Function at 0x4031a0
Capabilities:
Delete file
Get number of processors
Move file
Set file attributes
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4271f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebx
push ebp
mov ebp, dword [esp + 0x7c]
push esi
mov esi, edi
call fcn.00401930
mov byte [esp + 0x35], al
call fcn.004017a0
mov byte [esp + 0x33], al
call fcn.004018a0
mov ebx, edi
mov byte [esp + 0x31], al
call fcn.00401320
mov bl, al
call fcn.00401820
mov byte [esp + 0x2f], al
call fcn.00401a50
mov byte [esp + 0x2d], al
call fcn.00401a90
mov byte [esp + 0x2b], al
call fcn.00401b00
mov byte [esp + 0x29], al
call fcn.00401b90
mov byte [esp + 0x27], al
call fcn.004019c0
mov byte [esp + 0x25], al
call fcn.00401c10
mov byte [esp + 0x23], al
call fcn.00401c90
mov byte [esp + 0x21], al
call fcn.00401ee0
mov byte [esp + 0x1f], al
call fcn.00401d10
mov byte [esp + 0x1d], al
call fcn.00401d90
mov byte [esp + 0x1b], al
call fcn.00401e40
mov byte [esp + 0x19], al
call fcn.00402090
mov byte [esp + 0x17], al
mov eax, edi
call fcn.00401f70
mov byte [esp + 0x15], al
call fcn.00402120
mov byte [esp + 0x13], al
call fcn.00402210
mov byte [esp + 0x11], al
call fcn.004022a0
mov byte [esp + 0x10], al
call fcn.00402320
mov byte [esp + 0x24], al
call fcn.00402400
mov byte [esp + 0x2e], al
call fcn.00402480
mov byte [esp + 0x22], al
call fcn.00402580
mov byte [esp + 0x36], al
call fcn.00402500
mov byte [esp + 0x20], al
call fcn.00402600
mov byte [esp + 0x2c], al
call fcn.004026e0
mov byte [esp + 0x1e], al
call fcn.00402770
mov byte [esp + 0x32], al
call fcn.00402800
mov byte [esp + 0x1c], al
call fcn.00402880
mov byte [esp + 0x2a], al
call fcn.00402900
mov byte [esp + 0x1a], al
call fcn.00402a00
mov byte [esp + 0x37], al
mov eax, edi
call fcn.00402a90
mov byte [esp + 0x18], al
mov eax, edi
call fcn.00402b30
push edi
mov byte [esp + 0x2c], al
call fcn.00402bd0
mov byte [esp + 0x1a], al
add esp, 4
mov eax, edi
call fcn.00402cb0
mov byte [esp + 0x30], al
call fcn.00402e00
mov byte [esp + 0x14], al
mov eax, edi
call fcn.00402e80
mov byte [esp + 0x26], al
mov eax, edi
call fcn.00402f70
mov byte [esp + 0x12], al
mov eax, edi
call fcn.00403010
mov byte [esp + 0x34], al
mov eax, edi
call fcn.00403100
movzx ecx, byte [esp + 0x34]
movzx eax, al
add eax, ecx
movzx edx, byte [esp + 0x12]
add eax, edx
movzx ecx, byte [esp + 0x26]
add eax, ecx
movzx edx, byte [esp + 0x14]
add eax, edx
movzx ecx, byte [esp + 0x30]
add eax, ecx
movzx edx, byte [esp + 0x16]
add eax, edx
movzx ecx, byte [esp + 0x28]
add eax, ecx
movzx edx, byte [esp + 0x18]
movzx ecx, byte [esp + 0x37]
add eax, edx
movzx edx, byte [esp + 0x1a]
add eax, ecx
movzx ecx, byte [esp + 0x2a]
add eax, edx
movzx edx, byte [esp + 0x1c]
add eax, ecx
movzx ecx, byte [esp + 0x32]
add eax, edx
movzx edx, byte [esp + 0x1e]
add eax, ecx
movzx ecx, byte [esp + 0x2c]
add eax, edx
movzx edx, byte [esp + 0x20]
add eax, ecx
movzx ecx, byte [esp + 0x36]
add eax, edx
movzx edx, byte [esp + 0x22]
add eax, ecx
movzx ecx, byte [esp + 0x2e]
add eax, edx
movzx edx, byte [esp + 0x24]
add eax, ecx
movzx ecx, byte [esp + 0x10]
add eax, edx
movzx edx, byte [esp + 0x11]
add eax, ecx
movzx ecx, byte [esp + 0x13]
add eax, edx
movzx edx, byte [esp + 0x15]
add eax, ecx
movzx ecx, byte [esp + 0x17]
add eax, edx
movzx edx, byte [esp + 0x19]
add eax, ecx
movzx ecx, byte [esp + 0x1b]
add eax, edx
movzx edx, byte [esp + 0x1d]
add eax, ecx
movzx ecx, byte [esp + 0x1f]
add eax, edx
movzx edx, byte [esp + 0x21]
add eax, ecx
movzx ecx, byte [esp + 0x23]
add eax, edx
add eax, ecx
movzx edx, byte [esp + 0x25]
movzx ecx, byte [esp + 0x27]
add eax, edx
movzx edx, byte [esp + 0x29]
add eax, ecx
movzx ecx, byte [esp + 0x2b]
add eax, edx
movzx edx, byte [esp + 0x2d]
add eax, ecx
movzx ecx, byte [esp + 0x2f]
add eax, edx
add eax, ecx
movzx ecx, byte [esp + 0x31]
movzx edx, bl
add eax, edx
movzx edx, byte [esp + 0x33]
add eax, ecx
movzx ecx, byte [esp + 0x35]
add eax, edx
add eax, ecx
je 0x40360b
mov edx, dword [esp + 0x84]
push edx
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x4035a4
push ebp
call fcn.00408050
add esp, 4
push 0x80
push ebp
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test ebx, ebx
je 0x403576
push ebp
xor esi, esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x4034ea
mov ebx, dword [sym.imp.KERNEL32.DLL_Sleep]
nop
push 0xa
call ebx
add esi, 0xa
cmp esi, 0x7d0
je 0x403531
push ebp
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
je 0x4034d0
push 0x496df4
mov edx, ebp
call fcn.00413060
push 6
push str.___OK_n
mov eax, 0x496df4
call fcn.00413a20
mov eax, ebp
lea ecx, [esp + 0x54]
call fcn.00414020
lea eax, [esp + 0x54]
mov dword [esp + 0x78], 1
call fcn.00408b50
lea esi, [esp + 0x54]
call fcn.0040af70
jmp 0x4035dc
mov eax, ebp
lea ecx, [esp + 0x38]
call fcn.00414020
lea ecx, [esp + 0x38]
mov dword [esp + 0x78], 0
call fcn.00408a50
lea esi, [esp + 0x38]
mov byte [eax], 1
mov dword [esp + 0x78], 0xffffffff
call fcn.0040af70
push 0x496df4
mov edx, ebp
call fcn.00413060
push 0xf
push str.___REMOVE_FAIL_n
jmp 0x4035d2
mov eax, ebp
lea edx, [eax + 2]
jmp 0x403580
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403580
sub eax, edx
sar eax, 1
push eax
push ebp
mov eax, 0x496df4
call fcn.00413a20
push 0xd
push str.___TERM_FAIL_n
jmp 0x4035d2
mov eax, ebp
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4035b0
sub eax, edx
sar eax, 1
push eax
push ebp
mov eax, 0x496df4
call fcn.00413a20
push 0xd
push str.___OPEN_FAIL_n
mov eax, 0x496df4
call fcn.00413a20
mov eax, edi
call fcn.004049a0
test al, al
je 0x403600
mov esi, ebp
call fcn.004049e0
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
add esp, 0x70
ret
push 4
push 0
push ebp
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov ecx, dword [esp + 0x70]
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x70
ret