Function at 0x4126f0
Capabilities:
Check if file exists
Create process on windows
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463116
mov eax, dword fs:[0]
push eax
sub esp, 0x2d8
mov eax, dword [0x47b040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2e0], ecx
mov ebx, dword [ebp + 8]
push 0
mov dword [ebp - 0x22c], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x2dc], eax
test eax, eax
js 0x412cf4
mov ecx, dword [ebx + 4]
mov eax, 0xdd67c8a7
sub ecx, dword [ebx]
xorps xmm0, xmm0
imul ecx
movq qword [ebp - 0x228], xmm0
mov dword [ebp - 0x220], 0
add edx, ecx
mov dword [ebp - 0x228], 0
sar edx, 7
mov eax, edx
mov dword [ebp - 0x224], 0
shr eax, 0x1f
mov dword [ebp - 0x220], 0
add eax, edx
je 0x412874
cmp eax, 0x1bacf91
ja 0x412d1c
imul edi, eax, 0x94
test edi, edi
jne 0x4127ad
xor esi, esi
jmp 0x4127e7
cmp edi, 0x1000
jb 0x4127dc
lea eax, [edi + 0x23]
cmp eax, edi
jbe 0x412d21
push eax
call fcn.0043870c
add esp, 4
test eax, eax
je 0x412d26
lea esi, [eax + 0x23]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x4127e7
push edi
call fcn.0043870c
add esp, 4
mov esi, eax
lea ecx, [edi + esi]
mov dword [ebp - 0x228], esi
lea eax, [ebp - 0x228]
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov edi, dword [ebp - 0x22c]
mov ebx, dword [ebx + 4]
movq qword [ebp - 0x238], xmm0
mov dword [ebp - 0x230], 0
mov edi, dword [edi]
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x230], eax
mov byte [ebp - 4], 1
cmp edi, ebx
je 0x41286e
nop dword [eax]
push edi
mov ecx, esi
call fcn.0040ef40
add esi, 0x94
add edi, 0x94
mov dword [ebp - 0x234], esi
cmp edi, ebx
jne 0x412850
mov dword [ebp - 0x224], esi
lea ecx, [ebp - 0x2d4]
mov dword [ebp - 4], 2
call fcn.0040b170
mov byte [ebp - 4], 3
mov eax, dword [0x47e038]
test al, 1
jne 0x4128c6
or eax, 1
mov dword [0x47e038], eax
push 0x68
push 0
push 0x47dfd0
mov byte [ebp - 4], 4
call fcn.0043a680
add esp, 0xc
call fcn.0041b300
push 0x466210
call fcn.00438a8d
add esp, 4
mov byte [ebp - 4], 3
mov edx, dword [0x47dfd0]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4128d1
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2d0]
call fcn.00408a60
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x2d4]
mov dword [ebp - 0x2d4], 3
push ecx
cmp eax, dword [ebp - 0x220]
je 0x412929
mov edx, eax
call fcn.0040ec70
mov eax, dword [ebp - 0x224]
add esp, 4
add eax, 0x94
mov dword [ebp - 0x224], eax
jmp 0x41293b
push eax
lea ecx, [ebp - 0x228]
call fcn.0040e880
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x2d4]
mov dword [ebp - 0x2d4], 1
push ecx
cmp eax, dword [ebp - 0x220]
je 0x41296a
mov edx, eax
call fcn.0040ec70
add esp, 4
add dword [ebp - 0x224], 0x94
jmp 0x412976
push eax
lea ecx, [ebp - 0x228]
call fcn.0040e880
mov eax, dword [0x47e038]
test al, 1
jne 0x4129b2
or eax, 1
mov dword [0x47e038], eax
push 0x68
push 0
push 0x47dfd0
mov byte [ebp - 4], 5
call fcn.0043a680
add esp, 0xc
call fcn.0041b300
push 0x466210
call fcn.00438a8d
add esp, 4
mov byte [ebp - 4], 3
mov edx, dword [0x47dfd0]
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4129c0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2b8]
call fcn.00408a60
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x2d4]
mov dword [ebp - 0x2d4], 2
push ecx
cmp eax, dword [ebp - 0x220]
je 0x412a11
mov edx, eax
call fcn.0040ec70
add esp, 4
add dword [ebp - 0x224], 0x94
jmp 0x412a1d
push eax
lea ecx, [ebp - 0x228]
call fcn.0040e880
mov eax, dword [0x47e038]
test al, 1
jne 0x412a59
or eax, 1
mov dword [0x47e038], eax
push 0x68
push 0
push 0x47dfd0
mov byte [ebp - 4], 6
call fcn.0043a680
add esp, 0xc
call fcn.0041b300
push 0x466210
call fcn.00438a8d
add esp, 4
mov byte [ebp - 4], 3
mov edx, dword [0x47dfd4]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412a64
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2d0]
call fcn.00408a60
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x2d4]
mov dword [ebp - 0x2d4], 2
push ecx
cmp eax, dword [ebp - 0x220]
je 0x412abd
mov edx, eax
call fcn.0040ec70
mov ecx, dword [ebp - 0x224]
add esp, 4
add ecx, 0x94
mov dword [ebp - 0x224], ecx
jmp 0x412acf
push eax
lea ecx, [ebp - 0x228]
call fcn.0040e880
mov ecx, dword [ebp - 0x224]
sub ecx, dword [ebp - 0x228]
xor edx, edx
mov dword [ebp - 0x2d8], edx
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x412cc1
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor edi, edi
nop
mov eax, dword [ebp - 0x228]
push ecx
mov ecx, dword [ebp - 0x2e0]
add eax, edi
push eax
call fcn.00412d30
mov dword [ebp - 0x2dc], eax
test eax, eax
js 0x412c8a
mov ecx, dword [ebp - 0x228]
cmp dword [ecx + edi + 0x8c], 0
je 0x412c8a
lea eax, [ecx + 0x7c]
add eax, edi
cmp dword [ecx + edi], 3
jne 0x412c1c
cmp dword [eax + 0x14], 7
jbe 0x412b4e
mov eax, dword [eax]
push eax
call ebx
test eax, eax
je 0x412c8a
mov eax, dword [ebp - 0x228]
add eax, edi
push eax
call fcn.00412e00
call fcn.00405000
mov ecx, eax
test ecx, ecx
je 0x412d12
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x22c], eax
push str.barU
lea eax, [ebp - 0x22c]
mov byte [ebp - 4], 7
push str.Task_snPin
push eax
call fcn.00406780
mov eax, dword [ebp - 0x228]
add esp, 0xc
add eax, 0x7c
add eax, edi
cmp dword [eax + 0x14], 7
jbe 0x412bb4
mov eax, dword [eax]
mov esi, dword [ebp - 0x22c]
push 0
push 0
push 0
push eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x228]
add eax, 0x7c
add eax, edi
cmp dword [eax + 0x14], 7
jbe 0x412bdd
mov eax, dword [eax]
push eax
call ebx
test eax, eax
je 0x412bfe
mov eax, dword [ebp - 0x228]
add eax, 0x7c
add eax, edi
cmp dword [eax + 0x14], 7
jbe 0x412bf7
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 3
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x412c8a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x412c8a
cmp dword [eax + 0x14], 7
jbe 0x412c24
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [ebp - 0x228]
cmp dword [esi + edi + 0x2c], 0
je 0x412c8a
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.0043a680
lea eax, [esi + 0x7c]
add esp, 0xc
add eax, edi
cmp dword [eax + 0x14], 7
jbe 0x412c5b
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.00442d30
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 0x224]
mov eax, 0xdd67c8a7
sub ecx, dword [ebp - 0x228]
add edi, 0x94
inc dword [ebp - 0x2d8]
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x2d8], eax
jb 0x412b00
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x2d4]
call fcn.0040ace0
lea ecx, [ebp - 0x228]
call fcn.0040abe0
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00438436
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004022c0
call fcn.00406980
call fcn.00405400
call fcn.00442b30
int3