Function at 0x40e860
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Get file attributes

Disassembly:
sub esp, 0x6c4
mov eax, dword [0x4677a0]
xor eax, esp
mov dword [esp + 0x6c0], eax
push ebp
mov ebp, dword [esp + 0x6cc]
push esi
push edi
push 0x28
push 0x46f0f8
lea esi, [esp + 0x224]
call fcn.004047a0
add esp, 8
lea ecx, [esp + 0x26c]
mov edi, esi
call fcn.0040fbd0
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov dword [esp + 0x10], esi
test esi, esi
je 0x40ebdf
xor ecx, ecx
mov word [esp + 0x26c], cx
push 0x104
push 0x46f0f8
lea edx, [esp + 0x274]
mov ecx, str.DataLocation
call fcn.00407360
add esp, 8
mov ecx, 0x104
lea eax, [esp + 0x26c]
cmp word [eax], 0
je 0x40e902
add eax, 2
sub ecx, 1
jne 0x40e8f2
jmp 0x40e925
test ecx, ecx
je 0x40e925
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [esp + eax*2 + 0x26c]
mov eax, 0x457f30
call fcn.00407450
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x270]
call fcn.0040fca0
add esp, 4
test eax, eax
je 0x40ebd8
mov esi, dword [esp + 0xc]
mov ecx, dword [esi + 0x214]
mov edi, dword [ecx + 4]
xor eax, eax
test edi, edi
jle 0x40ebcf
jmp 0x40e960
mov edx, dword [ecx + eax*4 + 0x10288]
mov dl, byte [edx + ecx + 3]
and dl, 0x3f
cmp dl, 2
jne 0x40e978
mov eax, SysReAllocString
inc eax
cmp eax, edi
jl 0x40e960
cmp eax, 0x7fffffff
jne 0x40ebcf
test ebp, ebp
jne 0x40e990
xor eax, eax
jmp 0x40e993
mov eax, dword [ebp + 0x20]
push 1
push 5
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40ebcf
lea eax, [esp + 0x14]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e9c0
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x12], 0x5c
je 0x40ea10
mov ecx, 0x104
lea eax, [esp + 0x14]
cmp word [eax], 0
je 0x40e9f0
add eax, 2
sub ecx, 1
jne 0x40e9e0
jmp 0x40ea10
test ecx, ecx
je 0x40ea10
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [esp + eax*2 + 0x14]
mov eax, 0x457ff4
call fcn.00407450
mov ecx, 0x104
lea eax, [esp + 0x14]
lea esp, [esp]
cmp word [eax], 0
je 0x40ea30
add eax, 2
sub ecx, 1
jne 0x40ea20
jmp 0x40ea50
test ecx, ecx
je 0x40ea50
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [esp + eax*2 + 0x14]
mov eax, 0x45ce68
call fcn.00407450
mov ecx, 0x104
lea eax, [esp + 0x14]
lea esp, [esp]
cmp word [eax], 0
je 0x40ea70
add eax, 2
sub ecx, 1
jne 0x40ea60
jmp 0x40ea90
test ecx, ecx
je 0x40ea90
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [esp + eax*2 + 0x14]
mov eax, 0x46be44
call fcn.00407450
mov ecx, 0x104
lea eax, [esp + 0x14]
lea esp, [esp]
cmp word [eax], 0
je 0x40eab0
add eax, 2
sub ecx, 1
jne 0x40eaa0
jmp 0x40ead0
test ecx, ecx
je 0x40ead0
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [esp + eax*2 + 0x14]
mov eax, 0x45ce70
call fcn.00407450
push ebx
lea ebx, [esp + 0x18]
call fcn.00409760
mov ecx, 0x104
mov eax, ebx
cmp word [eax], 0
je 0x40eaf1
add eax, 2
sub ecx, 1
jne 0x40eae1
jmp 0x40eb11
test ecx, ecx
je 0x40eb11
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [esp + eax*2 + 0x18]
mov eax, 0x45ce78
call fcn.00407450
mov eax, dword [esp + 0x14]
push str.DDITFGetObject
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40eb39
lea ecx, [esp + 0x10]
push ecx
push 3
call eax
add esp, 8
mov edx, dword [esp + 0x10]
push esi
lea ecx, [esp + 0x1c]
call fcn.0040f840
add esp, 4
test eax, eax
jne 0x40eb5b
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40ebce
lea eax, [esp + 0x18]
push eax
push 0x45cea8
mov ecx, 0x12c
lea ebx, [esp + 0x480]
call fcn.00402d10
add esp, 8
push 0x24
push 0x45cedc
mov ecx, ebx
push ecx
mov ecx, ebp
call fcn.0041ad4f
cmp eax, 6
jne 0x40ebce
lea edx, [esp + 0x18]
push edx
push str._select___s_
mov ecx, 0x12c
call fcn.00402d10
add esp, 8
test ebp, ebp
jne 0x40ebae
xor eax, eax
jmp 0x40ebb1
mov eax, dword [ebp + 0x20]
push 5
push 0
lea ecx, [esp + 0x480]
push ecx
push str.Explorer.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebx
call fcn.00409280
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x6cc]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00435010
add esp, 0x6c4
ret