Function at 0x403410
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Get hostname
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1f30
call fcn.0040adc0
mov dword [ebp - 0x189c], 0x104
lea eax, [ebp - 0x189c]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x1450]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.4ZBR19116_NNIF
lea ecx, [ebp - 0x1248]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.ZBR_JNSEXOBM
lea edx, [ebp - 0x1040]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.alFSVWJB
lea eax, [ebp - 0xe38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x40e2fc
lea ecx, [ebp - 0xc30]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.bett2f00
lea edx, [ebp - 0xa28]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.bett2f002
lea eax, [ebp - 0x820]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x40e2b8
lea ecx, [ebp - 0x618]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.update
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push 0x1a
lea eax, [ebp - 0x1f30]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x1f30]
push ecx
push str._s.
lea edx, [ebp - 0x1658]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x1d00]
push eax
lea ecx, [ebp - 0x1658]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x1660], eax
cmp dword [ebp - 0x1660], 0xffffffff
je 0x403707
mov edx, dword [ebp - 0x1d00]
and edx, 0x10
je 0x4036eb
movzx eax, word [ebp - 0x1cd4]
cmp eax, 0x2e
jne 0x40355b
movzx ecx, word [ebp - 0x1cd2]
test ecx, ecx
je 0x40357e
movzx edx, word [ebp - 0x1cd4]
cmp edx, 0x2e
jne 0x403583
movzx eax, word [ebp - 0x1cd2]
cmp eax, 0x2e
jne 0x403583
movzx ecx, word [ebp - 0x1cd0]
test ecx, ecx
jne 0x403583
jmp 0x4036eb
mov dword [ebp - 0x165c], 0
jmp 0x40359e
mov edx, dword [ebp - 0x165c]
add edx, 1
mov dword [ebp - 0x165c], edx
cmp dword [ebp - 0x165c], 9
jge 0x4036eb
mov eax, dword [ebp - 0x165c]
imul eax, eax, 0x208
lea ecx, [ebp + eax - 0x1450]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov edx, dword [ebp - 0x165c]
imul edx, edx, 0x208
lea eax, [ebp + edx - 0x1450]
push eax
lea ecx, [ebp - 0x1cd4]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x4036e6
lea edx, [ebp - 0x1cd4]
push edx
lea eax, [ebp - 0x1f30]
push eax
push str._s_s
lea ecx, [ebp - 0x1898]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x1898]
push edx
call fcn.00403140
push 0x13
lea eax, [ebp - 0x1d28]
push eax
call fcn.00403200
add esp, 8
mov word [ebp - 0x1d02], 0
lea ecx, [ebp - 0x1d28]
push ecx
lea edx, [ebp - 0x1f30]
push edx
push str._s_s
lea eax, [ebp - 0x1ab0]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x1684], eax
lea ecx, [ebp - 0x1ab0]
push ecx
lea edx, [ebp - 0x1898]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, 1
je 0x403687
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x403687
jmp 0x40361e
push 0x80
lea eax, [ebp - 0x1ab0]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x1e
lea ecx, [ebp - 0x1680]
push ecx
call fcn.00402250
add esp, 8
mov dword [ebp - 0x167c], 3
mov word [ebp - 0x1670], 0x414
mov edx, dword [ebp - 0x1684]
mov word [ebp + edx*2 - 0x1aae], 0
lea eax, [ebp - 0x1ab0]
mov dword [ebp - 0x1678], eax
lea ecx, [ebp - 0x1680]
push ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
jmp 0x40358f
lea edx, [ebp - 0x1d00]
push edx
mov eax, dword [ebp - 0x1660]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x403535
mov ecx, dword [ebp - 0x1660]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esp, ebp
pop ebp
ret