Function at 0x409fb0
Capabilities:
Check mutex on windows
Delete directory
Delete file
Delete registry key
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x46c
mov eax, dword [0x518450]
xor eax, esp
mov dword [esp + 0x464], eax
push ebx
push ebp
push esi
push edi
push str.MUTEX_XREVEAL
push 1
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40a02b
push ebx
push str.XrevealWndClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x40a02b
push 0x24
push ebx
push 0xf7e5d6ac
mov edx, 0x865dc797
mov ecx, 0xd719f172
call fcn.00401485
pop ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40a318
push ebx
push ebx
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x268]
push 1
push 0x10
push eax
push ebx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x268]
push eax
call ebx
lea esi, [esp + 0x268]
mov edx, 0xd12c4377
push 0xa094526c
mov ecx, 0x8068767e
lea esi, [esi + eax*2]
call fcn.00401485
pop ecx
sub esi, eax
movzx ecx, word [eax]
mov word [esi + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x40a071
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x268]
push eax
call ebp
push 1
push 0x17
lea eax, [esp + 0x270]
push eax
push 0
call edi
lea eax, [esp + 0x268]
push eax
call ebx
lea esi, [esp + 0x268]
mov edx, 0x7f5d9dc7
push 0xee58cdc
mov ecx, 0x2e19a8aa
lea esi, [esi + eax*2]
call fcn.00401485
pop ecx
sub esi, eax
movzx ecx, word [eax]
mov word [esi + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x40a0cb
lea eax, [esp + 0x268]
push eax
call ebp
push 0x104
lea eax, [esp + 0x26c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x268]
push 0x5c
push eax
call fcn.004bb2a8
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40a227
push 0xf741d8ff
mov edx, 0x86f9c9e5
mov ecx, 0xd7bdfc94
add esi, 2
call fcn.00401485
mov edx, esi
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x40a130
lea eax, [esp + 0x268]
push eax
call ebp
push 0x2f8db68a
mov edx, 0x5e35a790
mov ecx, 0xf7192c7
call fcn.00401485
mov edx, esi
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x40a162
lea eax, [esp + 0x268]
push eax
call ebp
push 0xeec9739e
mov edx, 0x9f716287
mov ecx, 0xce35573a
call fcn.00401485
mov edx, esi
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x40a194
and dword [esp + 0x18], 0
lea eax, [esp + 0x1c]
push 0x24c
push 0
push eax
call fcn.004bf040
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40a227
lea edi, [esi + 0x12]
lea eax, [esp + 0x44]
sub edi, eax
lea ecx, [esp + 0x44]
movzx eax, word [ecx]
mov word [edi + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x40a1e3
lea eax, [esp + 0x268]
push eax
call ebp
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40a1df
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov word [esi + 0x12], ax
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 0x268]
call fcn.0040dcf4
push 0x8f30e9b4
mov edx, 0xfe88f8aa
mov ecx, 0xafcccd37
mov esi, eax
call fcn.00401485
mov edx, esi
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x40a24e
lea eax, [esp + 0x268]
push eax
call ebp
xor eax, eax
mov word [esi], ax
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [esp + 0x268]
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push eax
call fcn.004bad3c
lea esi, [esp + 0x270]
mov edx, 0x113104dd
push 0x608915c1
mov ecx, 0x40753136
add esi, eax
call fcn.0040145b
add esp, 0xc
sub esi, eax
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x40a2ae
lea eax, [esp + 0x14]
push eax
push 0x2000e
push 0
lea eax, [esp + 0x274]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a2f4
push 0x4ef5ec
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor cl, cl
call fcn.0040d420
push dword [0x52aaf0]
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
xor ecx, ecx
call fcn.00408ee8
call fcn.00409d51
mov ecx, dword [esp + 0x474]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b9a6c
add esp, 0x46c
ret