Function at 0x40aea0
Capabilities:
Check if file exists
Delete file
Get file attributes
Get session user name
Reference absolute stream path on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4337d8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x780
mov eax, dword [0x441370]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x11
movups xmmword [ecx], xmm0
push str.C:ProgramData:NT
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00401570
call fcn.0040ac70
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x18
test al, al
je 0x40af23
push str.C:ProgramData:NT
call esi
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x12
movups xmmword [ecx], xmm0
push str.C:ProgramData:NT2
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00401570
call fcn.0040ac70
add esp, 0x18
test al, al
je 0x40af5b
push str.C:ProgramData:NT2
call esi
push 0x22
xorps xmm0, xmm0
mov dword [ebp - 0x748], 0
push str.C:ProgramDataMTA_San_Andreas_All
lea ecx, [ebp - 0x758]
mov dword [ebp - 0x744], 0
movups xmmword [ebp - 0x758], xmm0
call fcn.00401570
cmp dword [ebp - 0x744], 0x10
lea eax, [ebp - 0x758]
cmovae eax, dword [ebp - 0x758]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40afb4
mov byte [ebp - 0x72c], 0
jmp 0x40afbf
shr al, 4
and al, 1
mov dword [ebp - 0x72c], eax
mov ecx, dword [ebp - 0x744]
cmp ecx, 0x10
jb 0x40aff9
mov edx, dword [ebp - 0x758]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40afef
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba9d
push ecx
push edx
call fcn.00412542
add esp, 8
cmp byte [ebp - 0x72c], 0
je 0x40b0dd
push 0x34
push str.C:ProgramDataMTA_San_Andreas_AllCommondatacache
call fcn.00411dc4
mov edx, eax
lea ecx, [ebp - 0x758]
call fcn.00401eb0
add esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 0x758]
cmp dword [ebp - 0x744], 8
cmovae eax, dword [ebp - 0x758]
push eax
call fcn.0041219c
mov ecx, edx
movzx eax, al
cdq
mov dword [ebp - 0x730], eax
mov dword [ebp - 0x72c], edx
mov dword [ebp - 0x73c], ecx
mov dword [ebp - 0x738], 0x441e08
cmp ecx, 0x91
jne 0x40b08e
lea eax, [ebp - 0x730]
push eax
lea edx, [ebp - 0x73c]
lea ecx, [ebp - 0x758]
call fcn.00403300
mov ecx, dword [ebp - 0x73c]
add esp, 4
test ecx, ecx
jne 0x40baa2
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x744]
cmp ecx, 8
jb 0x40b0dd
mov edx, dword [ebp - 0x758]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40b0d3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40bab4
push ecx
push edx
call fcn.00412542
add esp, 8
push 0x1f4
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00415210
add esp, 0xc
mov dword [ebp - 0x734], 0x100
lea eax, [ebp - 0x734]
push eax
lea eax, [ebp - 0x520]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x520]
push eax
lea eax, [ebp - 0x218]
push str.C:Users_sAppData
push eax
call fcn.004016c0
add esp, 0xc
mov dword [ebp - 0x760], 0
xorps xmm0, xmm0
mov dword [ebp - 0x75c], 0
lea ecx, [ebp - 0x770]
movups xmmword [ebp - 0x770], xmm0
push 0xb
push str.Roaming:NT
call fcn.00401570
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x218]
xorps xmm0, xmm0
mov dword [ebp - 0x748], 0
movups xmmword [ebp - 0x758], xmm0
mov dword [ebp - 0x744], 0
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40b190
sub ecx, edx
lea eax, [ebp - 0x218]
push ecx
push eax
lea ecx, [ebp - 0x758]
call fcn.00401570
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
lea eax, [ebp - 0x770]
mov dword [ebp - 0x72c], ecx
push eax
lea eax, [ebp - 0x758]
push eax
push dword [ebp - 0x734]
call fcn.0040d570
call fcn.0040ac70
mov byte [ebp - 4], 1
add esp, 0x18
mov ecx, dword [ebp - 0x744]
mov byte [ebp - 0x73d], al
cmp ecx, 0x10
jb 0x40b220
mov edx, dword [ebp - 0x758]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b216
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40babe
push ecx
push edx
call fcn.00412542
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x75c]
cmp ecx, 0x10
jb 0x40b261
mov edx, dword [ebp - 0x770]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b257
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40babe
push ecx
push edx
call fcn.00412542
add esp, 8
cmp byte [ebp - 0x73d], 0
je 0x40b3fa
push 0xb
xorps xmm0, xmm0
mov dword [ebp - 0x778], 0
push str.Roaming:NT
lea ecx, [ebp - 0x788]
mov dword [ebp - 0x774], 0
movups xmmword [ebp - 0x788], xmm0
call fcn.00401570
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x218]
xorps xmm0, xmm0
mov dword [ebp - 0x760], 0
movups xmmword [ebp - 0x770], xmm0
mov dword [ebp - 0x75c], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40b2d0
sub ecx, edx
lea eax, [ebp - 0x218]
push ecx
push eax
lea ecx, [ebp - 0x770]
call fcn.00401570
lea eax, [ebp - 0x788]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x770]
push eax
push dword [ebp - 0x734]
lea ecx, [ebp - 0x758]
call fcn.0040d570
cmp dword [ebp - 0x744], 0x10
lea eax, [ebp - 0x758]
cmovae eax, dword [ebp - 0x758]
push eax
call esi
mov ecx, dword [ebp - 0x744]
cmp ecx, 0x10
jb 0x40b360
mov edx, dword [ebp - 0x758]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b356
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40bab9
push ecx
push edx
call fcn.00412542
add esp, 8
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x75c]
mov dword [ebp - 0x748], 0
mov dword [ebp - 0x744], 0xf
mov byte [ebp - 0x758], 0
cmp ecx, 0x10
jb 0x40b3b9
mov edx, dword [ebp - 0x770]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b3af
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40bab9
push ecx
push edx
call fcn.00412542
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x774]
cmp ecx, 0x10
jb 0x40b3fa
mov edx, dword [ebp - 0x788]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b3f0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40bab9
push ecx
push edx
call fcn.00412542
add esp, 8
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x760], 0
push str.Roaming:NT2
lea ecx, [ebp - 0x770]
mov dword [ebp - 0x75c], 0
movups xmmword [ebp - 0x770], xmm0
call fcn.00401570
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x218]
xorps xmm0, xmm0
mov dword [ebp - 0x778], 0
movups xmmword [ebp - 0x788], xmm0
mov dword [ebp - 0x774], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40b458
sub ecx, edx
lea eax, [ebp - 0x218]
push ecx
push eax
lea ecx, [ebp - 0x788]
call fcn.00401570
sub esp, 0x18
mov byte [ebp - 4], 6
mov ecx, esp
lea eax, [ebp - 0x770]
mov dword [ebp - 0x72c], ecx
push eax
lea eax, [ebp - 0x788]
push eax
push dword [ebp - 0x734]
call fcn.0040d570
call fcn.0040ac70
mov byte [ebp - 4], 5
add esp, 0x18
mov ecx, dword [ebp - 0x774]
mov byte [ebp - 0x73d], al
cmp ecx, 0x10
jb 0x40b4e8
mov edx, dword [ebp - 0x788]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b4de
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40babe
push ecx
push edx
call fcn.00412542
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x75c]
cmp ecx, 0x10
jb 0x40b529
mov edx, dword [ebp - 0x770]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b51f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40babe
push ecx
push edx
call fcn.00412542
add esp, 8
cmp byte [ebp - 0x73d], 0
je 0x40b6be
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x760], 0
push str.Roaming:NT2
lea ecx, [ebp - 0x770]
mov dword [ebp - 0x75c], 0
movups xmmword [ebp - 0x770], xmm0
call fcn.00401570
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x218]
xorps xmm0, xmm0
mov dword [ebp - 0x778], 0
movups xmmword [ebp - 0x788], xmm0
mov dword [ebp - 0x774], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40b594
sub ecx, edx
lea eax, [ebp - 0x218]
push ecx
push eax
lea ecx, [ebp - 0x788]
call fcn.00401570
lea eax, [ebp - 0x770]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x788]
push eax
push dword [ebp - 0x734]
lea ecx, [ebp - 0x758]
call fcn.0040d570
cmp dword [ebp - 0x744], 0x10
lea eax, [ebp - 0x758]
cmovae eax, dword [ebp - 0x758]
push eax
call esi
mov ecx, dword [ebp - 0x744]
cmp ecx, 0x10
jb 0x40b624
mov edx, dword [ebp - 0x758]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b61a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40bac3
push ecx
push edx
call fcn.00412542
add esp, 8
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x774]
mov dword [ebp - 0x748], 0
mov dword [ebp - 0x744], 0xf
mov byte [ebp - 0x758], 0
cmp ecx, 0x10
jb 0x40b67d
mov edx, dword [ebp - 0x788]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b673
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40bac3
push ecx
push edx
call fcn.00412542
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x75c]
cmp ecx, 0x10
jb 0x40b6be
mov edx, dword [ebp - 0x770]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b6b4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40bac3
push ecx
push edx
call fcn.00412542
add esp, 8
lea ecx, [ebp - 0x420]
mov dword [ebp - 4], 9
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerCLSID
mov eax, ecx
mov edx, 0x208
sub esi, eax
nop dword [eax]
lea eax, [edx + 0x7ffffdf6]
test eax, eax
je 0x40b700
mov al, byte [esi + ecx]
test al, al
je 0x40b6fb
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x40b6e0
jmp 0x40b6ff
test edx, edx
jne 0x40b700
dec ecx
lea edx, [ebp - 0x420]
mov byte [ecx], 0
call fcn.0040ace0
lea ecx, [ebp - 0x420]
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerCLSID2
mov eax, ecx
mov edx, 0x208
sub esi, eax
lea eax, [edx + 0x7ffffdf6]
test eax, eax
je 0x40b742
mov al, byte [esi + ecx]
test al, al
je 0x40b73d
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x40b722
jmp 0x40b741
test edx, edx
jne 0x40b742
dec ecx
lea edx, [ebp - 0x420]
mov byte [ecx], 0
call fcn.0040ace0
lea ecx, [ebp - 0x728]
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnections
mov eax, ecx
mov edx, 0x208
sub esi, eax
lea eax, [edx + 0x7ffffdf6]
test eax, eax
je 0x40b784
mov al, byte [esi + ecx]
test al, al
je 0x40b77f
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x40b764
jmp 0x40b783
test edx, edx
jne 0x40b784
dec ecx
lea edx, [ebp - 0x728]
mov byte [ecx], 0
call fcn.0040ace0
push 0xc
call fcn.0041250d
add esp, 4
mov esi, eax
push esi
push 0xf003f
mov dword [esi + 4], 0
push 0
mov dword [esi + 8], 0
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SOFTWAREWOW6432NodeMulti_Theft_Auto:_Province_All1.5
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esi], 0
mov dword [ebp - 0x72c], eax
call eax
test eax, eax
jne 0x40b7d9
mov byte [esi + 4], 1
push 0
push 0x43c232
push str.Last_Run_Path_Hash
push esi
mov byte [esi + 8], 1
call fcn.004012d0
mov eax, dword [esi]
add esp, 0x10
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x40b801
push eax
call edi
push 0xc
push esi
call fcn.00412542
push 0xc
call fcn.0041250d
add esp, 0xc
mov esi, eax
push esi
push 0xf003f
push 0
mov dword [esi + 4], 0
push str.SOFTWAREWOW6432NodeFortuna_GTA1.5
mov dword [esi + 8], 0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esi], 0
call dword [ebp - 0x72c]
test eax, eax
jne 0x40b849
mov byte [esi + 4], 1
push 0
push 0x43c232
push str.Last_Run_Path_Hash
push esi
mov byte [esi + 8], 1
call fcn.004012d0
mov eax, dword [esi]
add esp, 0x10
test eax, eax
je 0x40b86b
push eax
call edi
push 0xc
push esi
call fcn.00412542
push 0xc
call fcn.0041250d
add esp, 0xc
mov esi, eax
push esi
push 0xf003f
push 0
mov dword [esi + 4], 0
push str.SOFTWAREWOW6432NodeMulti_Theft_Auto:_Province_All1.5Settingsgeneral
mov dword [esi + 8], 0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esi], 0
call dword [ebp - 0x72c]
test eax, eax
jne 0x40b8b3
mov byte [esi + 4], 1
push 0
push 0x43c232
push str.cachechecksum
push esi
mov byte [esi + 8], 1
call fcn.004012d0
add esp, 0x10
push 0
push 0x43c232
push str.serial
push esi
call fcn.004012d0
mov eax, dword [esi]
add esp, 0x10
test eax, eax
je 0x40b8ea
push eax
call edi
push 0xc
push esi
call fcn.00412542
push 0xc
call fcn.0041250d
add esp, 0xc
mov esi, eax
push esi
push 0xf003f
push 0
mov dword [esi + 4], 0
push str.SOFTWAREWOW6432NodeFortuna_GTA1.5Settingsgeneral
mov dword [esi + 8], 0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esi], 0
call dword [ebp - 0x72c]
test eax, eax
jne 0x40b932
mov byte [esi + 4], 1
push 0
push 0x43c232
push str.cachechecksum
push esi
mov byte [esi + 8], 1
call fcn.004012d0
add esp, 0x10
push 0
push 0x43c232
push str.serial
push esi
call fcn.004012d0
mov eax, dword [esi]
add esp, 0x10
test eax, eax
je 0x40b969
push eax
call edi
push 0xc
push esi
call fcn.00412542
push 0xc
call fcn.0041250d
add esp, 0xc
mov esi, eax
push esi
push 0xf003f
push 0
mov dword [esi + 4], 0
push str.SOFTWAREWOW6432NodeMulti_Theft_Auto:_San_Andreas_All1.5
mov dword [esi + 8], 0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esi], 0
call dword [ebp - 0x72c]
test eax, eax
jne 0x40b9b1
mov byte [esi + 4], 1
push 0
push 0x43c232
push str.Last_Run_Path_Hash
push esi
mov byte [esi + 8], 1
call fcn.004012d0
mov eax, dword [esi]
add esp, 0x10
test eax, eax
je 0x40b9d3
push eax
call edi
push 0xc
push esi
call fcn.00412542
push 0xc
call fcn.0041250d
add esp, 0xc
mov esi, eax
push esi
push 0xf003f
push 0
mov dword [esi + 4], 0
push str.SOFTWAREWOW6432NodeMulti_Theft_Auto:_San_Andreas_All1.5Settingsgeneral
mov dword [esi + 8], 0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esi], 0
call dword [ebp - 0x72c]
test eax, eax
jne 0x40ba1b
mov byte [esi + 4], 1
push 0
push 0x43c232
push str.cachechecksum
push esi
mov byte [esi + 8], 1
call fcn.004012d0
add esp, 0x10
push 0
push 0x43c232
push str.serial
push esi
call fcn.004012d0
mov eax, dword [esi]
add esp, 0x10
test eax, eax
je 0x40ba52
push eax
call edi
push 0xc
push esi
call fcn.00412542
add esp, 8
jmp 0x40ba7f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004124fa
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0041a900
lea eax, [ebp - 0x758]
push eax
lea edx, [ebp - 0x73c]
call fcn.00402c30
call fcn.0041a900
call fcn.0041a900
call fcn.0041a900
call fcn.0041a900
int3