Function at 0x401000
Capabilities:
Create directory
Create process on windows
Delete directory
Delete file
Get common file path
Read file on windows

Disassembly:
mov eax, 0x8768
call fcn.00408990
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], ebx
push 0xff
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x978]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x364]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x5c]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x468]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x874]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x770]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x66c]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x160]
rep stosd dword es:[edi], eax
mov ecx, 0x3f
lea edi, [esp + 0x264]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x56c]
mov esi, 1
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x8780]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x56c]
push eax
push 3
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [esp + 0x974]
push 0x104
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4010ee
xor esi, esi
lea eax, [esp + 0x58]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x401104
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea ecx, [esp + 0x58]
push ecx
push ebx
lea edx, [esp + 0x60]
push 0x40e060
push edx
call edi
test eax, eax
jne 0x401122
xor esi, esi
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x58]
push 0x40e05c
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, ebx
je 0x401159
lea edx, [esp + 0x58]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov dword [esp + 0x10], 1
jne 0x40115d
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x360]
lea ecx, [esp + 0x58]
push eax
push ebx
push 0x40e060
push ecx
call edi
test eax, eax
jne 0x40117a
mov dword [esp + 0x10], ebx
push ebx
lea edx, [esp + 0x978]
push 0x8000
push edx
call fcn.004086b5
mov edi, eax
push 0x180
lea eax, [esp + 0x370]
push 0x8102
push eax
call fcn.004086b5
add esp, 0x18
cmp edi, 0xffffffff
mov ebp, eax
je 0x4011c4
cmp ebp, 0xffffffff
je 0x4011bb
cmp dword [esp + 0x10], ebx
jne 0x401220
push edi
call fcn.00408602
add esp, 4
cmp ebp, 0xffffffff
je 0x4011d2
push ebp
call fcn.00408602
add esp, 4
lea ecx, [esp + 0x360]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [esp + 0x260]
push 0xff
mov ecx, dword [esp + 0x8780]
push eax
push 4
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [esp + 0x568]
push 0x30
lea eax, [esp + 0x264]
push edx
push eax
push ebx
jmp 0x401684
push 2
push 0xfffffffffffffffc
push edi
call fcn.00408568
add esp, 0xc
cmp eax, 0xffffffff
jne 0x401236
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x18]
push 4
push ecx
push edi
call fcn.00408372
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40124f
mov dword [esp + 0x10], ebx
push edi
call fcn.00408361
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
jne 0x401263
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x18]
mov edx, 0xfffffffc
push ebx
sub edx, eax
push eax
push edi
add esi, edx
call fcn.00408568
add esp, 0xc
cmp eax, 0xffffffff
jne 0x401284
mov dword [esp + 0x10], ebx
cmp esi, 0x7d00
mov eax, esi
jb 0x401293
mov eax, 0x7d00
push eax
lea eax, [esp + 0xa7c]
push eax
push edi
call fcn.00408372
add esp, 0xc
test eax, eax
jbe 0x401300
cmp ebx, esi
jae 0x401300
lea ecx, [esp + 0xa78]
push eax
push ecx
push ebp
call fcn.004081b4
add esp, 0xc
cmp eax, 0xffffffff
je 0x4012ee
add ebx, eax
mov eax, esi
sub eax, ebx
cmp eax, 0x7d00
jb 0x4012d6
mov eax, 0x7d00
lea edx, [esp + 0xa78]
push eax
push edx
push edi
call fcn.00408372
add esp, 0xc
test eax, eax
ja 0x4012a9
jmp 0x401300
mov eax, dword [0x40fce0]
mov dword [esp + 0x10], 0
mov dword [0x40e030], eax
push edi
call fcn.00408602
push ebp
call fcn.00408602
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x40161c
cmp ebx, esi
jb 0x40161c
lea edi, [esp + 0x58]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x360]
mov edx, ecx
mov esi, edi
mov edi, 0xbff2a0
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004018c0
add esp, 4
test eax, eax
je 0x40158f
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x15c]
push 0x40eb74
push ecx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x58]
lea eax, [esp + 0x15c]
push edx
push eax
call ebp
lea ecx, [esp + 0x15c]
push str.MAKEWISH.TXT
push ecx
call ebp
xor ebx, ebx
lea edx, [esp + 0x15c]
push ebx
push 0x4000
push edx
call fcn.004086b5
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x4013bb
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x76c]
push 0x104
push eax
push esi
call fcn.00408372
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4013da
mov dword [esp + 0x10], ebx
push esi
call fcn.00408602
add esp, 4
lea ecx, [esp + 0x15c]
push 0x40eb74
push ecx
call edi
lea edx, [esp + 0x58]
lea eax, [esp + 0x15c]
push edx
push eax
call ebp
lea ecx, [esp + 0x15c]
push str.ADJUST.TXT
push ecx
call ebp
push ebx
lea edx, [esp + 0x160]
push 0x4000
push edx
call fcn.004086b5
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x401431
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x668]
push 0x104
push eax
push esi
call fcn.00408372
add esp, 0xc
cmp eax, 0xffffffff
jne 0x401450
mov dword [esp + 0x10], ebx
push esi
call fcn.00408602
mov eax, dword [esp + 0x14]
add esp, 4
cmp eax, ebx
je 0x40158f
lea ecx, [esp + 0x870]
lea edx, [esp + 0x58]
push ecx
lea eax, [esp + 0x770]
push edx
push eax
call dword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x20
jbe 0x40158f
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x668]
push ecx
call ebx
test eax, eax
jle 0x4014af
lea edx, [esp + 0x668]
lea eax, [esp + 0x464]
push edx
push eax
call edi
mov esi, dword [esp + 0x8784]
push esi
call ebx
test eax, eax
jle 0x4014f2
lea ecx, [esp + 0x464]
push ecx
call ebx
test eax, eax
jle 0x4014e7
lea edx, [esp + 0x464]
push 0x40e03c
push edx
call ebp
lea eax, [esp + 0x464]
push esi
push eax
call ebp
jmp 0x4014f2
lea ecx, [esp + 0x464]
push esi
push ecx
call edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 0x870]
rep stosd dword es:[edi], eax
mov dword [esp + 0x2c], edx
lea edx, [esp + 0x1c]
lea eax, [esp + 0x464]
lea ecx, [esp + 0x58]
push edx
mov dword [esp + 0x20], 0x3c
mov dword [esp + 0x24], 0x440
mov dword [esp + 0x2c], str.open
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x401574
mov eax, dword [esp + 0x54]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x40157c
mov edx, dword [esp + 0x54]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x40157c
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4015cf
cmp dword [0x40e030], 0x1c
jne 0x4015cf
mov edx, dword [esp + 0x877c]
lea ecx, [esp + 0x260]
push 0xff
push ecx
push 5
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x568]
push 0x30
lea ecx, [esp + 0x264]
push eax
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x360]
push edx
call ebx
mov eax, dword [0x40eb70]
xor esi, esi
test eax, eax
jl 0x401602
mov edi, 0x40fea0
push edi
call ebx
mov eax, dword [0x40eb70]
inc esi
add edi, 0x104
cmp esi, eax
jle 0x4015ef
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x8768
ret 0x10
lea ecx, [esp + 0x360]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov eax, dword [0x40e030]
push 0xff
cmp eax, 0x1c
jne 0x401658
mov ecx, dword [esp + 0x8780]
lea eax, [esp + 0x264]
push eax
push 5
push ecx
jmp 0x40166a
mov eax, dword [esp + 0x8780]
lea edx, [esp + 0x264]
push edx
push 2
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x568]
push 0x30
lea edx, [esp + 0x264]
push ecx
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x8768
ret 0x10