Function at 0x40c950
Capabilities:
Check if file exists
Delete directory
Delete file
Delete registry value
Get common file path
Get file attributes
Move file
Persist via lnk shortcut
Set file attributes

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push str.Deleting_all_existing_files...._n
call fcn.0040b8e0
add esp, 4
push 0
push 0x19
push 0x436ef0
push 0
mov byte [0x436ef0], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push ebp
push 0x436ef0
push str._s_s.lnk
push 0x4365e8
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0x10
push 0x4365e8
call edi
cmp eax, 0xffffffff
je 0x40c9da
test al, 0x10
jne 0x40c9da
push 0x4365e8
push str.Deleting:_s_n
call fcn.0040b8e0
add esp, 8
push 0x80
push 0x4365e8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, 0x4365e8
call fcn.0040a290
push 0
push 0x10
push 0x436ef0
push 0
mov byte [0x436ef0], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push ebp
push 0x436ef0
push str._s_s.lnk
push 0x4365e8
call esi
add esp, 0x10
push 0x4365e8
call edi
cmp eax, 0xffffffff
je 0x40ca43
test al, 0x10
jne 0x40ca43
push 0x4365e8
push str.Deleting:_s_n
call fcn.0040b8e0
add esp, 8
push 0x80
push 0x4365e8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, 0x4365e8
call fcn.0040a290
push 0x436ef0
push 0
push 0
push 0x1c
push 0
mov byte [0x436ef0], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push str.InstProg.dat
push 0x436ef0
push 0x428160
push 0x4365e8
call esi
add esp, 0x10
push 0x4365e8
call edi
cmp eax, 0xffffffff
je 0x40cab2
test al, 0x10
jne 0x40cab2
push 0x4365e8
push str.Deleting:_s_n
call fcn.0040b8e0
add esp, 8
push 0x80
push 0x4365e8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, 0x4365e8
call fcn.0040a290
push 0
push 0x17
push 0x436ef0
push 0
mov byte [0x436ef0], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push ebp
push 0x436ef0
push 0x428160
push 0x4365e8
call esi
add esp, 0x10
push 0x4365e8
call edi
cmp eax, 0xffffffff
je 0x40cb1d
test al, 0x10
je 0x40cb1d
push 0x4365e8
push str.Deleting:_s_n
call fcn.0040b8e0
push 7
push 0x428170
push 0x4365e8
call fcn.0040a380
add esp, 0x14
push 0x4365e8
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov eax, dword [0x435e74]
push eax
push 0x436ef0
push 0x428160
push 0x4365e8
call esi
add esp, 0x10
push 0x4365e8
call edi
cmp eax, 0xffffffff
je 0x40cb75
test al, 0x10
je 0x40cb75
push 0x4365e8
push str.Deleting:_s_n
call fcn.0040b8e0
push 7
push 0x428170
push 0x4365e8
call fcn.0040a380
add esp, 0x14
push 0x4365e8
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor edi, edi
cmp dword [str.K7UltimateSecurity], edi
je 0x40cbf3
mov eax, 0x431eb8
mov ecx, dword [eax]
push ecx
push 0x436ef0
push 0x428160
push 0x4365e8
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0x10
push 0x4365e8
call ebx
cmp eax, 0xffffffff
je 0x40cbdf
test al, 0x10
je 0x40cbdf
push 0x4365e8
push str.Deleting:_s_n
call fcn.0040b8e0
push 7
push 0x428170
push 0x4365e8
call fcn.0040a380
add esp, 0x14
push 0x4365e8
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
inc edi
cmp dword [edi*4 + 0x431eb8], 0
lea eax, [edi*4 + 0x431eb8]
jne 0x40cb84
jmp 0x40cbf9
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
push 2
push 0x436ef0
push 0
mov byte [0x436ef0], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push ebp
push 0x436ef0
push 0x428160
push 0x4365e8
call esi
add esp, 0x10
push 0x4365e8
call ebx
cmp eax, 0xffffffff
je 0x40cc68
test al, 0x10
je 0x40cc68
push 0x4365e8
push str.Deleting:_s_n
call fcn.0040b8e0
push 7
push 0x428170
push 0x4365e8
call fcn.0040a380
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
add esp, 0x14
push 0x4365e8
call edi
jmp 0x40cc6e
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov edx, dword [0x435e74]
push edx
push 0x436ef0
push 0x428160
push 0x4365e8
call esi
add esp, 0x10
push 0x4365e8
call ebx
cmp eax, 0xffffffff
je 0x40ccc3
test al, 0x10
je 0x40ccc3
push 0x4365e8
push str.Deleting:_s_n
call fcn.0040b8e0
push 7
push 0x428170
push 0x4365e8
call fcn.0040a380
add esp, 0x14
push 0x4365e8
call edi
xor ebp, ebp
cmp dword [str.K7UltimateSecurity], ebp
je 0x40cd35
mov eax, 0x431eb8
mov eax, dword [eax]
push eax
push 0x436ef0
push 0x428160
push 0x4365e8
call esi
add esp, 0x10
push 0x4365e8
call ebx
cmp eax, 0xffffffff
je 0x40cd23
test al, 0x10
je 0x40cd23
push 0x4365e8
push str.Deleting:_s_n
call fcn.0040b8e0
push 7
push 0x428170
push 0x4365e8
call fcn.0040a380
add esp, 0x14
push 0x4365e8
call edi
inc ebp
cmp dword [ebp*4 + 0x431eb8], 0
lea eax, [ebp*4 + 0x431eb8]
jne 0x40ccd2
push str.SoftwareK7_ComputingK7TotalSecurity
push 0x80000002
mov byte [0x4365e8], 0
call fcn.00414a10
mov edi, eax
test edi, edi
je 0x40cd71
push 0x104
push 0x4365e8
push str.DirProductBase
push edi
call fcn.00414a70
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call ebx
jmp 0x40cd77
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.K7ScnEng.dll
push 0x4365e8
call ebp
mov eax, 0x4365e8
call fcn.0040c8a0
push str.SoftwareK7_ComputingK7TotalSecurity
push 0x80000002
mov byte [0x4365e8], 0
call fcn.00414a10
mov edi, eax
test edi, edi
je 0x40cdc7
push 0x104
push 0x4365e8
push str.DirProductBase
push edi
call fcn.00414a70
push edi
call ebx
push str.K7AVSExt.dll
push 0x4365e8
call ebp
mov eax, 0x4365e8
call fcn.0040c8a0
push str.SoftwareK7_ComputingK7TotalSecurity
push 0x80000002
mov byte [0x4365e8], 0
call fcn.00414a10
mov edi, eax
test edi, edi
je 0x40ce11
push 0x104
push 0x4365e8
push str.DirProductBase
push edi
call fcn.00414a70
push edi
call ebx
push str.K7ScrBlk.dll
push 0x4365e8
call ebp
mov eax, 0x4365e8
call fcn.0040c8a0
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x3e8
push 0x4365e8
mov byte [0x4365e8], 0
call ebx
push 0x42a6ac
push 0x4365e8
call ebp
mov eax, 0x4365e8
call fcn.0040c8a0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
mov byte [0x4365e8], 0
call fcn.00414a10
mov edi, eax
test edi, edi
je 0x40ce8e
push 0x104
push 0x4365e8
push str.ProgramFilesDir
push edi
call fcn.00414a70
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x4365e8], 0
je 0x40cee0
push str.K7TSecurity
push str.K7_Computing
push 0x4365e8
push str._s_s_s
push 0x436af0
call esi
push 0x436af0
push str.Deleting:_s_n
call fcn.0040b8e0
push 7
push 0x428170
push 0x436af0
call fcn.0040a380
add esp, 0x28
push 0x436af0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x3e8
push 0x436ef0
mov byte [0x436ef0], 0
call ebx
push str.K7WSLsp.dll
push 0x436ef0
push 0x428160
push 0x4365e8
call esi
push 0x4365e8
push str.Renaming:_s_n
call fcn.0040b8e0
add esp, 0x18
push str.SOFTWAREMicrosoftWindowsCurrentVersionSharedDLLs
push 0x80000002
call fcn.00414a40
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, eax
test edi, edi
je 0x40cf45
push 0x4365e8
push edi
call ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
jmp 0x40cf50
push edi
push 0x436ef0
push str._sK7WSLsp._d
push 0x436af0
call esi
push 0x436af0
call fcn.00414910
add esp, 0x14
test eax, eax
je 0x40cf7c
inc edi
cmp edi, 0x3e8
jl 0x40cf50
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp edi, 0x3e8
je 0x40cfc3
push 0x436af0
push 0x4365e8
call ebx
mov edi, eax
push edi
push 0x436af0
push 0x4365e8
push str.MoveFile:_s_s_d_n
call fcn.0040b8e0
add esp, 0x10
test edi, edi
je 0x40cfc3
push 4
push 0
push 0x436af0
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push str.asapsdk.dll
push 0x436ef0
push 0x428160
push 0x4365e8
call esi
push 0x4365e8
push str.Renaming:_s_n
call fcn.0040b8e0
add esp, 0x18
push str.SOFTWAREMicrosoftWindowsCurrentVersionSharedDLLs
push 0x80000002
call fcn.00414a40
mov edi, eax
test edi, edi
je 0x40d00f
push 0x4365e8
push edi
call ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
push edi
push 0x436ef0
push str._s_asapsdk._d
push 0x436af0
call esi
push 0x436af0
call fcn.00414910
add esp, 0x14
test eax, eax
je 0x40d03d
inc edi
cmp edi, 0x3e8
jl 0x40d011
cmp edi, 0x3e8
je 0x40d07e
push 0x436af0
push 0x4365e8
call ebx
mov esi, eax
push esi
push 0x436af0
push 0x4365e8
push str.MoveFile:_s_s_d_n
call fcn.0040b8e0
add esp, 0x10
test esi, esi
je 0x40d07e
push 4
push 0
push 0x436af0
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0x400
push 0x436af0
mov byte [0x436af0], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [0x436af0], 0
je 0x40d0fa
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x42a720
push 0x436af0
call esi
push str.K7SVSDsm
push 0x436af0
call esi
push 0x436af0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40d0fa
push 0x436af0
push str.Deleting:_s_n
call fcn.0040b8e0
push 7
push 0x428170
push 0x436af0
call fcn.0040a380
add esp, 0x14
push 0x436af0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret