Function at 0x40a976
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebp
push ebx
push edi
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40a97e
call fcn.0041abc0
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 0x138]
call fcn.0040fdf0
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
cmp ebx, 1
jne 0x40ada7
mov dword [0x4207e0], 1
call fcn.004094f9
mov edx, dword [esp]
mov ebp, dword [edx]
mov edx, dword [ebp + 0x13c]
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ac20
lea eax, [esp + 0xc]
push eax
call fcn.0041ac80
push dword [ebp + 0x140]
call fcn.0040fdf0
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x40aa0b
mov dword [esp + 0x10], pe_nt_image_headers32
jmp 0x40aa85
mov ebx, dword [esp + 0xc]
cmp ebx, 1
jne 0x40aa1e
mov dword [esp + 0x10], 1
jmp 0x40aa85
mov ebx, dword [esp + 0xc]
cmp ebx, 2
jne 0x40aa31
mov dword [esp + 0x10], 4
jmp 0x40aa85
mov ebx, dword [esp + 0xc]
cmp ebx, 3
jne 0x40aa44
mov dword [esp + 0x10], 2
jmp 0x40aa85
mov ebx, dword [esp + 0xc]
cmp ebx, 4
jne 0x40aa57
mov dword [esp + 0x10], 6
jmp 0x40aa85
mov ebx, dword [esp + 0xc]
cmp ebx, 5
jne 0x40aa6a
mov dword [esp + 0x10], 5
jmp 0x40aa85
mov ebx, dword [esp + 0xc]
cmp ebx, 6
jne 0x40aa7d
mov dword [esp + 0x10], 3
jmp 0x40aa85
mov dword [esp + 0x10], 7
push edx
call fcn.0041ab10
pop edx
push eax
push dword [esp + 0xc]
call fcn.0040b2c3
lea eax, [esp + 0x18]
push eax
call fcn.0041ac80
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ab10
pop edx
push eax
push dword [esp + 0x1c]
call fcn.00413105
lea eax, [esp + 0x1c]
push eax
call fcn.0041ac80
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ab10
pop edx
push eax
call fcn.00413184
lea eax, [esp + 0x20]
push eax
call fcn.0041ac80
push 1
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
push eax
call fcn.0041a6e0
mov ebx, eax
and ebx, ebx
jne 0x40ac39
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ab10
pop edx
push eax
push dword [esp + 0x1c]
call fcn.004130b7
lea eax, [esp + 0x24]
push eax
call fcn.0041ac80
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ab10
pop edx
push eax
call fcn.00410ed6
call fcn.0040f192
add dword [esp], edx
call fcn.004130b7
lea eax, [esp + 0x28]
push eax
call fcn.0041ac80
push 1
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push eax
call fcn.0041a6e0
mov ebx, eax
and ebx, ebx
jne 0x40ab7e
jmp 0x40ac34
push edx
call fcn.0041ab10
pop edx
push eax
push pe_nt_image_headers32
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ab10
pop edx
push eax
call fcn.00410ed6
call fcn.0040f192
add dword [esp], edx
call sub.KERNEL32.dll_SetFileAttributesW
call fcn.0040f1b0
push dword [esp + 0x14]
call fcn.00412e23
push edx
push eax
pop ebx
pop edi
cmp edi, 0xffffffff
jg 0x40abcf
jl 0x40abcb
cmp ebx, 0xffffffff
ja 0x40abcf
xor eax, eax
jmp 0x40abd4
mov eax, 1
or eax, eax
je 0x40abef
push pe_nt_image_headers32
push dword [esp + 0x18]
call sub.KERNEL32.dll_SetFileAttributesW
push dword [esp + 0x14]
call sub.KERNEL32.dll_DeleteFileW
push edx
call fcn.0041ab10
pop edx
push eax
push 1
push dword [esp + 0x1c]
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ab10
pop edx
push eax
call fcn.00410ed6
call fcn.0040f192
add dword [esp], edx
call sub.KERNEL32.dll_MoveFileExW
call fcn.0040f1b0
push dword [esp + 0x10]
push dword [esp + 0x18]
call sub.KERNEL32.dll_SetFileAttributesW
jmp 0x40ad1c
push dword [esp + 0x18]
call fcn.00412e23
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x40ac54
cmp edi, 0xffffffff
jne 0x40ac54
xor eax, eax
jmp 0x40ac59
mov eax, 1
or eax, eax
je 0x40ac66
push dword [esp + 0x18]
call fcn.0040164c
push edx
call fcn.0041ab10
pop edx
push eax
push pe_nt_image_headers32
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ab10
pop edx
push eax
call fcn.00410ed6
call fcn.0040f192
add dword [esp], edx
call sub.KERNEL32.dll_SetFileAttributesW
call fcn.0040f1b0
push dword [esp + 0x14]
call fcn.00412e23
push edx
push eax
pop ebx
pop edi
cmp edi, 0xffffffff
jg 0x40acb7
jl 0x40acb3
cmp ebx, 0xffffffff
ja 0x40acb7
xor eax, eax
jmp 0x40acbc
mov eax, 1
or eax, eax
je 0x40acd7
push pe_nt_image_headers32
push dword [esp + 0x18]
call sub.KERNEL32.dll_SetFileAttributesW
push dword [esp + 0x14]
call sub.KERNEL32.dll_DeleteFileW
push edx
call fcn.0041ab10
pop edx
push eax
push 1
push dword [esp + 0x1c]
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ab10
pop edx
push eax
call fcn.00410ed6
call fcn.0040f192
add dword [esp], edx
call sub.KERNEL32.dll_MoveFileExW
call fcn.0040f1b0
push dword [esp + 0x10]
push dword [esp + 0x18]
call sub.KERNEL32.dll_SetFileAttributesW
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 0x144]
call fcn.0040fdf0
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x28]
cmp ebx, 1
jne 0x40ad7a
call fcn.004094f9
push dword [esp + 0x14]
call fcn.00404565
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ab10
pop edx
push eax
push dword [esp + 0x20]
call fcn.00413105
call fcn.0040f192
add dword [esp], edx
call fcn.00403d25
call fcn.0040f1b0
mov edx, dword [esp + 0x14]
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ac20
push 0x4208b8
call fcn.0041ac80
push dword [esp + 0x14]
mov eax, str.cpath
push eax
call fcn.004110ea
jmp 0x40add5
push edx
call fcn.0041ab10
pop edx
push eax
push edx
call fcn.0041ab10
pop edx
push eax
call fcn.00410ed6
lea eax, [esp + 0x30]
push eax
call fcn.0041ac80
push dword [esp + 0x2c]
mov eax, str.cpath
push eax
call fcn.004110ea
xor eax, eax
push dword [esp + 0x24]
call fcn.0041ad10
push dword [esp + 0x14]
call fcn.0041ad10
push dword [esp + 0x1c]
call fcn.0041ad10
push dword [esp + 8]
call fcn.0041ad10
push dword [esp + 0x20]
call fcn.0041ad10
push dword [esp + 0x18]
call fcn.0041ad10
push dword [esp + 0x2c]
call fcn.0041ad10
add esp, 0x30
pop edi
pop ebx
pop ebp
ret 4