4044a5
mov byte [edi], 0
push 0x404259
push edi
call sub.KERNEL32.DLL_lstrcatA
push 0x404249
push edi
call sub.KERNEL32.DLL_lstrcatA
push 0
push edi
call sub.KERNEL32.DLL_WinExec
cmp eax, 0x1f
ja 0x4025c6
push 0x4041fb
call fcn.00401360
jmp 0x4025d0
push 0x404212
call fcn.00401360
push 0x404249
call sub.KERNEL32.DLL_DeleteFileA
push 0x404290
call fcn.00401360
push 0x404299
call fcn.00401360
pop ecx
jmp 0x40254f
push 1
push 7
call fcn.00401050
test eax, eax
je 0x402737
mov dword [ebp - 4], eax
jmp 0x402627
lea ebx, [ebx]
inc ecx
push ecx
push 7
call fcn.00401050
or eax, eax
je 0x402622
cmp eax, dword [ebp - 4]
jne 0x402627
jmp 0x402737
mov ecx, dword [0x404424]
push ecx
mov esi, eax
lea edi, [esi + 0xd]
mov ebx, dword [esi + 5]
lea ebx, [ebx + esi]
push 0x200
push 0x4044a5
push edi
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov edi, 0x4044a5
push 0x404394
call fcn.00401360
push edi
call fcn.00401360
push edi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4026b1
cmp byte [0x404963], 0
jne 0x402687
push 0x24
push edi
push 0x4043a2
push dword [0x404444]
call sub.USER32.DLL_MessageBoxA
jmp 0x40269c
cmp byte [0x404965], 1
jne 0x402697
mov eax, 6
jmp 0x40269c
mov eax, 7
cmp eax, 6
jne 0x4026ac
push 0x80
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
cmp eax, 7
je 0x40271d
cmp byte [edi + 1], 0x3a
jne 0x4026dc
cmp byte [edi + 2], 0x5c
jne 0x4026dc
push edi
push 0x404b66
call sub.KERNEL32.DLL_lstrcpyA
push 0x404b66
call fcn.00401300
push 0x404b66
call fcn.00402f30
push dword [esi + 1]
push ebx
push edi
call fcn.00402c84
or eax, eax
jne 0x4026f6
push 0x404269
call fcn.00401360
jmp 0x40271d
mov eax, dword [esi + 9]
or eax, eax
je 0x402713
push eax
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
cmp eax, 1
jne 0x402713
push 0x4043c1
call fcn.00401360
push 0x404280
call fcn.00401360
push 0x404290
call fcn.00401360
push 0x404299
call fcn.00401360
pop ecx
jmp 0x40260a
push 0x4043d5
call fcn.00401360
push 1
push 0
push 0
push dword [0x404444]
call sub.USER32.DLL_RedrawWindow
leave
ret