Function at 0x1004e0d
Capabilities:
Create directory
Delete directory
Delete file
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x1008010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x444], ecx
lea edi, [ebp - 0x440]
stosd dword es:[edi], eax
mov dword [ebp - 0x434], ecx
lea edi, [ebp - 0x430]
stosd dword es:[edi], eax
mov esi, 0x206
mov dword [ebp - 0x43c], ecx
lea edi, [ebp - 0x438]
push esi
stosd dword es:[edi], eax
mov word [ebp - 0x414], ax
push ecx
lea eax, [ebp - 0x412]
push eax
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x424], ecx
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x20c], ax
xor esi, esi
lea eax, [ebp - 0x20a]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x418], 1
mov dword [ebp - 0x420], esi
mov dword [ebp - 0x41c], esi
mov edi, 0x1008d20
push edi
call fcn.010019fc
push 0x10015a0
mov dword [0x1008d40], 0x10012b0
mov dword [section..data], edi
call fcn.01001acd
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, 0x1008258
push ebx
push dword [ebp + 8]
mov dword [0x100825c], eax
mov dword [0x1008258], eax
mov eax, 0x1008248
mov dword [0x100824c], eax
mov dword [0x1008248], eax
call fcn.01001b60
test eax, eax
jge 0x1004f14
or eax, 0xffffffff
jmp 0x100585e
push 0x100158c
push 0x41
push 0x1008920
call fcn.01002eaa
mov ecx, 0x80070057
mov esi, 0x10012c0
mov edi, section..data
cmp eax, ecx
jne 0x1004f56
mov eax, dword [section..data]
cmp eax, edi
je 0x1004f56
test byte [eax + 0x1c], 1
je 0x1004f56
push ecx
push esi
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010019d0
and dword [0x1008900], 0
and dword [0x1008904], 0
push 0x1008900
push 0x1001260
call fcn.01006b45
test eax, eax
jge 0x1004f96
mov ecx, dword [section..data]
cmp ecx, edi
je 0x1004f96
test byte [ecx + 0x1c], 1
je 0x1004f96
push eax
push esi
push 0xb
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010019d0
lea eax, [ebp - 0x414]
push eax
mov ebx, 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1004fb7
cmp eax, ebx
jbe 0x1005009
mov dword [ebp - 0x418], 2
call esi
test eax, eax
jle 0x1004fd1
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jge 0x1005009
mov eax, dword [section..data]
cmp eax, section..data
je 0x1005621
test byte [eax + 0x1c], 1
je 0x1005621
push edi
push 0x10012c0
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010019d0
jmp 0x1005621
push 0x1008470
push 0
push 0x1001584
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x100506a
mov dword [ebp - 0x418], 2
call esi
test eax, eax
jle 0x1005040
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jge 0x100506a
mov eax, dword [section..data]
cmp eax, section..data
je 0x1005621
test byte [eax + 0x1c], 1
je 0x1005621
push edi
push 0x10012c0
push 0xd
jmp 0x1004ff9
push 0x1008470
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10050c0
mov dword [ebp - 0x418], 2
call esi
test eax, eax
jle 0x1005093
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jge 0x10050c0
mov eax, dword [section..data]
cmp eax, section..data
je 0x1005621
test byte [eax + 0x1c], 1
je 0x1005621
push edi
push 0x10012c0
push 0xe
jmp 0x1004ff9
push 0
push 0x1008470
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1005118
mov dword [ebp - 0x418], 2
call esi
test eax, eax
jle 0x10050eb
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jge 0x1005118
mov eax, dword [section..data]
cmp eax, section..data
je 0x1005621
test byte [eax + 0x1c], 1
je 0x1005621
push edi
push 0x10012c0
push 0xf
jmp 0x1004ff9
push dword [0x1008910]
mov byte [0x10086c4], 1
push 0x1008470
push 0x1001560
push ebx
push 0x1008268
call fcn.01002f19
mov edi, eax
add esp, 0x14
mov esi, 0x8007007a
test edi, edi
je 0x1005177
cmp edi, esi
je 0x1005177
test edi, edi
jge 0x1005177
mov eax, dword [section..data]
cmp eax, section..data
je 0x1005621
test byte [eax + 0x1c], 1
je 0x1005621
push edi
push 0x10012c0
push 0x10
jmp 0x1004ff9
push dword [0x1008910]
push 0x1008470
push 0x1001538
push ebx
push 0x1008040
call fcn.01002f19
mov edi, eax
add esp, 0x14
test edi, edi
je 0x10051ca
cmp edi, esi
je 0x10051ca
test edi, edi
jge 0x10051ca
mov eax, dword [section..data]
cmp eax, section..data
je 0x1005621
test byte [eax + 0x1c], 1
je 0x1005621
push edi
push 0x10012c0
push 0x11
jmp 0x1004ff9
mov eax, dword [section..data]
cmp eax, section..data
je 0x10051f8
test byte [eax + 0x1c], 8
je 0x10051f8
push 0x1008040
push 0x1008268
push 0x10012c0
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001896
xor esi, esi
push esi
push 0x80
push 2
push esi
push esi
push 0x10000000
push 0x1008268
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x10086c8], eax
cmp eax, esi
je 0x1005222
cmp eax, 0xffffffff
jne 0x100526f
mov dword [ebp - 0x418], 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
mov esi, 0x80070000
jle 0x1005242
and eax, 0xffff
or eax, esi
mov edi, eax
test edi, edi
jge 0x1005274
mov eax, dword [section..data]
cmp eax, section..data
je 0x1005621
test byte [eax + 0x1c], 1
je 0x1005621
push edi
push 0x10012c0
push 0x13
jmp 0x1004ff9
mov esi, 0x80070000
mov eax, dword [0x1008910]
mov byte [0x10086c5], 1
call fcn.01002aae
mov dword [0x10086d0], eax
test eax, eax
jne 0x10052c4
mov dword [ebp - 0x418], 8
mov edi, 0x80004005
mov eax, dword [section..data]
cmp eax, section..data
je 0x1005621
test byte [eax + 0x1c], 1
je 0x1005621
push edi
push 0x10012c0
push 0x14
jmp 0x1004ff9
push ebx
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.01004267
test eax, eax
jl 0x10052e2
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x428], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x41
push 0x1008920
push dword [0x10086d0]
call edi
push eax
call fcn.010069f1
test eax, eax
jge 0x1005328
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x1005328
test byte [ecx + 0x1c], 1
je 0x1005328
push eax
push 0x10012c0
push 0x15
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010019d0
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x444]
push eax
push 0x10089a4
push dword [0x10086d0]
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
jne 0x1005392
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xffff
test eax, eax
jle 0x1005365
and eax, ebx
or eax, esi
mov ecx, eax
test ecx, ecx
jge 0x1005397
mov eax, dword [section..data]
cmp eax, section..data
je 0x1005397
test byte [eax + 0x1c], 1
je 0x1005397
push ecx
push 0x10012c0
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010019d0
jmp 0x1005397
mov ebx, 0xffff
push dword [0x10086d0]
call fcn.01002c9f
test eax, eax
je 0x10053ad
or dword [0x10086c0], 4
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x42c]
push eax
push dword [0x1008910]
call edi
push eax
call fcn.010060b3
test eax, eax
jge 0x10053f4
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x10053f4
test byte [ecx + 0x1c], 1
je 0x10053f4
push eax
push 0x10012c0
push 0x17
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010019d0
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.01004485
mov edi, eax
test edi, edi
jge 0x1005434
mov eax, dword [section..data]
cmp eax, section..data
je 0x1005621
test byte [eax + 0x1c], 1
je 0x1005621
push edi
push 0x10012c0
push 0x18
jmp 0x1004ff9
push 1
push 0x1001d9c
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
jne 0x1005480
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1005453
and eax, ebx
or eax, esi
mov edi, eax
test edi, edi
jge 0x1005480
mov eax, dword [section..data]
cmp eax, section..data
je 0x1005621
test byte [eax + 0x1c], 1
je 0x1005621
push edi
push 0x10012c0
push 0x19
jmp 0x1004ff9
cmp byte [0x100800c], 0
jne 0x10054d2
push 1
push 1
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
test eax, eax
jne 0x10054d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10054a5
and eax, ebx
or eax, esi
mov edi, eax
test edi, edi
jge 0x10054d2
mov eax, dword [section..data]
cmp eax, section..data
je 0x1005621
test byte [eax + 0x1c], 1
je 0x1005621
push edi
push 0x10012c0
push 0x1a
jmp 0x1004ff9
cmp dword [ebp - 0x41c], 0
je 0x10054e8
push dword [0x10086d0]
call fcn.01003102
jmp 0x10054f3
mov ecx, dword [0x10086d0]
call fcn.01002998
test eax, eax
jge 0x100554c
mov ecx, dword [ebp - 0x41c]
neg ecx
sbb ecx, ecx
and ecx, 0xffc0
add ecx, 0x40
push eax
mov dword [ebp - 0x418], ecx
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jle 0x100551f
and eax, ebx
or eax, esi
mov edi, eax
test edi, edi
jge 0x100554c
mov eax, dword [section..data]
cmp eax, section..data
je 0x1005621
test byte [eax + 0x1c], 1
je 0x1005621
push edi
push 0x10012c0
push 0x1b
jmp 0x1004ff9
push dword [0x10089a8]
mov ebx, 0x1008920
push dword [0x10089a4]
push dword [0x1008910]
push 0x41
push 0x1001270
push dword [0x1008904]
push dword [0x1008900]
call fcn.0100356a
test eax, eax
jge 0x10055a8
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x10055b2
test byte [ecx + 0x1c], 1
je 0x10055b2
push eax
push 0x10012c0
push 0x1c
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010019d0
jmp 0x10055b2
mov dword [ebp - 0x420], 1
cmp byte [0x100891b], 0
jne 0x10057ba
push 0xffffffffffffffff
push dword [0x10086e4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1005607
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10055e2
and eax, 0xffff
or eax, esi
mov edi, eax
test edi, edi
jge 0x1005607
mov eax, dword [section..data]
cmp eax, section..data
je 0x1005621
test byte [eax + 0x1c], 1
je 0x1005621
push edi
push 0x10012c0
push 0x1d
jmp 0x1004ff9
push dword [ebp - 0x41c]
lea ebx, [ebp - 0x418]
mov byte [0x10086c7], 1
call fcn.01004b39
mov edi, eax
call fcn.01002fb4
test edi, edi
jl 0x1005712
cmp byte [0x1008918], 0
je 0x10056b2
push dword [0x100890c]
push dword [0x1008908]
push dword [0x1008694]
push dword [0x1008690]
push dword [0x100869c]
push dword [0x1008698]
push dword [ebp - 0x424]
push dword [ebp - 0x42c]
push dword [0x10088fc]
push 0x1008920
push dword [ebp - 0x428]
push 0x1008268
push 0x1008040
call fcn.010037e7
test eax, eax
jge 0x10056b2
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x10056b2
test byte [ecx + 0x1c], 1
je 0x10056b2
push eax
push 0x10012c0
push 0x1e
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010019d0
push dword [0x10089a8]
mov ebx, 0x1008920
push dword [0x10089a4]
push dword [0x1008910]
push 0x41
push 0x1001280
push dword [0x1008904]
push dword [0x1008900]
call fcn.0100356a
test eax, eax
jge 0x10057ba
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x10057ba
test byte [ecx + 0x1c], 1
je 0x10057ba
push eax
push 0x10012c0
push 0x1f
jmp 0x10057af
cmp dword [ebp - 0x420], 0
push dword [ebp - 0x418]
mov byte [0x1008919], 1
push dword [0x10089a8]
mov edi, 0x1008920
push dword [0x10089a4]
push dword [0x1008910]
push 0x41
jne 0x1005779
push 0x1001290
push dword [0x1008904]
push dword [0x1008900]
call fcn.0100369e
test eax, eax
jge 0x10057ba
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x10057ba
test byte [ecx + 0x1c], 1
je 0x10057ba
push eax
push 0x10012c0
push 0x20
jmp 0x10057af
push 0x10012a0
push dword [0x1008904]
push dword [0x1008900]
call fcn.0100369e
test eax, eax
jge 0x10057ba
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x10057ba
test byte [ecx + 0x1c], 1
je 0x10057ba
push eax
push 0x10012c0
push 0x21
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010019d0
cmp byte [0x1008919], 0
je 0x100581b
cmp byte [0x10086c5], 0
je 0x10057f3
mov eax, dword [0x10086c8]
test eax, eax
je 0x10057e8
cmp eax, 0xffffffff
je 0x10057e8
push eax
call dword [sym.imp.ntdll.dll_NtClose]
and dword [0x10086c8], 0
push 0x1008268
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [0x10086c6], 0
je 0x1005807
push 0x1008040
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [0x10086c4], 0
je 0x100581b
push 0x1008470
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push dword [0x1008904]
push dword [0x1008900]
call fcn.01006b79
test eax, eax
jge 0x1005857
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x1005857
test byte [ecx + 0x1c], 1
je 0x1005857
push eax
push 0x10012c0
push 0x22
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010019d0
call fcn.01001b1b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01005bfd
leave
ret