Function at 0x403eb0
Capabilities:
Check if file exists
Delete file
Set file attributes
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x449590
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x460df4]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x15c], 0x2e
je 0x403f0b
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0x5404
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
xor al, al
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov edi, 0x10
mov dword [esi + 0x94], 3
cmp dword [esi + 0x17c], edi
jb 0x403f2a
mov eax, dword [esi + 0x168]
jmp 0x403f30
lea eax, [esi + 0x168]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x403f7a
cmp dword [esi + 0x17c], edi
jb 0x403f4b
mov eax, dword [esi + 0x168]
jmp 0x403f51
lea eax, [esi + 0x168]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [esi + 0x17c], edi
jb 0x403f6d
mov eax, dword [esi + 0x168]
jmp 0x403f73
lea eax, [esi + 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00418ca8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x403f94
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x3c], 0
call fcn.00418ca8
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x403fc6
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x18], ebp
push 0x99
mov byte [esp + 0x40], 1
call fcn.00418c57
test eax, eax
je 0x403ffc
push 0x99
push eax
lea ecx, [esp + 0x20]
call fcn.00401540
mov ebp, dword [esp + 0x18]
mov ecx, dword [esi + 0x1c]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebp
push 0x5400
push ecx
call ebx
cmp dword [esi + 0x17c], edi
jb 0x404024
mov edx, dword [esi + 0x168]
mov dword [esp + 0x1c], edx
jmp 0x40402e
lea eax, [esi + 0x168]
mov dword [esp + 0x1c], eax
cmp dword [esi + 0x160], edi
jb 0x40403e
mov eax, dword [esi + 0x14c]
jmp 0x404044
lea eax, [esi + 0x14c]
mov edi, dword [esi + 0x9c]
mov ecx, dword [esi + 0x98]
mov edx, dword [ecx]
push 3
push edi
mov edi, dword [esp + 0x24]
push edi
push eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [esi + 0x98]
mov edx, dword [ecx]
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [esi + 0x98]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
push 1
call eax
mov ecx, dword [esi + 0x98]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
and eax, 0xffff0000
cmp eax, 0x20000
je 0x404136
push 0x9a
call fcn.00418c57
test eax, eax
je 0x4040ba
push 0x9a
push eax
lea ecx, [esp + 0x20]
call fcn.00401540
mov ebp, dword [esp + 0x18]
mov ecx, dword [esi + 0x1c]
push 0
push ebp
push 0x5400
push ecx
call ebx
mov esi, dword [esi + 0x98]
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
lea eax, [ebp - 0x10]
mov byte [esp + 0x3c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4040f8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404120
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push 0x9b
call fcn.00418c57
test eax, eax
je 0x404157
push 0x9b
push eax
lea ecx, [esp + 0x20]
call fcn.00401540
mov ebp, dword [esp + 0x18]
mov ecx, dword [esi + 0x1c]
push 0
push ebp
push 0x5400
push ecx
call ebx
mov ecx, dword [esi + 0x98]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
cmp dword [esi + 0x17c], 0x10
jb 0x404183
mov eax, dword [esi + 0x168]
jmp 0x404189
lea eax, [esi + 0x168]
push 0
lea ecx, [esp + 0x24]
push ecx
push eax
call fcn.0040fad0
add esp, 0xc
cmp dword [esp + 0x20], 0
mov edi, eax
je 0x4041ef
lea edx, [esp + 0x14]
push 0x9c
push edx
call fcn.004035c0
mov edi, dword [esp + 0x1c]
mov eax, dword [esi + 0x1c]
add esp, 8
push 0
push edi
push 0x5404
push eax
call ebx
lea eax, [ebp - 0x10]
mov byte [esp + 0x3c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4041e7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
jmp 0x4040ff
push 0x11000
push str.autoupdate.exe
push edi
call fcn.0040ef90
mov ebp, eax
add esp, 0xc
test ebp, ebp
jne 0x404248
push edi
call fcn.0040f890
lea ecx, [esp + 0x18]
push 0x9c
push ecx
call fcn.004035c0
mov edx, dword [esp + 0x20]
mov eax, dword [esi + 0x1c]
add esp, 0xc
push ebp
push edx
push 0x5404
push eax
call ebx
lea ecx, [esp + 0x18]
call fcn.004014a0
lea ecx, [esp + 0x14]
call fcn.004014a0
jmp 0x404120
push 8
lea ecx, [esp + 0x28]
push ecx
push str.autoupdate.exe
push edi
call fcn.0040f200
add esp, 0x10
test eax, eax
je 0x404291
push ebp
call fcn.0040ed30
push edi
call fcn.0040f890
lea edx, [esp + 0x1c]
push 0x9c
push edx
call fcn.004035c0
mov eax, dword [esp + 0x24]
mov ecx, dword [esi + 0x1c]
add esp, 0x10
push 0
push eax
push 0x5404
push ecx
jmp 0x40422f
mov edx, dword [esp + 0x2c]
push edx
call fcn.00416a1f
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4042e2
push ebp
call fcn.0040ed30
push edi
call fcn.0040f890
push ebx
call fcn.00416a24
lea eax, [esp + 0x20]
push 0x9c
push eax
call fcn.004035c0
mov ecx, dword [esp + 0x28]
mov edx, dword [esi + 0x1c]
add esp, 0x14
push ebx
push ecx
push 0x5404
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x404231
mov eax, dword [esp + 0x2c]
push eax
push ebx
push ebp
call fcn.0040ee30
add esp, 0xc
cmp eax, dword [esp + 0x2c]
push ebp
je 0x404336
call fcn.0040ed30
push edi
call fcn.0040f890
push ebx
call fcn.00416a24
lea ecx, [esp + 0x20]
push 0x9c
push ecx
call fcn.004035c0
mov edx, dword [esp + 0x28]
mov eax, dword [esi + 0x1c]
add esp, 0x14
push 0
push edx
push 0x5404
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x404231
call fcn.0040ed30
push edi
call fcn.0040f890
mov ecx, dword [0x462348]
add esp, 8
push ecx
xor edi, edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4043b0
mov edx, dword [0x462348]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [0x462348]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4043b0
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0xa
call ebp
mov ecx, edi
add edi, 1
cmp ecx, 0xa
je 0x40440a
mov edx, dword [0x462348]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [0x462348]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x404380
mov ecx, dword [0x462348]
push 0x44cb00
push ecx
call fcn.00433b5c
mov edi, eax
add esp, 8
test edi, edi
jne 0x404457
lea edx, [esp + 0x14]
push 0x9c
push edx
call fcn.004035c0
mov eax, dword [esi + 0x1c]
add esp, 8
push edi
mov edi, dword [esp + 0x18]
push edi
push 0x5404
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
call fcn.00416a24
mov eax, dword [esp + 0x1c]
add esp, 4
add eax, 0xfffffff0
jmp 0x4041c9
push 0x1e
push 0x44cae0
lea ecx, [esp + 0x1c]
call fcn.00401610
mov edi, dword [esp + 0x14]
mov ecx, dword [esi + 0x1c]
push 0
push edi
push 0x5404
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
call fcn.00416a24
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 4
mov byte [esp + 0x3c], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x4041db
mov ecx, dword [esp + 0x2c]
push edi
push ecx
push 1
push ebx
call fcn.00433a0b
push edi
call fcn.00433875
push ebx
call fcn.00416a24
add esp, 0x18
push 0x9d
call fcn.00418c57
test eax, eax
je 0x404491
push 0x9d
push eax
lea ecx, [esp + 0x20]
call fcn.00401540
mov ebx, dword [esp + 0x18]
mov edx, dword [esi + 0x1c]
push 0
push ebx
push 0x5400
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, 0x10
cmp dword [esi + 0x17c], edi
jb 0x4044bc
mov eax, dword [esi + 0x168]
jmp 0x4044c2
lea eax, [esi + 0x168]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40450c
cmp dword [esi + 0x17c], edi
jb 0x4044dd
mov eax, dword [esi + 0x168]
jmp 0x4044e3
lea eax, [esi + 0x168]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [esi + 0x17c], edi
jb 0x4044ff
mov esi, dword [esi + 0x168]
jmp 0x404505
add esi, 0x168
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebx - 0x10]
mov byte [esp + 0x3c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40452d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404555
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret