Function at 0x402340
Capabilities:
Delete file
Set file attributes

Disassembly:
sub esp, 0x22c
mov al, byte [0x41b8cc]
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x13c], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x13d]
push 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ebp, dword [esp + 0x244]
push ebp
call fcn.00402050
add esp, 4
test eax, eax
je 0x402574
mov eax, dword [0x4170b4]
test eax, eax
jne 0x4023ae
push 0x41d504
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0
push 0
push 0x202
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push ebp
lea ecx, [esp + 0x140]
push str.WARNING____Autorun_file_is_detected__n___________________________________________________________________nFound___s__nDo_you_want_to_remove_it_
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov esi, str.unchecked
mov eax, 0x4170d0
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4023f7
test cl, cl
je 0x4023f3
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4023f7
add eax, 2
add esi, 2
test cl, cl
jne 0x4023cf
xor eax, eax
jmp 0x4023fc
sbb eax, eax
sbb eax, 0xffffffff
mov edi, dword [esp + 0x240]
test eax, eax
jne 0x402428
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esp + 0x248]
test eax, eax
jne 0x4024bf
mov esi, str.unchecked
mov eax, 0x4170d0
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x402469
test cl, cl
je 0x402465
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x402469
add eax, 2
add esi, 2
test cl, cl
jne 0x402441
xor eax, eax
jmp 0x40246e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4024bf
push 0x24
lea eax, [esp + 0x140]
push 0x41d504
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x4024bf
mov edi, 0x41b8cc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 2
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x22c
ret
mov edi, 0x41b8cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80
mov eax, ecx
mov esi, edi
mov edi, edx
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
push ebp
call ebx
test eax, eax
jne 0x402513
push 0xc8
inc esi
call edi
cmp esi, 0x32
jl 0x4024ff
push 0x417264
push ebp
call fcn.0040d536
add esp, 8
test eax, eax
jne 0x40256b
mov cl, byte [0x41b8cc]
lea edi, [esp + 0x11]
mov byte [esp + 0x10], cl
mov ecx, 0x4a
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebp
lea edx, [esp + 0x14]
push str.Remove__s_OK
push edx
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x1c]
push eax
call fcn.00404fc0
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x22c
ret
push eax
call fcn.0040d4c0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x22c
ret