Function at 0x401a10
Capabilities:
Check os version
Delete directory
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xe0cc
call fcn.00401f60
push edi
push esi
push ebx
call sub.COMCTL32.DLL_InitCommonControls
mov dword [ebp - 0xa0], 0x94
add esp, 0xfffffff4
lea eax, [ebp - 0xa0]
push eax
call sub.KERNEL32.dll_GetVersionExA
add esp, 0xc
test eax, eax
je 0x401f46
cmp dword [ebp + 0x10], 0
je 0x401a61
mov edi, dword [ebp + 0x10]
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
cmp ecx, 0xfffffffe
jne 0x401a6c
mov eax, 1
jmp 0x401f48
cmp dword [ebp + 0x14], 0xe4653c7
jne 0x401a84
add esp, 0xfffffff8
push 0
push 0
call sub.KERNEL32.dll_FindFirstFileA
add esp, 8
call fcn.00401850
mov byte [ebp - 0xe0a6], 0
mov byte [ebp - 0xe0a7], 0
add esp, 0xfffffff8
push 0x4019b6
lea eax, [ebp - 0xa0a0]
mov dword [ebp - 0xe0ac], eax
push eax
call sub.msvcrt.dll_wcscpy
add esp, 0xfffffff8
push 0x4019b6
lea eax, [ebp - 0xe0a0]
mov dword [ebp - 0xe0b0], eax
push eax
call sub.msvcrt.dll_wcscpy
mov byte [ebp - 0xe0b1], 0
add esp, 0x20
mov dword [ebp - 0xe0a4], 1
nop
mov byte [ebp - 0xe0a5], 0
xor esi, esi
add esp, 0xfffffff8
push 0x4019b8
mov eax, dword [ebp + 0x10]
push eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0xe0b8], eax
add esp, 0x10
test eax, eax
je 0x401e12
jmp 0x401db8
mov byte [ebx + edx - 1], 0
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea edx, [ecx - 1]
test edx, edx
jle 0x401b36
mov al, byte [ebx + ecx - 2]
cmp al, 0xd
je 0x401b10
cmp al, 0xa
je 0x401b10
lea ebx, [ebp - 0x20a0]
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
cmp ecx, 0xfffffffe
jne 0x401b54
inc esi
jmp 0x401db8
test esi, esi
jne 0x401b70
add esp, 0xfffffff4
push ebx
call fcn.004017f0
mov esi, 1
add esp, 0x10
jmp 0x401db8
cmp esi, 1
jne 0x401c8c
mov esi, ebx
mov edi, 0x4019bb
mov ecx, 0xd
cld
test al, 0
repe cmpsb byte [esi], byte es:[edi]
sete byte [ebp - 0xe0a7]
mov byte [ebp - 0xe0b1], 0
cmp byte [ebp - 0xe0a7], 0
jne 0x401bb4
mov esi, ebx
mov edi, 0x4019c8
mov ecx, 0x10
cld
test al, 0
repe cmpsb byte [esi], byte es:[edi]
jne 0x401bdc
mov byte [ebp - 0xe0b1], 1
jmp 0x401bdc
cmp dword [ebp - 0xe0a4], 1
jne 0x401bdc
add esp, 0xfffffff8
push ebx
mov eax, dword [ebp - 0xe0ac]
push eax
call sub.msvcrt.dll_wcscat
add esp, 0x10
add esp, 0xfffffffc
mov eax, dword [ebp - 0xe0b8]
push eax
push 0x2000
lea ebx, [ebp - 0x60a0]
push ebx
call sub.msvcrt.dll_fgetws
add esp, 0x10
test eax, eax
je 0x401c40
add esp, 0xfffffffc
add esp, 0xfffffff4
push 0x4019d8
call sub.msvcrt.dll_wcslen
push eax
push 0x4019d8
push ebx
call sub.msvcrt.dll_wcsncmp
add esp, 0x20
test eax, eax
jne 0x401bc0
jmp 0x401c40
cmp dword [ebp - 0xe0a4], 1
jne 0x401c40
add esp, 0xfffffff8
push ebx
mov eax, dword [ebp - 0xe0b0]
push eax
call sub.msvcrt.dll_wcscat
add esp, 0x10
add esp, 0xfffffffc
mov eax, dword [ebp - 0xe0b8]
push eax
push 0x2000
push ebx
call sub.msvcrt.dll_fgetws
add esp, 0x10
test eax, eax
je 0x401c7f
add esp, 0xfffffffc
add esp, 0xfffffff4
push 0x4019d8
call sub.msvcrt.dll_wcslen
push eax
push 0x4019d8
push ebx
call sub.msvcrt.dll_wcsncmp
add esp, 0x20
test eax, eax
jne 0x401c24
mov esi, 2
jmp 0x401db8
cmp esi, 2
jne 0x401d3c
add esp, 0xfffffff4
push ebx
call sub.KERNEL32.dll_DeleteFileA
add esp, 0xc
test eax, eax
jne 0x401db8
add esp, 0xfffffff4
push ebx
call fcn.0040149c
add esp, 0x10
test al, al
je 0x401db8
add esp, 0xfffffff8
push 0x4019ec
push ebx
call sub.msvcrt.dll_strstr
add esp, 0x10
test eax, eax
je 0x401ceb
add esp, 0xfffffff8
push 0x4019f0
push ebx
call sub.msvcrt.dll_strstr
add esp, 0x10
test eax, eax
jne 0x401d9f
mov byte [ebp - 0xe0a5], 1
cmp dword [ebp - 0xe0a4], 4
jne 0x401db8
cmp byte [ebp - 0xe0b1], 0
je 0x401db8
cmp dword [ebp - 0x90], 2
jne 0x401db8
add esp, 0xfffffffc
push 4
push 0
push ebx
call sub.KERNEL32.dll_MoveFileExA
add esp, 4
test eax, eax
je 0x401db8
mov byte [ebp - 0xe0a6], 1
jmp 0x401db8
add esp, 0xfffffff4
push ebx
call sub.KERNEL32.dll_RemoveDirectoryA
add esp, 0xc
test eax, eax
jne 0x401db8
add esp, 0xfffffff4
push ebx
call fcn.0040149c
add esp, 0x10
test al, al
je 0x401db8
add esp, 0xfffffff8
push 0x4019ec
push ebx
call sub.msvcrt.dll_strstr
add esp, 0x10
test eax, eax
je 0x401d86
add esp, 0xfffffff8
push 0x4019f0
push ebx
call sub.msvcrt.dll_strstr
add esp, 0x10
test eax, eax
jne 0x401d9f
mov byte [ebp - 0xe0a5], 1
cmp dword [ebp - 0xe0a4], 4
jne 0x401db8
cmp byte [ebp - 0xe0b1], 0
je 0x401db8
cmp dword [ebp - 0x90], 2
jne 0x401db8
add esp, 0xfffffffc
push 4
push 0
push ebx
call sub.KERNEL32.dll_MoveFileExA
add esp, 4
add esp, 0xfffffffc
mov eax, dword [ebp - 0xe0b8]
push eax
push 0x2000
lea ebx, [ebp - 0x20a0]
push ebx
call sub.msvcrt.dll_fgets
add esp, 0x10
test eax, eax
jne 0x401b15
add esp, 0xfffffff4
mov eax, dword [ebp - 0xe0b8]
push eax
call sub.msvcrt.dll_fclose
add esp, 0x10
cmp byte [ebp - 0xe0a5], 0
je 0x401e30
cmp dword [ebp - 0xe0a4], 3
jg 0x401e12
add esp, 0xfffffff4
push 0x1f4
call sub.KERNEL32.dll_Sleep
add esp, 0xc
cmp byte [ebp - 0xe0a5], 0
je 0x401e30
mov eax, dword [ebp - 0xe0a4]
inc dword [ebp - 0xe0a4]
cmp eax, 3
jle 0x401ae0
add esp, 0xfffffff4
mov eax, dword [ebp + 0x10]
push eax
call sub.KERNEL32.dll_DeleteFileA
add esp, 0xfffffff8
push 0x2000
lea esi, [ebp - 0x20a0]
push esi
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
add esp, 0x14
cmp byte [ebp - 0xe0b1], 0
je 0x401e6e
add esp, 0xfffffffc
push 4
push 0
push esi
call sub.KERNEL32.dll_MoveFileExA
add esp, 4
cmp byte [ebp - 0xe0a7], 0
je 0x401eb4
call fcn.004018f0
test al, al
jne 0x401f46
add esp, 0xfffffff4
lea ebx, [ebp - 0xe0a0]
push ebx
call sub.msvcrt.dll_wcslen
add esp, 0x10
cmp eax, 5
jbe 0x401f46
push 0x30
push 0x4019fa
push ebx
push 0
call sub.USER32.dll_MessageBoxW
jmp 0x401f46
cmp byte [ebp - 0xe0a6], 0
je 0x401f46
add esp, 0xfffffff4
lea ebx, [ebp - 0xa0a0]
push ebx
call sub.msvcrt.dll_wcslen
add esp, 0x10
cmp eax, 5
jbe 0x401f20
push 0x24
push 0x4019fa
push ebx
push 0
call sub.USER32.dll_MessageBoxW
cmp eax, 6
jne 0x401f20
call fcn.004018f0
test al, al
jne 0x401f46
add esp, 0xfffffff4
lea ebx, [ebp - 0xe0a0]
push ebx
call sub.msvcrt.dll_wcslen
add esp, 0x10
cmp eax, 5
jbe 0x401f46
push 0x30
push 0x4019fa
push ebx
push 0
call sub.USER32.dll_MessageBoxW
jmp 0x401f46
add esp, 0xfffffff4
push esi
call fcn.00401788
add esp, 0xfffffffc
push 4
push 0
push esi
call sub.KERNEL32.dll_MoveFileExA
add esp, 0x14
test eax, eax
je 0x401f46
add esp, 0xfffffff4
push esi
call fcn.004013cc
xor eax, eax
lea esp, [ebp - 0xe0d8]
pop ebx
pop esi
pop edi
leave
ret 0x10