Function at 0x40d4c0
Capabilities:
Check if file exists
Copy file
Create process on windows
Delete file
Get file attributes
Hide graphical window
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x20], 0
mov ebx, ecx
mov edi, dword [ebp + 8]
push str.winguarddll
mov dword [ebp - 0x1c], ebx
push dword [edi]
call fcn.0046b1da
add esp, 8
test eax, eax
je 0x40dae8
push str.winguard
push dword [edi]
call fcn.0046b1da
add esp, 8
test eax, eax
je 0x40dae8
push str.winguard_x64dll
push dword [edi]
call fcn.0046b1da
add esp, 8
test eax, eax
je 0x40dae8
push str.winguard_x64
push dword [edi]
call fcn.0046b1da
add esp, 8
test eax, eax
je 0x40dae8
mov eax, dword [edi + 8]
push ecx
sub eax, 0x10
mov esi, esp
push eax
call fcn.00403380
add esp, 4
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.00423d40
test al, al
je 0x40dba4
push edi
mov ecx, ebx
call fcn.0040e7e0
cmp byte [edi + 0x24], 0
je 0x40d599
push str.saayaa
mov ecx, edi
call fcn.0040ebb0
test eax, eax
jne 0x40d599
lea esi, [eax + 0xa]
nop dword [eax + eax]
push ecx
mov ecx, esp
push str.f_saayaa
call fcn.00403710
mov ecx, ebx
call fcn.00424cc0
sub esi, 1
jne 0x40d580
lea ecx, [ebp - 0xc]
call fcn.00407480
lea ecx, [ebp - 8]
call fcn.00407480
cmp byte [edi + 0x27], 0
je 0x40d830
push dword [edi + 8]
lea eax, [ebp - 0xc]
push dword [ebx + 0x594]
push str._supgrade_s
push eax
call fcn.0041ad10
push dword [edi + 8]
lea eax, [ebp - 8]
push dword [ebx + 0x594]
push 0x4a6b18
push eax
call fcn.0041ad10
add esp, 0x20
mov ecx, edi
push 0x4a55a0
call fcn.0040ebb0
test eax, eax
jne 0x40d64b
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.0041d350
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
jle 0x40d643
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
push eax
call fcn.004073e0
push ecx
lea eax, [ebp - 0xc]
mov ecx, esp
push eax
call fcn.004073e0
mov ecx, ebx
call fcn.0042d9b0
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.0041d530
push eax
lea ecx, [ebp - 8]
call fcn.00409a20
lea ecx, [ebp - 0x18]
call fcn.00409060
lea ecx, [ebp - 0x14]
call fcn.00409060
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x40d664
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x18]
call fcn.00407480
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
push ecx
mov ebx, esp
lea eax, [edi - 0x10]
push eax
call fcn.00403380
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.0041b590
add esp, 4
mov byte [ebp - 1], al
lea ecx, [edi - 0x10]
mov ebx, esp
push ecx
call fcn.00403380
add eax, 0x10
add esp, 4
mov dword [ebx], eax
mov ebx, dword [ebp - 0x1c]
mov ecx, ebx
call fcn.00424470
mov byte [ebp - 2], al
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.0041d210
mov ecx, dword [ebp + 8]
push eax
add ecx, 0x10
push ecx
call fcn.00409eb0
add esp, 0x10
test al, al
je 0x40d6e0
cmp byte [ebp - 1], 0
je 0x40d6e0
cmp byte [ebp - 2], 0
mov byte [ebp - 1], 1
jne 0x40d6e4
mov byte [ebp - 1], 0
lea ecx, [ebp - 0x14]
call fcn.00409060
cmp byte [ebp - 1], 0
je 0x40d803
push 0
push esi
push edi
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, eax
mov dword [ebp - 0x10], ecx
test ecx, ecx
jne 0x40d7ef
cmp ecx, 0x14
jge 0x40d7eb
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d731
push esi
call fcn.00431f10
add esp, 4
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
inc dword [ebp - 0x14]
push 0xc8
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x14
jg 0x40d76f
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40d714
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x18]
call fcn.00409060
jmp 0x40d8cc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d7e8
lea ecx, [ebp - 0x14]
call fcn.00407480
push str.._d.tmp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040a190
add esp, 0xc
mov ebx, dword [eax]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.0041ad10
add esp, 0xc
lea ecx, [ebp - 0x20]
call fcn.00409060
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x40d7dd
push 4
push 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
call fcn.00409060
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40d823
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x18]
call fcn.00409060
jmp 0x40d8cc
push ecx
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.004073e0
push ecx
lea eax, [ebp - 0xc]
mov ecx, esp
push eax
call fcn.004073e0
call fcn.0040add0
add esp, 8
lea ecx, [ebp - 0x18]
call fcn.00409060
jmp 0x40d8cc
push str.saayaa
mov ecx, edi
call fcn.0040ebb0
test eax, eax
jne 0x40d8c6
push dword [edi + 8]
lea eax, [ebp - 0xc]
push dword [ebx + 0x594]
push str._supgrade_s
push eax
call fcn.0041ad10
add esp, 0x10
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.0041d690
push eax
lea ecx, [ebp - 8]
call fcn.00409a20
lea ecx, [ebp - 0x20]
call fcn.00409060
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d8c9
push ecx
lea eax, [ebp - 8]
mov ecx, esp
push eax
call fcn.004073e0
push ecx
lea eax, [ebp - 0xc]
mov ecx, esp
push eax
call fcn.004073e0
push edi
mov ecx, ebx
call fcn.0042dbb0
push str.upgrade_f_saayaa.exe
push str.saayaa.exe
lea ecx, [ebp - 8]
call fcn.00404290
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40d8c9
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
cmp byte [eax + 0x26], 0
je 0x40daac
lea ecx, [ebp - 0x14]
call fcn.00407480
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push dword [esi + 8]
push dword [ebx + 0x594]
push str._supgrade_s
push eax
call fcn.0041ad10
push dword [esi + 8]
lea eax, [ebp - 8]
push dword [ebx + 0x594]
push 0x4a649c
push eax
call fcn.0041ad10
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 0x14]
add esp, 0x20
cmp byte [esi + 0x27], 0
mov esi, dword [ebp - 8]
push eax
push ecx
mov ecx, esp
je 0x40d9ae
lea eax, [ebp - 8]
push eax
call fcn.004073e0
call fcn.0041b590
add esp, 4
mov byte [ebp - 2], al
lea eax, [ebp - 8]
mov ecx, esp
push eax
call fcn.004073e0
mov ecx, ebx
call fcn.00424470
mov bl, al
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.0041d210
mov ecx, dword [ebp + 8]
push eax
add ecx, 0x10
push ecx
call fcn.00409eb0
add esp, 0x10
test al, al
je 0x40d980
cmp byte [ebp - 2], 0
je 0x40d980
test bl, bl
je 0x40d980
mov bl, 1
jmp 0x40d982
xor bl, bl
lea ecx, [ebp - 0x20]
call fcn.00409060
test bl, bl
je 0x40daa4
push 5
push 0
push str._fromrmup
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40daa4
lea eax, [ebp - 0xc]
push eax
call fcn.004073e0
call fcn.0041b590
add esp, 4
mov byte [ebp - 2], al
lea eax, [ebp - 0xc]
mov ecx, esp
push eax
call fcn.004073e0
mov ecx, ebx
call fcn.00424470
mov byte [ebp - 1], al
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 0
jl 0x40da1f
push str.magictray
push ecx
call fcn.0044b974
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x40da1f
mov eax, dword [ebp + 8]
sub ecx, dword [eax]
sar ecx, 1
js 0x40da1f
cmp byte [0x4c103e], 0
je 0x40da1f
push 0
push dword [ebx + 4]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
call ebx
mov eax, dword [ebp - 0x1c]
push 0
push dword [eax + 0x30]
call ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
push str.vistaghostsetup
call fcn.0040ebb0
test eax, eax
je 0x40da6b
lea eax, [ebp + 8]
push edi
push eax
call fcn.0041d210
push eax
lea eax, [ebx + 0x10]
push eax
call fcn.00409eb0
add esp, 0x10
test al, al
je 0x40da5d
cmp byte [ebp - 2], 0
je 0x40da5d
cmp byte [ebp - 1], 0
je 0x40da5d
mov bl, 1
jmp 0x40da5f
xor bl, bl
lea ecx, [ebp + 8]
call fcn.00409060
test bl, bl
je 0x40da84
push 5
push 0
push str._fromrmup
push edi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40daa4
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
push eax
call fcn.004073e0
push ecx
lea eax, [ebp - 0xc]
mov ecx, esp
push eax
call fcn.004073e0
call fcn.0040add0
add esp, 8
lea ecx, [ebp - 0x14]
call fcn.00409060
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40dac6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jg 0x40dba4
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov word [ebx + 0x5d4], 0x101
push str.winguarddll
push dword [edi]
call fcn.0046b1da
add esp, 8
test eax, eax
je 0x40db35
push str.winguard
push dword [edi]
call fcn.0046b1da
add esp, 8
test eax, eax
je 0x40db35
push ecx
mov ecx, esp
push str.winguard_x64dll
call fcn.00403710
mov ecx, ebx
call fcn.00424b90
push ecx
mov ecx, esp
push str.winguard_x64
jmp 0x40db51
push ecx
mov ecx, esp
push str.winguarddll
call fcn.00403710
mov ecx, ebx
call fcn.00424b90
push ecx
mov ecx, esp
push str.winguard
mov byte [ebx + 0x5d4], al
call fcn.00403710
mov ecx, ebx
call fcn.00424b90
cmp byte [ebx + 0x5d4], 0
mov byte [ebx + 0x5d5], al
je 0x40db9c
test al, al
je 0x40db9c
push str.winguarddll
push dword [edi]
call fcn.0046b1da
add esp, 8
test eax, eax
je 0x40dba4
push str.winguard_x64dll
push dword [edi]
call fcn.0046b1da
add esp, 8
test eax, eax
je 0x40dba4
push edi
mov ecx, ebx
call fcn.0040dbb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4