Function at 0x4087d0
Capabilities:
Create directory
Create thread
Delete directory
Delete file
Get common file path
Resume thread

Disassembly:
sub esp, 0x1c8
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
mov dword [0x42064c], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [esp + 0x164]
push str.DWD_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0xa48
call fcn.0040ef93
mov edi, eax
mov ecx, 0x292
xor eax, eax
mov dword [0x420638], edi
rep stosd dword es:[edi], eax
push 0x3390
call fcn.0040ef93
mov ecx, dword [0x420638]
add esp, 0x14
mov dword [ecx + 0xa44], eax
mov edx, dword [0x420638]
mov ecx, 0xce4
xor eax, eax
mov edi, dword [edx + 0xa44]
push 0x104
rep stosd dword es:[edi], eax
mov eax, dword [0x420638]
add eax, 0x104
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [0x420638]
add ecx, 0x734
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, dword [0x420638]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
add edx, 0x734
push edx
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, eax
mov eax, dword [0x420638]
cmp byte [ecx + eax + 0x733], 0x5c
je 0x4088b6
add eax, 0x734
push 0x41d1c8
push eax
call esi
mov eax, dword [0x420638]
lea edx, [esp + 0x160]
add eax, 0x734
push edx
push eax
call esi
mov eax, dword [0x420638]
push 0x41d1c8
add eax, 0x734
push eax
call esi
mov ecx, dword [0x420638]
push ebp
add ecx, 0x734
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x408b2e
mov edx, dword [0x420638]
mov eax, dword [0x420640]
add edx, 0x104
push edx
push eax
call fcn.00408410
add esp, 8
test eax, eax
je 0x408b2e
call fcn.00408f60
test eax, eax
je 0x408b2e
call fcn.00408e90
test eax, eax
je 0x408970
mov ecx, dword [0x420638]
mov dword [ecx + 0x418], 1
call fcn.004090a0
test eax, eax
jne 0x408970
mov edx, dword [0x420638]
cmp dword [edx + 0x410], ebp
jne 0x408b2e
push 0x10
push str.Error
push str.Failed_to_aquire_logon_information.
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x408b2e
mov eax, dword [0x420638]
cmp dword [eax + 0x410], ebp
jne 0x408a40
mov eax, dword [esp + 0x1e0]
mov edi, dword [esp + 0x1dc]
cmp eax, ebp
jne 0x4089f3
push 0x65
push edi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], 0x40a5a0
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], edi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push ebp
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push ebp
mov dword [esp + 0x30], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], ebp
push ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], str.DWMRCII
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x408b2e
push ebp
push edi
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push 0xcf0000
push 0x420634
push str.DWMRCII
push 0x20
mov dword [0x42063c], edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
push ebp
push eax
mov dword [0x420640], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x420640]
push ebp
push 0x408750
push edx
push 0x69
push edi
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x420644], eax
lea eax, [esp + 0x140]
push eax
push 4
push ebp
push 0x40a530
push ebp
push ebp
call fcn.0040fb27
mov edi, eax
add esp, 0x18
cmp edi, ebp
je 0x408aa5
push 2
push ebp
lea ecx, [esp + 0x18]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
push edi
jne 0x408a98
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c8
ret 0x10
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x420638]
cmp dword [edx + 0x410], ebp
je 0x408ace
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x408b41
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x10]
jmp 0x408b36
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push ebp
push ebp
lea ecx, [esp + 0x14c]
push ebp
push ecx
call edi
test eax, eax
je 0x408b2e
mov eax, dword [0x420644]
cmp eax, ebp
je 0x408b01
lea edx, [esp + 0x144]
push edx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x408b1d
lea eax, [esp + 0x144]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [esp + 0x144]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebp
push ebp
lea edx, [esp + 0x14c]
push ebp
push edx
call edi
test eax, eax
jne 0x408ae5
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x408b41
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], ebp
mov eax, dword [0x420638]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call edi
mov ecx, dword [0x420638]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add ecx, 0x734
lea edx, [esp + 0x3c]
push ecx
push edx
call ebp
lea eax, [esp + 0x3c]
push eax
call ebx
cmp byte [esp + eax + 0x3b], 0x5c
je 0x408b83
lea ecx, [esp + 0x3c]
push 0x41d1c8
push ecx
call esi
lea edx, [esp + 0x3c]
push str.DWRCS.reg
push edx
call esi
lea eax, [esp + 0x3c]
push eax
call edi
mov ecx, dword [0x420638]
lea edx, [esp + 0x3c]
add ecx, 0x734
push ecx
push edx
call ebp
lea eax, [esp + 0x3c]
push eax
call ebx
cmp byte [esp + eax + 0x3b], 0x5c
je 0x408bc4
lea ecx, [esp + 0x3c]
push 0x41d1c8
push ecx
call esi
lea edx, [esp + 0x3c]
push str.DWRCS.exe
push edx
call esi
lea eax, [esp + 0x3c]
push eax
call edi
mov ecx, dword [0x420638]
lea edx, [esp + 0x3c]
add ecx, 0x734
push ecx
push edx
call ebp
lea eax, [esp + 0x3c]
push eax
call ebx
cmp byte [esp + eax + 0x3b], 0x5c
je 0x408c05
lea ecx, [esp + 0x3c]
push 0x41d1c8
push ecx
call esi
lea edx, [esp + 0x3c]
push str.DWRCS.tmp
push edx
call esi
lea eax, [esp + 0x3c]
push eax
call edi
mov ecx, dword [0x420638]
lea edx, [esp + 0x3c]
add ecx, 0x734
push ecx
push edx
call ebp
lea eax, [esp + 0x3c]
push eax
call ebx
cmp byte [esp + eax + 0x3b], 0x5c
je 0x408c46
lea ecx, [esp + 0x3c]
push 0x41d1c8
push ecx
call esi
lea edx, [esp + 0x3c]
push str.DWRCK.dll
push edx
call esi
lea eax, [esp + 0x3c]
push eax
call edi
mov ecx, dword [0x420638]
lea edx, [esp + 0x3c]
add ecx, 0x734
push ecx
push edx
call ebp
lea eax, [esp + 0x3c]
push eax
call ebx
cmp byte [esp + eax + 0x3b], 0x5c
je 0x408c87
lea ecx, [esp + 0x3c]
push 0x41d1c8
push ecx
call esi
lea edx, [esp + 0x3c]
push str.DWRCSP.cfg
push edx
call esi
lea eax, [esp + 0x3c]
push eax
call edi
mov ecx, dword [0x420638]
lea edx, [esp + 0x3c]
add ecx, 0x734
push ecx
push edx
call ebp
lea eax, [esp + 0x3c]
push eax
call ebx
cmp byte [esp + eax + 0x3b], 0x5c
je 0x408cc8
lea ecx, [esp + 0x3c]
push 0x41d1c8
push ecx
call esi
lea edx, [esp + 0x3c]
push str.DWRCSU.cfg
push edx
call esi
lea eax, [esp + 0x3c]
push eax
call edi
mov ecx, dword [0x420638]
lea edx, [esp + 0x3c]
add ecx, 0x734
push ecx
push edx
call ebp
lea eax, [esp + 0x3c]
push eax
call ebx
cmp byte [esp + eax + 0x3b], 0x5c
je 0x408d09
lea ecx, [esp + 0x3c]
push 0x41d1c8
push ecx
call esi
lea edx, [esp + 0x3c]
push str.DWRCSET.dll
push edx
call esi
lea eax, [esp + 0x3c]
push eax
call edi
mov ecx, dword [0x420638]
lea edx, [esp + 0x3c]
add ecx, 0x734
push ecx
push edx
call ebp
lea eax, [esp + 0x3c]
push eax
call ebx
cmp byte [esp + eax + 0x3b], 0x5c
je 0x408d4a
lea ecx, [esp + 0x3c]
push 0x41d1c8
push ecx
call esi
lea edx, [esp + 0x3c]
push str.DWRCShell.dll
push edx
call esi
lea eax, [esp + 0x3c]
push eax
call edi
mov ecx, dword [0x420638]
lea edx, [esp + 0x3c]
add ecx, 0x734
push ecx
push edx
call ebp
lea eax, [esp + 0x3c]
push eax
call ebx
cmp byte [esp + eax + 0x3b], 0x5c
je 0x408d8b
lea ecx, [esp + 0x3c]
push 0x41d1c8
push ecx
call esi
lea edx, [esp + 0x3c]
push str.DWRCSI.dll
push edx
call esi
lea eax, [esp + 0x3c]
push eax
call edi
mov ecx, dword [0x420638]
lea edx, [esp + 0x3c]
add ecx, 0x734
push ecx
push edx
call ebp
lea eax, [esp + 0x3c]
push eax
call ebx
cmp byte [esp + eax + 0x3b], 0x5c
je 0x408dcc
lea ecx, [esp + 0x3c]
push 0x41d1c8
push ecx
call esi
lea edx, [esp + 0x3c]
push str.DWRCST.exe
push edx
call esi
lea eax, [esp + 0x3c]
push eax
call edi
mov ecx, dword [0x420638]
lea edx, [esp + 0x3c]
add ecx, 0x734
push ecx
push edx
call ebp
lea eax, [esp + 0x3c]
push eax
call ebx
cmp byte [esp + eax + 0x3b], 0x5c
je 0x408e0d
lea ecx, [esp + 0x3c]
push 0x41d1c8
push ecx
call esi
lea edx, [esp + 0x3c]
push str.DWRCST.exe.manifest
push edx
call esi
lea eax, [esp + 0x3c]
push eax
call edi
mov ecx, dword [0x420638]
add ecx, 0x734
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call fcn.00408e90
test eax, eax
je 0x408e41
call fcn.00409c90
mov ecx, dword [0x420638]
mov eax, dword [ecx + 0xa44]
test eax, eax
je 0x408e60
push eax
call fcn.0040eeaa
mov ecx, dword [0x420638]
add esp, 4
test ecx, ecx
je 0x408e6d
push ecx
call fcn.0040eeaa
add esp, 4
mov eax, dword [esp + 0x14c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c8
ret 0x10