Function at 0x40d3d6
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebp
push ebx
push edi
mov edx, 0xe
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40d3de
call fcn.0041ed30
mov eax, dword [esp + 0x48]
mov dword [esp], eax
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 0x138]
call fcn.00414010
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
cmp ebx, 1
jne 0x40d868
mov dword [0x424ea8], 1
call fcn.0040b914
mov edx, dword [esp]
mov ebp, dword [edx]
mov edx, dword [ebp + 0x13c]
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041edc0
lea eax, [esp + 0xc]
push eax
call fcn.0041ee20
push dword [ebp + 0x140]
call fcn.00414010
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x40d46b
mov dword [esp + 0x10], pe_nt_image_headers32
jmp 0x40d4e5
mov ebx, dword [esp + 0xc]
cmp ebx, 1
jne 0x40d47e
mov dword [esp + 0x10], 1
jmp 0x40d4e5
mov ebx, dword [esp + 0xc]
cmp ebx, 2
jne 0x40d491
mov dword [esp + 0x10], 4
jmp 0x40d4e5
mov ebx, dword [esp + 0xc]
cmp ebx, 3
jne 0x40d4a4
mov dword [esp + 0x10], 2
jmp 0x40d4e5
mov ebx, dword [esp + 0xc]
cmp ebx, 4
jne 0x40d4b7
mov dword [esp + 0x10], 6
jmp 0x40d4e5
mov ebx, dword [esp + 0xc]
cmp ebx, 5
jne 0x40d4ca
mov dword [esp + 0x10], 5
jmp 0x40d4e5
mov ebx, dword [esp + 0xc]
cmp ebx, 6
jne 0x40d4dd
mov dword [esp + 0x10], 3
jmp 0x40d4e5
mov dword [esp + 0x10], 7
push edx
call fcn.0041ec80
pop edx
push eax
push dword [esp + 0xc]
call fcn.0040ddcd
lea eax, [esp + 0x18]
push eax
call fcn.0041ee20
push edx
call fcn.0041ec80
pop edx
push eax
push dword [esp + 0xc]
call fcn.0040436b
lea eax, [esp + 0x1c]
push eax
call fcn.0041ee20
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
call fcn.00414e70
lea eax, [esp + 0x20]
push eax
call fcn.0041ee20
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.0040b0d8
mov ebx, eax
and ebx, ebx
jne 0x40d561
push dword [esp + 0x14]
mov eax, str.cpath
push eax
call fcn.00415084
jmp 0x40d8b4
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
push dword [esp + 0x1c]
call fcn.00417275
lea eax, [esp + 0x24]
push eax
call fcn.0041ee20
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
call fcn.004172f4
lea eax, [esp + 0x28]
push eax
call fcn.0041ee20
push 1
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push eax
call fcn.0041e970
mov ebx, eax
and ebx, ebx
jne 0x40d6fa
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
push dword [esp + 0x1c]
call fcn.004171a7
lea eax, [esp + 0x2c]
push eax
call fcn.0041ee20
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
call fcn.00414e70
call fcn.004131e2
add dword [esp], edx
call fcn.004171a7
lea eax, [esp + 0x30]
push eax
call fcn.0041ee20
push 1
mov eax, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push eax
call fcn.0041e970
mov ebx, eax
and ebx, ebx
jne 0x40d63f
jmp 0x40d6f5
push edx
call fcn.0041ec80
pop edx
push eax
push pe_nt_image_headers32
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
call fcn.00414e70
call fcn.004131e2
add dword [esp], edx
call sub.KERNEL32.dll_SetFileAttributesW
call fcn.00413200
push dword [esp + 0x14]
call fcn.00416f93
push edx
push eax
pop ebx
pop edi
cmp edi, 0xffffffff
jg 0x40d690
jl 0x40d68c
cmp ebx, 0xffffffff
ja 0x40d690
xor eax, eax
jmp 0x40d695
mov eax, 1
or eax, eax
je 0x40d6b0
push pe_nt_image_headers32
push dword [esp + 0x18]
call sub.KERNEL32.dll_SetFileAttributesW
push dword [esp + 0x14]
call sub.KERNEL32.dll_DeleteFileW
push edx
call fcn.0041ec80
pop edx
push eax
push 1
push dword [esp + 0x1c]
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
call fcn.00414e70
call fcn.004131e2
add dword [esp], edx
call sub.KERNEL32.dll_MoveFileExW
call fcn.00413200
push dword [esp + 0x10]
push dword [esp + 0x18]
call sub.KERNEL32.dll_SetFileAttributesW
jmp 0x40d7dd
push dword [esp + 0x20]
call fcn.00416f93
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x40d715
cmp edi, 0xffffffff
jne 0x40d715
xor eax, eax
jmp 0x40d71a
mov eax, 1
or eax, eax
je 0x40d727
push dword [esp + 0x20]
call fcn.004024e9
push edx
call fcn.0041ec80
pop edx
push eax
push pe_nt_image_headers32
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
call fcn.00414e70
call fcn.004131e2
add dword [esp], edx
call sub.KERNEL32.dll_SetFileAttributesW
call fcn.00413200
push dword [esp + 0x14]
call fcn.00416f93
push edx
push eax
pop ebx
pop edi
cmp edi, 0xffffffff
jg 0x40d778
jl 0x40d774
cmp ebx, 0xffffffff
ja 0x40d778
xor eax, eax
jmp 0x40d77d
mov eax, 1
or eax, eax
je 0x40d798
push pe_nt_image_headers32
push dword [esp + 0x18]
call sub.KERNEL32.dll_SetFileAttributesW
push dword [esp + 0x14]
call sub.KERNEL32.dll_DeleteFileW
push edx
call fcn.0041ec80
pop edx
push eax
push 1
push dword [esp + 0x1c]
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
call fcn.00414e70
call fcn.004131e2
add dword [esp], edx
call sub.KERNEL32.dll_MoveFileExW
call fcn.00413200
push dword [esp + 0x10]
push dword [esp + 0x18]
call sub.KERNEL32.dll_SetFileAttributesW
mov edx, dword [esp]
mov ebp, dword [edx]
push dword [ebp + 0x144]
call fcn.00414010
mov dword [esp + 0x30], eax
mov ebx, dword [esp + 0x30]
cmp ebx, 1
jne 0x40d83b
call fcn.0040b914
push dword [esp + 0x14]
call fcn.00405dfd
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
push dword [esp + 0x20]
call fcn.00417275
call fcn.004131e2
add dword [esp], edx
call fcn.004055a2
call fcn.00413200
mov edx, dword [esp + 0x14]
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041edc0
push 0x424fa0
call fcn.0041ee20
push dword [esp + 0x14]
mov eax, str.cpath
push eax
call fcn.00415084
jmp 0x40d8b2
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041ec80
pop edx
push eax
call fcn.00414e70
lea eax, [esp + 0x38]
push eax
call fcn.0041ee20
mov edx, dword [esp + 0x34]
push edx
call fcn.0041ec80
pop edx
push eax
push edx
call fcn.0041edc0
push 0x424fa0
call fcn.0041ee20
push dword [esp + 0x34]
mov eax, str.cpath
push eax
call fcn.00415084
xor eax, eax
push dword [esp + 0x18]
call fcn.0041ed90
push dword [esp + 0x2c]
call fcn.0041ed90
push dword [esp + 0x14]
call fcn.0041ed90
push dword [esp + 0x24]
call fcn.0041ed90
push dword [esp + 8]
call fcn.0041ed90
push dword [esp + 0x28]
call fcn.0041ed90
push dword [esp + 0x20]
call fcn.0041ed90
push dword [esp + 0x1c]
call fcn.0041ed90
push dword [esp + 0x34]
call fcn.0041ed90
add esp, 0x38
pop edi
pop ebx
pop ebp
ret 4