Function at 0x403da0
Capabilities:
Create process on windows
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x878
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0xffffffff
push 0x413bcc
push 4
call fcn.00406600
add esp, 8
push 0
push 1
call fcn.004065e0
add esp, 8
test eax, eax
jne 0x40415a
call fcn.00404b00
test eax, eax
je 0x40415a
push 0x14
push 2
call fcn.00406600
add esp, 8
push 0x413bb0
push 4
call fcn.00406600
add esp, 8
push 0
push 1
call fcn.004065e0
add esp, 8
test eax, eax
jne 0x40413e
push 0
push 0x405160
push 0
push 0x65
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 1
jne 0x40413e
mov ecx, dword [0x417128]
push ecx
push 0
call fcn.004042b0
add esp, 4
push eax
call fcn.00403440
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403ed6
push 0x28
push 2
call fcn.00406600
add esp, 8
push 0x413b98
push 4
call fcn.00406600
add esp, 8
push 0
push 1
call fcn.004065e0
add esp, 8
test eax, eax
jne 0x403ebd
mov edx, dword [ebp + 8]
push edx
push 0
call fcn.00404420
add esp, 4
push eax
push 0
call fcn.004042b0
add esp, 4
push eax
call fcn.004052c0
add esp, 0xc
test eax, eax
je 0x403ebd
push 0x64
push 2
call fcn.00406600
add esp, 8
mov dword [ebp - 8], 1
jmp 0x403ed1
push 0x30
push 0x413aac
push 0x413b7c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x404137
cmp dword [ebp - 4], 1
jne 0x404137
mov dword [ebp - 4], 0xffffffff
cmp dword [0x417130], 0
je 0x404132
mov eax, dword [0x41715c]
add eax, 1
mov dword [0x41715c], eax
cmp dword [0x41715c], 3
jb 0x404132
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x460], 0
mov dword [ebp - 0x454], 0xffffffff
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x474], 0
push 0x400
push 0
lea ecx, [ebp - 0x450]
push ecx
call fcn.00407070
add esp, 0xc
push 0x44
push 0
lea edx, [ebp - 0x50]
push edx
call fcn.00407070
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x470], eax
mov dword [ebp - 0x46c], eax
mov dword [ebp - 0x468], eax
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x50], 0x44
push 0
call fcn.00406790
add esp, 4
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0
je 0x40409a
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov ecx, dword [ebp - 0x460]
push ecx
call dword [0x417138]
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0xffffffff
je 0x40409a
push 0
mov edx, dword [0x417120]
push edx
push 0
push 4
push 0
mov eax, dword [ebp - 0x454]
push eax
call dword [0x417140]
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0
je 0x40408d
push 0
push 0
push 0
push 2
mov ecx, dword [ebp - 0x45c]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
je 0x404080
cmp dword [0x417124], 0
je 0x404073
mov edx, dword [0x417120]
push edx
mov eax, dword [0x417124]
push eax
mov ecx, dword [ebp - 0x474]
push ecx
call fcn.004070f0
add esp, 0xc
push 2
mov edx, dword [ebp - 0x460]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [ebp - 0x458], 1
mov eax, dword [0x417124]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0x474]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [ebp - 0x45c]
push edx
call dword [0x41713c]
mov eax, dword [ebp - 0x454]
push eax
call dword [0x41713c]
cmp dword [ebp - 0x458], 0
je 0x404130
push 0x400
lea ecx, [ebp - 0x450]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x450]
push edx
push 0
call fcn.00406790
add esp, 4
push eax
push str.__s____s_
lea eax, [ebp - 0x878]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x470]
push ecx
lea edx, [ebp - 0x50]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x878]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x404116
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4040e2
mov ecx, dword [ebp - 0x46c]
push ecx
call dword [0x41713c]
mov edx, dword [ebp - 0x470]
push edx
call dword [0x41713c]
jmp 0x40413e
jmp 0x403e02
jmp 0x40413e
cmp dword [ebp - 4], 0xffffffff
jne 0x404158
push 0x30
push 0x413aac
push 0x413b50
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40416e
push 0x30
push 0x413aac
push 0x413b34
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
call fcn.00406600
add esp, 8
push 0
call fcn.004042b0
add esp, 4
test eax, eax
je 0x4041a3
push 0
call fcn.004042b0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
call fcn.004042b0
add esp, 4
push 0
call fcn.00406790
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4041cd
push 0
push 0
call fcn.00406790
add esp, 4
push eax
call fcn.00406870
add esp, 8
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret