Function at 0x403db5
Capabilities:
Delete file
Get common file path
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa3c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [0x42225c], 3
jne 0x403e3c
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
push 0
push edi
call esi
test eax, eax
je 0x404111
cmp dword [ebp + 0xc], 0
je 0x404115
lea eax, [ebp - 0x44c]
push edi
push eax
call fcn.00413bb0
lea eax, [ebp - 0x44c]
push eax
call fcn.00413dd0
mov byte [ebp + eax - 0x44d], 0x5f
lea eax, [ebp - 0x44c]
push eax
push dword [ebp + 0xc]
call fcn.00403a23
add esp, 0x14
lea eax, [ebp - 0x44c]
push 4
push edi
push eax
call esi
jmp 0x404118
mov esi, 0x104
lea eax, [ebp - 0x348]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x104]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
jne 0x403ec4
lea eax, [ebp - 0x104]
push edi
push eax
call fcn.00413bb0
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x32
jne 0x403ec4
lea eax, [ebp - 0x244]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x403ec4
lea eax, [ebp - 0x104]
push 0x5c
push eax
call fcn.00413b80
pop ecx
test eax, eax
pop ecx
je 0x403ea8
and byte [eax], 0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00403d6d
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0xc], 0
je 0x403f0e
lea eax, [ebp - 0x104]
push eax
call fcn.00413dd0
mov esi, eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x654]
push eax
call fcn.00413bb0
lea eax, [ebp - 0x654]
mov byte [ebp + esi - 0x655], 0x5f
push eax
push dword [ebp + 0xc]
call fcn.00403a23
lea eax, [ebp - 0x654]
add esp, 0x14
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x550]
mov esi, str.WININIT.INI
push eax
push 0
lea eax, [ebp - 0x348]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x404111
lea eax, [ebp - 0x348]
push esi
push eax
call fcn.00403d6d
lea eax, [ebp - 0x550]
push 0x41d33c
push eax
call fcn.004142f5
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x404111
lea eax, [ebp - 0x348]
push 0x41d338
push eax
call fcn.004142f5
mov edi, eax
pop ecx
test edi, edi
pop ecx
mov esi, 0x100
je 0x403fca
push edi
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0041427e
add esp, 0xc
test eax, eax
je 0x403fca
push 8
lea eax, [ebp - 0x208]
push str._rename_
push eax
call fcn.0041a230
add esp, 0xc
test eax, eax
je 0x403fca
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.0041423b
push edi
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0041427e
add esp, 0x14
jmp 0x403f8c
push ebx
push str._rename__n
call fcn.0041423b
cmp dword [ebp + 0xc], 0
pop ecx
pop ecx
jne 0x404031
cmp dword [0x42225c], 0
je 0x404085
lea eax, [ebp - 0xa3c]
push 0x41d318
push eax
call fcn.00413bb0
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0xa3c]
push eax
call fcn.00413bc0
lea eax, [ebp - 0xa3c]
push 0x41d314
push eax
call fcn.00413bc0
lea eax, [ebp - 0xa3c]
push ebx
push eax
call fcn.0041423b
add esp, 0x20
jmp 0x404085
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0xa3c]
push eax
call fcn.00413bb0
lea eax, [ebp - 0xa3c]
push 0x41d310
push eax
call fcn.00413bc0
push dword [ebp + 0xc]
lea eax, [ebp - 0xa3c]
push eax
call fcn.00413bc0
lea eax, [ebp - 0xa3c]
push 0x41d314
push eax
call fcn.00413bc0
lea eax, [ebp - 0xa3c]
push ebx
push eax
call fcn.0041423b
add esp, 0x28
test edi, edi
je 0x4040be
push edi
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0041427e
add esp, 0xc
test eax, eax
je 0x4040be
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.0041423b
push edi
lea eax, [ebp - 0x208]
push esi
push eax
call fcn.0041427e
add esp, 0x14
jmp 0x40409a
push ebx
call fcn.004141e5
test edi, edi
pop ecx
je 0x4040ee
push edi
call fcn.004141e5
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop ecx
lea eax, [ebp - 0x348]
push eax
call esi
test eax, eax
jne 0x4040ee
lea eax, [ebp - 0x550]
push eax
call esi
jmp 0x404111
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp dword [ebp + 0xc], 0
jne 0x404115
cmp dword [0x42225c], 0
jne 0x404115
xor eax, eax
jmp 0x404118
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret