Function at 0x406070
Capabilities:
Check if file exists
Check mutex on windows
Delete file
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4e4
mov eax, dword [0x41f014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
push 0x34
mov dword [ebp - 0x4ac], eax
lea eax, [ebp - 0x4a8]
push ebx
push eax
call fcn.00408580
push 0x34
lea eax, [ebp - 0x4e4]
push ebx
push eax
call fcn.00408580
xor eax, eax
lea edi, [ebp - 0x464]
stosd dword es:[edi], eax
add esp, 0x18
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push esi
call dword [sym.imp.USER32.dll_CharUpperW]
push 0x4174f4
push esi
call dword [sym.imp.KERNEL32.DLL_lstrcmpW]
mov esi, eax
neg esi
push 0x4203c8
sbb esi, esi
and esi, 0x20
push 0x41f97c
add esi, 0xa0
call fcn.004074af
pop ecx
pop ecx
test al, al
jne 0x406110
push 0x10
push 0x4174fc
push 0x417514
jmp 0x40669b
push esi
push dword [0x41f97c]
call fcn.00407485
pop ecx
pop ecx
test al, al
jne 0x40614f
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x40]
push 0x1e
push eax
push 0x91
push ebx
call esi
push 0xc8
lea eax, [ebp - 0x248]
push eax
push 0x93
push ebx
call esi
jmp 0x40668e
mov eax, dword [0x4203d0]
mov ecx, 0x100
cmp dword [0x4203c8], ebx
cmovne eax, ecx
mov dword [0x4203d0], eax
call fcn.004056e9
test eax, eax
jne 0x406192
push 0x1e
lea eax, [ebp - 0x40]
push eax
push 0x91
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
lea eax, [ebp - 0x40]
push eax
push str.Load_DLL_failed__
jmp 0x40669b
lea eax, [ebp - 0x474]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
xor edi, edi
mov eax, 0x7e9
inc edi
cmp word [ebp - 0x474], ax
ja 0x40664b
jne 0x4061d2
cmp word [ebp - 0x472], di
ja 0x40664b
jne 0x4061d2
cmp word [ebp - 0x46e], di
jae 0x40664b
push str.A3C4E518_62F1_4fdc_8C6D_D77B00B185C1
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov dword [ebp - 0x4b0], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x40625d
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x40]
push 0x1e
push eax
push 0x91
push ebx
call esi
push 0x3c
lea eax, [ebp - 0xb8]
push eax
push 0xb2
push ebx
call esi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x40]
push 0x30
push eax
lea eax, [ebp - 0x248]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [ebp - 0x40]
push eax
push ebx
call dword [sym.imp.USER32.dll_FindWindowW]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x4066a2
push 0x41ff98
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
cmp word [eax*2 + 0x41ff96], 0x5c
jne 0x406294
lea eax, [eax*2 - 2]
cmp eax, 0x208
jae 0x4066b5
xor ecx, ecx
mov word [eax + 0x41ff98], cx
push edi
mov esi, 0x4203d8
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0x4175a8
lea eax, [eax*2 + 0x4203d2]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
call esi
cmp eax, 0xffffffff
jne 0x4062cb
xor eax, eax
mov word [0x4203d8], ax
push edi
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
push str.LiuRebootFlag
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
lea eax, [ebp - 0x450]
push eax
call esi
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x1e
pop ebx
cmp eax, 0xffffffff
je 0x406355
push ebx
lea eax, [ebp - 0x40]
push eax
push 0x91
push 0
call edi
push 0xc8
lea eax, [ebp - 0x248]
push eax
push 0xbe
push 0
call edi
push 0x134
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x248]
push eax
push 0
call esi
cmp eax, 6
jne 0x4066a2
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push ebx
lea eax, [ebp - 0x40]
push eax
push 0x91
push 0
call edi
push 0xc8
lea eax, [ebp - 0x248]
push eax
push 0xbb
push 0
call edi
push 0x40
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x248]
push eax
push 0
call esi
push ebx
push 0x41f940
push 0x86
push 0
call edi
mov esi, eax
mov ecx, ebx
sub ecx, esi
push ecx
lea ecx, [esi*2 + 0x41f940]
push ecx
push 0x87
push 0
call edi
add esi, eax
sub ebx, esi
push ebx
lea eax, [esi*2 + 0x41f940]
push eax
push 0x8b
push 0
call edi
cmp dword [0x4203c8], 0
je 0x4063df
push str.__x64_
push 0x41f940
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
mov ebx, dword [ebp - 0x4ac]
lea eax, [ebp - 0x4a8]
mov esi, dword [sym.imp.COMCTL32.dll_CreatePropertySheetPageW]
push 0x6b
pop edi
push eax
mov dword [ebp - 0x4a8], 0x34
mov dword [ebp - 0x4a4], 0x800
mov dword [ebp - 0x4a0], ebx
mov dword [ebp - 0x490], 0x405ec8
mov dword [ebp - 0x49c], edi
call esi
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x4a8]
push eax
mov dword [ebp - 0x4a4], 0x3000
mov dword [ebp - 0x480], 0x95
mov dword [ebp - 0x47c], 0x96
mov dword [ebp - 0x490], 0x405d55
mov dword [ebp - 0x49c], 0x6d
call esi
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x4a8]
push eax
mov dword [ebp - 0x4a4], 0x3000
mov dword [ebp - 0x480], 0x99
mov dword [ebp - 0x47c], 0x9a
mov dword [ebp - 0x490], 0x405c76
mov dword [ebp - 0x49c], 0x6f
call esi
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x4a8]
push eax
mov dword [ebp - 0x4a4], 0x800
mov dword [ebp - 0x490], 0x4059a9
mov dword [ebp - 0x49c], 0x6c
call esi
mov dword [ebp - 0x458], eax
lea eax, [ebp - 0x4a8]
push eax
mov dword [ebp - 0x4a4], 0x800
mov dword [ebp - 0x490], 0x405ab4
mov dword [ebp - 0x49c], 0x70
call esi
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x464]
mov dword [ebp - 0x4d8], ebx
xor ebx, ebx
push 0xa0
push dword [0x41f97c]
mov dword [ebp - 0x4e4], 0x34
mov dword [ebp - 0x4dc], ebx
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4e0], 0x1088004
mov dword [ebp - 0x4bc], 0x85
mov dword [ebp - 0x4b4], 0x84
call fcn.00407485
xor ecx, ecx
mov dword [ebp - 0x4c8], ebx
test al, al
mov dword [ebp - 0x4cc], 5
push 0x1f0
lea eax, [ebp - 0x438]
cmovne edi, ecx
push ebx
push eax
mov dword [ebp - 0x4d4], edi
call fcn.00408580
add esp, 0x14
mov dword [ebp - 0x43c], 0x1f4
lea eax, [ebp - 0x43c]
push ebx
push eax
push ebx
push 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x17
pop ecx
lea esi, [ebp - 0x2a4]
lea edi, [ebp - 0x9c]
rep movsd dword es:[edi], dword [esi]
push str.PMingLiU
lea eax, [ebp - 0x80]
mov dword [ebp - 0x8c], 0x2bc
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
imul eax, eax, 0xc
push 0xffffffffffffffb8
pop ecx
cdq
idiv ecx
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push esi
push ebx
mov dword [0x4203d4], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
lea eax, [ebp - 0x4e4]
push eax
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
push dword [0x4203d4]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x4b0]
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
cmp dword [0x4205e0], ebx
je 0x4066a2
call fcn.00405712
test eax, eax
jne 0x4066a2
push 0x30
push 0x4175f4
push 0x417604
jmp 0x40669b
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x40]
push 0x1e
push eax
push 0x91
push ebx
call esi
push 0x3c
lea eax, [ebp - 0xb8]
push eax
push 0x94
push ebx
call esi
push edi
push edi
push 0x7e9
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0x10
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x248]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004076f3
leave
ret 0x10
call fcn.0040785e
int3