Function at 0x409c62
Capabilities:
Check mutex on windows
Delete directory
Delete file
Delete registry key
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x46c
mov eax, dword [0x517490]
xor eax, esp
mov dword [esp + 0x464], eax
push ebx
push ebp
push esi
push edi
push str.MUTEX_XREVEAL
push 1
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x409cdd
push ebx
push str.XrevealWndClass
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x409cdd
push 0x24
push ebx
push 0x366efd92
mov edx, 0x3c609070
mov ecx, 0x8cd604e1
call fcn.004013ad
pop ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x409fca
push ebx
push ebx
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x268]
push 1
push 0x10
push eax
push ebx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x268]
push eax
call ebx
lea esi, [esp + 0x268]
mov edx, 0x78361884
push 0x72387546
mov ecx, 0xc8808ff9
lea esi, [esi + eax*2]
call fcn.004013ad
pop ecx
sub esi, eax
movzx ecx, word [eax]
mov word [esi + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x409d23
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x268]
push eax
call ebp
push 1
push 0x17
lea eax, [esp + 0x270]
push eax
push 0
call edi
lea eax, [esp + 0x268]
push eax
call ebx
lea esi, [esp + 0x268]
mov edx, 0x1eee95e3
push 0x14e0f821
mov ecx, 0xae5802fa
lea esi, [esi + eax*2]
call fcn.004013ad
pop ecx
sub esi, eax
movzx ecx, word [eax]
mov word [esi + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x409d7d
lea eax, [esp + 0x268]
push eax
call ebp
push 0x104
lea eax, [esp + 0x26c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x268]
push 0x5c
push eax
call fcn.004bacf8
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x409ed9
push 0x445e26cf
mov edx, 0x4e504b0c
mov ecx, 0xfee6dc09
add esi, 2
call fcn.004013ad
mov edx, esi
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x409de2
lea eax, [esp + 0x268]
push eax
call ebp
push 0x3a8be6dc
mov edx, 0x30858b1f
mov ecx, 0x80331c3c
call fcn.004013ad
mov edx, esi
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x409e14
lea eax, [esp + 0x268]
push eax
call ebp
push 0xebda44ff
mov edx, 0xe1d4293f
mov ecx, 0x5162bef6
call fcn.004013ad
mov edx, esi
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x409e46
and dword [esp + 0x18], 0
lea eax, [esp + 0x1c]
push 0x24c
push 0
push eax
call fcn.004bea90
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x409ed9
lea edi, [esi + 0x12]
lea eax, [esp + 0x44]
sub edi, eax
lea ecx, [esp + 0x44]
movzx eax, word [ecx]
mov word [edi + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x409e95
lea eax, [esp + 0x268]
push eax
call ebp
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409e91
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov word [esi + 0x12], ax
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 0x268]
call fcn.0040d960
push 0xf1da0d2f
mov edx, 0xfbd460e8
mov ecx, 0x4b62f701
mov esi, eax
call fcn.004013ad
mov edx, esi
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x409f00
lea eax, [esp + 0x268]
push eax
call ebp
xor eax, eax
mov word [esi], ax
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [esp + 0x268]
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push eax
call fcn.004ba78c
lea esi, [esp + 0x270]
mov edx, 0x7d1eaa62
push 0x7710c7a7
mov ecx, 0xcda83dfd
add esi, eax
call fcn.0040138c
add esp, 0xc
sub esi, eax
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x409f60
lea eax, [esp + 0x14]
push eax
push 0x2000e
push 0
lea eax, [esp + 0x274]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409fa6
push 0x4ee5d0
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor cl, cl
call fcn.0040d08c
push dword [0x529b30]
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
xor ecx, ecx
call fcn.00408b9a
call fcn.00409a03
mov ecx, dword [esp + 0x474]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b94b6
add esp, 0x46c
ret