Function at 0x408e2d
Capabilities:
Check if file exists
Check mutex on windows
Delete file
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d8
mov eax, dword [0x424064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
push 0x34
mov dword [ebp - 0x4a0], eax
lea eax, [ebp - 0x49c]
push ebx
push eax
call fcn.0040b3e0
push 0x34
lea eax, [ebp - 0x4d8]
push ebx
push eax
call fcn.0040b3e0
add esp, 0x18
lea edi, [ebp - 0x468]
xor eax, eax
push 6
pop ecx
rep stosd dword es:[edi], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push esi
call dword [sym.imp.USER32.dll_CharUpperW]
push 0x41b668
push esi
call dword [sym.imp.KERNEL32.DLL_lstrcmpW]
mov esi, eax
neg esi
push 0x425418
sbb esi, esi
and esi, 0x20
push 0x4249cc
add esi, 0xa0
call fcn.0040a314
pop ecx
pop ecx
test al, al
jne 0x408ecd
push 0x10
push 0x41b670
push 0x41b688
jmp 0x4093df
push esi
push dword [0x4249cc]
call fcn.0040a2ea
pop ecx
pop ecx
test al, al
jne 0x408f19
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x40]
push 0x1e
push eax
push 0x91
push ebx
call esi
push 0xc8
lea eax, [ebp - 0x248]
push eax
push 0x93
push ebx
call esi
push 0x10
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x248]
push eax
jmp 0x4093df
mov eax, dword [0x425420]
mov ecx, 0x100
cmp dword [0x425418], ebx
cmovne eax, ecx
mov dword [0x425420], eax
call fcn.00407d79
test eax, eax
jne 0x408f5c
push 0x1e
lea eax, [ebp - 0x40]
push eax
push 0x91
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
lea eax, [ebp - 0x40]
push eax
push str.Load_DLL_failed__
jmp 0x4093df
push str.A3C4E518_62F1_4fdc_8C6D_D77B00B185C1
push 1
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov dword [ebp - 0x4a4], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x408fe8
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x40]
push 0x1e
push eax
push 0x91
push ebx
call esi
push 0x3c
lea eax, [ebp - 0xb8]
push eax
push 0xb2
push ebx
call esi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x40]
push 0x30
push eax
lea eax, [ebp - 0x248]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [ebp - 0x40]
push eax
push ebx
call dword [sym.imp.USER32.dll_FindWindowW]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x4093e6
push 0x424fe8
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
cmp word [eax*2 + 0x424fe6], 0x5c
jne 0x40901f
lea eax, [eax*2 - 2]
cmp eax, 0x208
jae 0x4093f9
xor ecx, ecx
mov word [eax + 0x424fe8], cx
push edi
mov esi, 0x425428
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0x41b720
lea eax, [eax*2 + 0x425422]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
call esi
cmp eax, 0xffffffff
jne 0x409056
xor eax, eax
mov word [0x425428], ax
push edi
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
push str.LiuRebootFlag
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
lea eax, [ebp - 0x450]
push eax
call esi
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
push 0x1e
pop edi
cmp eax, 0xffffffff
je 0x4090de
push edi
lea eax, [ebp - 0x40]
push eax
push 0x91
push 0
call ebx
push 0xc8
lea eax, [ebp - 0x248]
push eax
push 0xbe
push 0
call ebx
push 0x134
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x248]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x4093e6
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push edi
push 0x424990
push 0x86
push 0
call ebx
mov esi, eax
mov ecx, edi
sub ecx, esi
push ecx
lea ecx, [esi*2 + 0x424990]
push ecx
push 0x87
push 0
call ebx
add esi, eax
sub edi, esi
push edi
lea eax, [esi*2 + 0x424990]
push eax
push 0x88
push 0
call ebx
cmp dword [0x425418], 0
je 0x409134
push str.__x64_
push 0x424990
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
mov ebx, dword [ebp - 0x4a0]
lea eax, [ebp - 0x49c]
mov esi, dword [sym.imp.COMCTL32.dll_CreatePropertySheetPageW]
push 0x6b
pop edi
push eax
mov dword [ebp - 0x49c], 0x34
mov dword [ebp - 0x498], 0x800
mov dword [ebp - 0x494], ebx
mov dword [ebp - 0x484], 0x408c85
mov dword [ebp - 0x490], edi
call esi
mov dword [ebp - 0x468], eax
lea eax, [ebp - 0x49c]
push eax
mov dword [ebp - 0x498], 0x3000
mov dword [ebp - 0x474], 0x95
mov dword [ebp - 0x470], 0x96
mov dword [ebp - 0x484], 0x4089f0
mov dword [ebp - 0x490], 0x6d
call esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x49c]
push eax
mov dword [ebp - 0x498], 0x3000
mov dword [ebp - 0x474], 0x99
mov dword [ebp - 0x470], 0x9a
mov dword [ebp - 0x484], 0x408911
mov dword [ebp - 0x490], 0x6f
call esi
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x49c]
push eax
mov dword [ebp - 0x498], 0x800
mov dword [ebp - 0x484], 0x4086b8
mov dword [ebp - 0x490], 0x6c
call esi
mov dword [ebp - 0x458], eax
lea eax, [ebp - 0x49c]
push eax
mov dword [ebp - 0x498], 0x800
mov dword [ebp - 0x484], 0x4087c3
mov dword [ebp - 0x490], 0x70
call esi
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x468]
mov dword [ebp - 0x4cc], ebx
xor ebx, ebx
push 0xa0
push dword [0x4249cc]
mov dword [ebp - 0x4d8], 0x34
mov dword [ebp - 0x4d0], ebx
mov dword [ebp - 0x4b8], eax
mov dword [ebp - 0x4d4], 0x1088004
mov dword [ebp - 0x4b0], 0x85
mov dword [ebp - 0x4a8], 0x84
call fcn.0040a2ea
xor ecx, ecx
mov dword [ebp - 0x4bc], ebx
test al, al
mov dword [ebp - 0x4c0], 6
push 0x1f0
lea eax, [ebp - 0x438]
cmovne edi, ecx
push ebx
push eax
mov dword [ebp - 0x4c8], edi
call fcn.0040b3e0
add esp, 0x14
mov dword [ebp - 0x43c], 0x1f4
lea eax, [ebp - 0x43c]
push ebx
push eax
push ebx
push 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x17
pop ecx
push str.PMingLiU
lea eax, [ebp - 0x80]
lea esi, [ebp - 0x2a4]
lea edi, [ebp - 0x9c]
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [ebp - 0x8c], 0x2bc
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
imul eax, eax, 0xc
push 0xffffffffffffffb8
pop ecx
cdq
idiv ecx
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push esi
push ebx
mov dword [0x425424], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
lea eax, [ebp - 0x4d8]
push eax
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
push dword [0x425424]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x4a4]
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
cmp dword [0x425638], ebx
je 0x4093e6
call fcn.00407da2
test eax, eax
jne 0x4093e6
push 0x30
push 0x41b76c
push 0x41b77c
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a558
leave
ret 0x10
call fcn.0040a6be
int3