Function at 0x41e1d0
Capabilities:
Create directory
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc5c
mov eax, dword [0x46414c]
xor eax, esp
mov dword [esp + 0xc58], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x20], eax
cmp ebx, edi
jne 0x41e217
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc58]
xor ecx, esp
call fcn.0042404d
mov esp, ebp
pop ebp
ret
cmp dword [ebx], 1
je 0x41e228
mov dword [0x47019c], 0x80000
jmp 0x41e235
mov esi, dword [ebx + 4]
call fcn.00421f80
mov dword [0x47019c], eax
xor eax, eax
xor ecx, ecx
cmp dword [ebx], 1
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], cx
mov dword [esp + 0x254], edi
je 0x41e25a
mov dword [0x47019c], 0x80000
jmp 0x41e2d8
mov esi, dword [ebx + 4]
mov ecx, dword [esi]
or edx, 0xffffffff
cmp dword [ecx + 4], edx
jg 0x41e26e
mov ecx, 0x10000
jmp 0x41e2d2
cmp dword [esi + 4], edx
je 0x41e27c
mov edi, ecx
call fcn.00421d70
xor edi, edi
mov edx, dword [esi]
mov dword [esi + 4], 0xffffffff
mov eax, dword [edx + 4]
xor ecx, ecx
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], cx
mov dword [esp + 0x234], edi
mov dword [esp + 0x238], edi
mov dword [esp + 0x23c], edi
mov dword [esp + 0x240], edi
mov dword [esp + 0x244], edi
mov dword [esp + 0x248], edi
mov dword [esp + 0x24c], edi
mov dword [esp + 0x250], edi
mov dword [esp + 0x254], edi
mov dword [0x47019c], ecx
mov esi, eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
test eax, eax
jle 0x41e32e
xor eax, eax
xor edx, edx
cmp dword [ebx], 1
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], dx
mov dword [esp + 0x254], eax
je 0x41e30b
mov dword [0x47019c], 0x80000
jmp 0x41e31e
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x28]
push eax
push edi
call fcn.00421ff0
mov dword [0x47019c], eax
mov ecx, dword [esp + 0x254]
add dword [esp + 0x14], ecx
inc edi
cmp edi, esi
jl 0x41e2e6
xor eax, eax
mov dword [esp + 0x10], eax
test esi, esi
jle 0x41e5c9
xor ecx, ecx
xor edx, edx
cmp dword [ebx], 1
mov dword [esp + 0x28], ecx
mov word [esp + 0x2c], dx
mov dword [esp + 0x254], ecx
je 0x41e361
mov dword [0x47019c], 0x80000
jmp 0x41e374
mov ecx, dword [ebx + 4]
lea edx, [esp + 0x28]
push edx
push eax
call fcn.00421ff0
mov dword [0x47019c], eax
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x2c]
push eax
push ecx
lea edx, [esp + 0x468]
push str._s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
add esp, 0x10
push str.usp10.
lea eax, [esp + 0x30]
push eax
call esi
test eax, eax
jne 0x41e5b6
push str.lpk.
lea ecx, [esp + 0x30]
push ecx
call esi
test eax, eax
jne 0x41e5b6
lea eax, [esp + 0x460]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41e3d0
sub eax, edx
sar eax, 1
mov ebx, eax
test ebx, ebx
jle 0x41e489
movzx eax, word [esp + ebx*2 + 0x45e]
cmp ax, 0x2f
je 0x41e401
cmp ax, 0x5c
jne 0x41e489
lea edx, [esp + 0x460]
push edx
lea eax, [esp + 0x25c]
push 0x104
push eax
call fcn.00425cd8
add esp, 0xc
xor edi, edi
test ebx, ebx
jle 0x41e5b2
cmp edi, ebx
jge 0x41e5b2
movzx eax, word [esp + edi*2 + 0x258]
cmp ax, 0x5c
je 0x41e44e
cmp ax, 0x2f
je 0x41e44e
inc edi
cmp edi, ebx
jl 0x41e430
jmp 0x41e5b2
cmp edi, ebx
jge 0x41e5b2
movzx esi, word [esp + edi*2 + 0x258]
xor ecx, ecx
push ecx
lea edx, [esp + 0x25c]
push edx
mov word [esp + edi*2 + 0x260], cx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov word [esp + edi*2 + 0x258], si
inc edi
cmp edi, ebx
jl 0x41e430
jmp 0x41e5b2
lea eax, [esp + 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea ecx, [esp + 0x478]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41e5b2
mov ebx, dword [esp + 0x14]
push ebx
call fcn.00424725
lea edx, [ebx + 1]
add esp, 4
mov edi, eax
mov dword [esp + 0x1c], 0
cmp dword [esp + 0x254], edx
jae 0x41e524
mov eax, dword [esp + 0xc]
cmp dword [eax], 1
je 0x41e4f7
mov dword [0x47019c], 0x80000
jmp 0x41e50d
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x10]
push ebx
push edi
push ecx
mov ebx, eax
call fcn.00422570
mov dword [0x47019c], eax
mov eax, dword [esp + 0x254]
push 0
lea edx, [esp + 0x28]
push edx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x2c]
lea edx, [eax + 2]
jmp 0x41e530
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41e530
sub eax, edx
sar eax, 1
cmp dword [ebp + 0xc], 0
mov dword [esp + 0x1c], eax
je 0x41e5a2
lea ecx, [esp + eax*2 + 0x24]
push str..exe
push ecx
call fcn.004248c8
add esp, 8
test eax, eax
jne 0x41e5a2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x64
div ecx
mov al, dl
add al, byte [esp + 0x10]
lea edx, [ecx - 0x44]
mov cl, al
test al, al
jne 0x41e57f
mov cl, 0x31
sub edx, 1
jne 0x41e577
push 2
push edx
push edx
push esi
mov byte [edi], cl
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [esp + 0x20]
push edx
push 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call fcn.00424042
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
jl 0x41e33c
cmp dword [ebx], 1
je 0x41e5dd
mov dword [0x47019c], 0x80000
jmp 0x41e691
mov esi, dword [ebx + 4]
cmp dword [esi + 4], 0xffffffff
je 0x41e5ed
mov edi, dword [esi]
call fcn.00421d70
mov edi, dword [esi]
mov dword [esi + 4], 0xffffffff
test edi, edi
je 0x41e635
cmp dword [edi + 0x7c], 0
je 0x41e605
call fcn.00421d70
mov eax, dword [edi]
mov dword [esp + 0x18], eax
test eax, eax
je 0x41e62c
cmp byte [eax + 0x10], 0
je 0x41e623
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
push eax
call fcn.00424042
add esp, 4
push edi
call fcn.00424dcf
add esp, 4
mov dword [esi], 0
mov eax, dword [esi + 0x23c]
mov dword [0x47019c], 0
test eax, eax
je 0x41e658
push eax
call fcn.00424042
add esp, 4
mov eax, dword [esi + 0x240]
mov dword [esi + 0x23c], 0
test eax, eax
je 0x41e675
push eax
call fcn.00424042
add esp, 4
push esi
mov dword [esi + 0x240], 0
call fcn.00424042
add esp, 4
push ebx
call fcn.00424042
add esp, 4
mov ecx, dword [esp + 0xc64]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0042404d
mov esp, ebp
pop ebp
ret