Function at 0x401be0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Persist via lnk shortcut

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x568f45
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x5cce5c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [ebp + 8], 0
je 0x401c38
lea ecx, [ebp - 0x30]
call fcn.00406520
push 0x579fa4
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.00406770
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.00406590
lea eax, [ebp - 0x10]
push eax
call fcn.0040b1f0
push 0x579fbc
push eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
push eax
call fcn.00402500
add esp, 0x10
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp + 8]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401c7f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov eax, esi
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401ca0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.0040b160
push 0x579fd4
push eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 2
push eax
call fcn.00402500
add esp, 0x14
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x401cf9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x401cf5
cmp eax, 0x57
je 0x401cf5
cmp eax, 0x15
je 0x401cf5
cmp eax, 3
je 0x401cf5
cmp eax, 0x7b
je 0x401cf5
cmp eax, 0x35
jne 0x401cf9
xor bl, bl
jmp 0x401cfb
mov bl, 1
mov edx, dword [ebp + 8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401d15
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov eax, esi
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401d36
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x401e19
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.0040b160
push 0x579fec
push eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 3
push eax
call fcn.00402500
add esp, 0x14
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp + 8]
test eax, eax
mov eax, esi
sete bl
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401d89
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov eax, esi
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401daa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x401e19
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.0040b160
push 0x57a004
push eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 4
push eax
call fcn.00402500
add esp, 0x14
push 4
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov edx, dword [ebp + 8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401df8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov eax, esi
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401e19
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.0040b160
push 0x57a01c
push eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 5
push eax
call fcn.00402500
add esp, 0x14
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x401e72
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x401e6e
cmp eax, 0x57
je 0x401e6e
cmp eax, 0x15
je 0x401e6e
cmp eax, 3
je 0x401e6e
cmp eax, 0x7b
je 0x401e6e
cmp eax, 0x35
jne 0x401e72
xor bl, bl
jmp 0x401e74
mov bl, 1
mov edx, dword [ebp + 8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401e8e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov eax, esi
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401eaf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x401f90
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.0040b160
push 0x57a028
push eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 6
push eax
call fcn.00402500
add esp, 0x14
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp + 8]
test eax, eax
mov eax, esi
sete bl
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401f02
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov eax, esi
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401f23
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x401f90
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.0040b160
push 0x57a034
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 7
push eax
call fcn.00402500
add esp, 0x14
push 4
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov edx, dword [ebp - 0x14]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x401f71
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x401f90
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4