Function at 0x410f2b
Capabilities:
Bypass windows file protection
Check if file exists
Get file attributes
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xb3d0
call fcn.0041b700
push ebx
push esi
push edi
push str.kernel32
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x410f9d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetDllDirectoryW
push edi
call esi
cmp eax, ebx
je 0x410f75
movzx ecx, byte [ebp + 8]
neg ecx
sbb ecx, ecx
and ecx, 0x42b5cc
push ecx
call eax
push str.SetDefaultDllDirectories
push edi
call esi
cmp eax, ebx
je 0x410f9d
xor ecx, ecx
cmp byte [ebp + 8], bl
sete cl
dec ecx
and ecx, 0xfffff800
add ecx, 0x1000
push ecx
call eax
mov byte [ebp - 1], 1
mov eax, dword [str.xlistpos]
cmp byte [eax], 0x78
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x2c], str.version.dll
mov dword [ebp - 0x28], str.DXGIDebug.dll
mov dword [ebp - 0x24], str.sfc_os.dll
mov dword [ebp - 0x20], str.SSPICLI.DLL
mov dword [ebp - 0x1c], str.rsaenh.dll
mov dword [ebp - 0x18], str.UXTheme.dll
mov dword [ebp - 0x14], str.dwmapi.dll
mov dword [ebp - 0x10], str.cryptbase.dll
mov dword [ebp - 0x100], str.lpk.dll
mov dword [ebp - 0xfc], str.usp10.dll
mov dword [ebp - 0xf8], str.clbcatq.dll
mov dword [ebp - 0xf4], str.comres.dll
mov dword [ebp - 0xf0], str.ws2_32.dll
mov dword [ebp - 0xec], str.ws2help.dll
mov dword [ebp - 0xe8], str.psapi.dll
mov dword [ebp - 0xe4], str.ieframe.dll
mov dword [ebp - 0xe0], str.ntshrui.dll
mov dword [ebp - 0xdc], str.atl.dll
mov dword [ebp - 0xd8], str.setupapi.dll
mov dword [ebp - 0xd4], str.apphelp.dll
mov dword [ebp - 0xd0], str.userenv.dll
mov dword [ebp - 0xcc], str.netapi32.dll
mov dword [ebp - 0xc8], str.shdocvw.dll
mov dword [ebp - 0xc4], str.crypt32.dll
mov dword [ebp - 0xc0], str.msasn1.dll
mov dword [ebp - 0xbc], str.cryptui.dll
mov dword [ebp - 0xb8], str.wintrust.dll
mov dword [ebp - 0xb4], str.shell32.dll
mov dword [ebp - 0xb0], str.secur32.dll
mov dword [ebp - 0xac], str.cabinet.dll
mov dword [ebp - 0xa8], str.oleaccrc.dll
mov dword [ebp - 0xa4], str.ntmarta.dll
mov dword [ebp - 0xa0], str.profapi.dll
mov dword [ebp - 0x9c], str.WindowsCodecs.dll
mov dword [ebp - 0x98], str.srvcli.dll
mov dword [ebp - 0x94], str.cscapi.dll
mov dword [ebp - 0x90], str.slc.dll
mov dword [ebp - 0x8c], str.imageres.dll
mov dword [ebp - 0x88], str.dnsapi.DLL
mov dword [ebp - 0x84], str.iphlpapi.DLL
mov dword [ebp - 0x80], str.WINNSI.DLL
mov dword [ebp - 0x7c], str.netutils.dll
mov dword [ebp - 0x78], str.mpr.dll
mov dword [ebp - 0x74], str.devrtl.dll
mov dword [ebp - 0x70], str.propsys.dll
mov dword [ebp - 0x6c], str.mlang.dll
mov dword [ebp - 0x68], str.samcli.dll
mov dword [ebp - 0x64], str.samlib.dll
mov dword [ebp - 0x60], str.wkscli.dll
mov dword [ebp - 0x5c], str.dfscli.dll
mov dword [ebp - 0x58], str.browcli.dll
mov dword [ebp - 0x54], str.rasadhlp.dll
mov dword [ebp - 0x50], str.dhcpcsvc6.dll
mov dword [ebp - 0x4c], str.dhcpcsvc.dll
mov dword [ebp - 0x48], str.XmlLite.dll
mov dword [ebp - 0x44], str.linkinfo.dll
mov dword [ebp - 0x40], str.cryptsp.dll
mov dword [ebp - 0x3c], str.RpcRtRemote.dll
mov dword [ebp - 0x38], str.aclui.dll
mov dword [ebp - 0x34], str.dsrole.dll
mov dword [ebp - 0x30], str.peerdist.dll
mov esi, 0x800
je 0x411281
push eax
call fcn.0041e275
pop ecx
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x411281
push esi
lea eax, [ebp - 0x2308]
push eax
push ebx
call edi
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
lea eax, [ebp - 0x2308]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x411278
push ebx
push ebx
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [ebp + 8]
jne 0x411278
push ebx
lea eax, [ebp - 0xc]
push eax
push 0x7ffe
lea eax, [ebp - 0xb3d0]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411278
mov eax, dword [ebp - 0xc]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0xb3d0], cx
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0xb3d0]
push eax
call fcn.00410ccf
mov dword [ebp + 8], eax
test eax, eax
je 0x411276
lea eax, [ebp - 0x308]
push eax
call fcn.00410e93
push ebx
lea eax, [ebp - 0x308]
push eax
push dword [ebp + 8]
jmp 0x411251
xor ebx, ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
lea eax, [ebp - 0x1308]
push eax
push ebx
call edi
push esi
lea eax, [ebp - 0x1308]
push eax
call fcn.0040a612
push eax
lea eax, [ebp - 0x33d0]
push eax
call fcn.00410be2
mov dword [ebp + 8], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edi, edi
call fcn.00409c3d
cmp eax, 0x600
jb 0x4112c8
push dword [ebp + edi*4 - 0x2c]
call fcn.00410e93
jmp 0x4112ca
xor eax, eax
test eax, eax
je 0x4112f0
push 0xffffffffffffffff
push str.DXGIDebug.dll
push 0xffffffffffffffff
push dword [ebp + edi*4 - 0x2c]
push 0x1001
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41130f
push esi
push dword [ebp + edi*4 - 0x2c]
lea eax, [ebp - 0x1308]
push eax
call fcn.0040a77c
lea eax, [ebp - 0x1308]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x411317
inc edi
cmp edi, 8
jb 0x4112b1
jmp 0x41131e
mov eax, dword [ebp + edi*4 - 0x2c]
mov dword [ebp + 8], eax
cmp byte [ebp - 1], 0
jne 0x41135a
xor edi, edi
push esi
push dword [ebp + edi*4 - 0x100]
lea eax, [ebp - 0x1308]
push eax
call fcn.0040a77c
lea eax, [ebp - 0x1308]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x411350
inc edi
cmp edi, 0x35
jb 0x411326
jmp 0x41135a
mov eax, dword [ebp + edi*4 - 0x100]
mov dword [ebp + 8], eax
xor esi, esi
cmp dword [ebp + 8], esi
je 0x41145f
lea eax, [ebp - 0x1308]
push eax
call fcn.0040a82a
call fcn.00409c3d
cmp eax, 0x600
jb 0x4113dd
push str.dwmapi.dll
call fcn.00410e93
push str.uxtheme.dll
call fcn.00410e93
lea eax, [ebp - 0x33d0]
push eax
lea eax, [ebp - 0x1308]
push eax
push dword [ebp + 8]
push 0xf1
call fcn.0040c3e8
push eax
lea eax, [ebp - 0x23d0]
push 0x864
push eax
call fcn.0040d7cd
add esp, 0x18
push 0x30
push 0xf0
call fcn.0040c3e8
push eax
lea eax, [ebp - 0x23d0]
push eax
push esi
call fcn.0041a629
jmp 0x411458
lea eax, [ebp - 0x33d0]
push eax
lea eax, [ebp - 0x1308]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x23d0]
push str.Please_remove__s_from__s_folder._It_is_unsecure_to_run__s_until_it_is_done.
push 0x864
push eax
call fcn.0040d7cd
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
je 0x411458
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push esi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x23d0]
push eax
call fcn.0041b3bb
pop ecx
push eax
lea eax, [ebp - 0x23d0]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
leave
ret 4