Function at 0x40cf3e
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebp
push ebx
push edi
mov edx, 0xe
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40cf46
call fcn.00419540
mov eax, dword [esp + 0x48]
mov dword [esp], eax
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 0x138]
call fcn.00412ef0
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
cmp ebx, 1
jne 0x40d3d0
mov dword [0x41fd28], 1
call fcn.0040b3ac
mov edx, dword [esp]
mov ebp, dword [edx]
mov edx, dword [ebp + 0x13c]
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419660
lea eax, [esp + 0xc]
push eax
call fcn.004196c0
push dword [ebp + 0x140]
call fcn.00412ef0
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x40cfd3
mov dword [esp + 0x10], pe_nt_image_headers32
jmp 0x40d04d
mov ebx, dword [esp + 0xc]
cmp ebx, 1
jne 0x40cfe6
mov dword [esp + 0x10], 1
jmp 0x40d04d
mov ebx, dword [esp + 0xc]
cmp ebx, 2
jne 0x40cff9
mov dword [esp + 0x10], 4
jmp 0x40d04d
mov ebx, dword [esp + 0xc]
cmp ebx, 3
jne 0x40d00c
mov dword [esp + 0x10], 2
jmp 0x40d04d
mov ebx, dword [esp + 0xc]
cmp ebx, 4
jne 0x40d01f
mov dword [esp + 0x10], 6
jmp 0x40d04d
mov ebx, dword [esp + 0xc]
cmp ebx, 5
jne 0x40d032
mov dword [esp + 0x10], 5
jmp 0x40d04d
mov ebx, dword [esp + 0xc]
cmp ebx, 6
jne 0x40d045
mov dword [esp + 0x10], 3
jmp 0x40d04d
mov dword [esp + 0x10], 7
push edx
call fcn.00419490
pop edx
push eax
push dword [esp + 0xc]
call fcn.0040d9a0
lea eax, [esp + 0x18]
push eax
call fcn.004196c0
push edx
call fcn.00419490
pop edx
push eax
push dword [esp + 0xc]
call fcn.004039a8
lea eax, [esp + 0x1c]
push eax
call fcn.004196c0
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
call fcn.00413e30
lea eax, [esp + 0x20]
push eax
call fcn.004196c0
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.0040ab3e
mov ebx, eax
and ebx, ebx
jne 0x40d0c9
push dword [esp + 0x14]
mov eax, str.cpath
push eax
call fcn.00414044
jmp 0x40d41c
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
push dword [esp + 0x1c]
call fcn.0041626c
lea eax, [esp + 0x24]
push eax
call fcn.004196c0
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
call fcn.004162eb
lea eax, [esp + 0x28]
push eax
call fcn.004196c0
push 1
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push eax
call fcn.00419180
mov ebx, eax
and ebx, ebx
jne 0x40d262
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
push dword [esp + 0x1c]
call fcn.0041619e
lea eax, [esp + 0x2c]
push eax
call fcn.004196c0
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
call fcn.00413e30
call fcn.004121b2
add dword [esp], edx
call fcn.0041619e
lea eax, [esp + 0x30]
push eax
call fcn.004196c0
push 1
mov eax, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push eax
call fcn.00419180
mov ebx, eax
and ebx, ebx
jne 0x40d1a7
jmp 0x40d25d
push edx
call fcn.00419490
pop edx
push eax
push pe_nt_image_headers32
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
call fcn.00413e30
call fcn.004121b2
add dword [esp], edx
call sub.KERNEL32.dll_SetFileAttributesW
call fcn.004121d0
push dword [esp + 0x14]
call fcn.00415f8a
push edx
push eax
pop ebx
pop edi
cmp edi, 0xffffffff
jg 0x40d1f8
jl 0x40d1f4
cmp ebx, 0xffffffff
ja 0x40d1f8
xor eax, eax
jmp 0x40d1fd
mov eax, 1
or eax, eax
je 0x40d218
push pe_nt_image_headers32
push dword [esp + 0x18]
call sub.KERNEL32.dll_SetFileAttributesW
push dword [esp + 0x14]
call sub.KERNEL32.dll_DeleteFileW
push edx
call fcn.00419490
pop edx
push eax
push 1
push dword [esp + 0x1c]
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
call fcn.00413e30
call fcn.004121b2
add dword [esp], edx
call sub.KERNEL32.dll_MoveFileExW
call fcn.004121d0
push dword [esp + 0x10]
push dword [esp + 0x18]
call sub.KERNEL32.dll_SetFileAttributesW
jmp 0x40d345
push dword [esp + 0x20]
call fcn.00415f8a
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x40d27d
cmp edi, 0xffffffff
jne 0x40d27d
xor eax, eax
jmp 0x40d282
mov eax, 1
or eax, eax
je 0x40d28f
push dword [esp + 0x20]
call fcn.00401d48
push edx
call fcn.00419490
pop edx
push eax
push pe_nt_image_headers32
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
call fcn.00413e30
call fcn.004121b2
add dword [esp], edx
call sub.KERNEL32.dll_SetFileAttributesW
call fcn.004121d0
push dword [esp + 0x14]
call fcn.00415f8a
push edx
push eax
pop ebx
pop edi
cmp edi, 0xffffffff
jg 0x40d2e0
jl 0x40d2dc
cmp ebx, 0xffffffff
ja 0x40d2e0
xor eax, eax
jmp 0x40d2e5
mov eax, 1
or eax, eax
je 0x40d300
push pe_nt_image_headers32
push dword [esp + 0x18]
call sub.KERNEL32.dll_SetFileAttributesW
push dword [esp + 0x14]
call sub.KERNEL32.dll_DeleteFileW
push edx
call fcn.00419490
pop edx
push eax
push 1
push dword [esp + 0x1c]
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
call fcn.00413e30
call fcn.004121b2
add dword [esp], edx
call sub.KERNEL32.dll_MoveFileExW
call fcn.004121d0
push dword [esp + 0x10]
push dword [esp + 0x18]
call sub.KERNEL32.dll_SetFileAttributesW
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 0x144]
call fcn.00412ef0
mov dword [esp + 0x30], eax
mov ebx, dword [esp + 0x30]
cmp ebx, 1
jne 0x40d3a3
call fcn.0040b3ac
push dword [esp + 0x14]
call fcn.00405597
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
push dword [esp + 0x20]
call fcn.0041626c
call fcn.004121b2
add dword [esp], edx
call fcn.00404bdf
call fcn.004121d0
mov edx, dword [esp + 0x14]
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419660
push 0x41fe2c
call fcn.004196c0
push dword [esp + 0x14]
mov eax, str.cpath
push eax
call fcn.00414044
jmp 0x40d41a
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419490
pop edx
push eax
call fcn.00413e30
lea eax, [esp + 0x38]
push eax
call fcn.004196c0
mov edx, dword [esp + 0x34]
push edx
call fcn.00419490
pop edx
push eax
push edx
call fcn.00419660
push 0x41fe2c
call fcn.004196c0
push dword [esp + 0x34]
mov eax, str.cpath
push eax
call fcn.00414044
xor eax, eax
push dword [esp + 0x18]
call fcn.00419630
push dword [esp + 0x2c]
call fcn.00419630
push dword [esp + 0x14]
call fcn.00419630
push dword [esp + 0x24]
call fcn.00419630
push dword [esp + 8]
call fcn.00419630
push dword [esp + 0x28]
call fcn.00419630
push dword [esp + 0x20]
call fcn.00419630
push dword [esp + 0x1c]
call fcn.00419630
push dword [esp + 0x34]
call fcn.00419630
add esp, 0x38
pop edi
pop ebx
pop ebp
ret 4