Function at 0x40a780
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462569
mov eax, dword fs:[0]
push eax
sub esp, 0x398
mov eax, dword [0x4785d0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp byte [str.ag_v1.6.2870], cl
mov dword [ebp - 0x388], eax
mov eax, 0xc
cmove eax, ecx
push eax
push str.ag_v1.6.2870
lea ecx, [esi + 8]
call fcn.00407c90
push 8
push str.1.6.2870
lea ecx, [esi + 0x20]
call fcn.00407c90
lea ecx, [ebp - 0x3a0]
call fcn.00409c70
mov edx, eax
lea ecx, [ebp - 0x380]
mov dword [ebp - 4], 0
call fcn.00401f70
mov ebx, eax
lea edi, [esi + 0x68]
cmp edi, ebx
je 0x40a837
cmp dword [edi + 0x14], 0x10
jb 0x40a81e
push dword [edi]
call fcn.0041a4c1
add esp, 4
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
push ebx
mov ecx, edi
mov byte [edi], 0
call fcn.00406f50
cmp dword [ebp - 0x36c], 0x10
jb 0x40a84e
push dword [ebp - 0x380]
call fcn.0041a4c1
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x38c], 0x10
mov dword [ebp - 0x36c], 0xf
mov dword [ebp - 0x370], 0
mov byte [ebp - 0x380], 0
jb 0x40a887
push dword [ebp - 0x3a0]
call fcn.0041a4c1
add esp, 4
push 0x15
push str.cwAQw0kycsnjT4ohuMBB
lea ecx, [esi + 0x38]
call fcn.00407c90
xor ecx, ecx
cmp byte [str.1040], cl
mov eax, 0xf
cmove eax, ecx
push eax
push str.1040
lea ecx, [esi + 0x50]
call fcn.00407c90
push 0x103
lea eax, [ebp - 0x11b]
push 0
push eax
mov dword [ebp - 0x350], 0
mov byte [ebp - 0x11c], 0
call fcn.00420820
mov byte [ebp - 0x32d], 0
mov dword [ebp - 0x354], 0xf
mov dword [ebp - 0x358], 0
mov byte [ebp - 0x368], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x350]
mov dword [ebp - 0x378], eax
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x374], eax
movq xmm0, qword [ebp - 0x378]
lea eax, [ebp - 0x32d]
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x368]
push ecx
mov dword [ebp - 0x36c], eax
mov eax, esp
lea ecx, [ebp - 0x370]
movq qword [eax], xmm0
movq xmm0, qword [ebp - 0x370]
movq qword [eax + 8], xmm0
call fcn.0040cae0
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00409fe0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x36c], 0
je 0x40a975
call fcn.0041b0d5
cmp dword [ebp - 0x358], 0
je 0x40a9af
cmp dword [esi + 0xc0], 0
je 0x40a999
push 1
push 0x46cdb8
lea ecx, [esi + 0xb0]
call fcn.00409300
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x368]
push eax
lea ecx, [esi + 0xb0]
call fcn.00407b90
cmp byte [ebp - 0x11c], 0
jne 0x40a9bc
xor ecx, ecx
jmp 0x40a9ce
lea ecx, [ebp - 0x11c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a9c5
sub ecx, edx
push ecx
lea eax, [ebp - 0x11c]
push eax
lea ecx, [esi + 0x1c0]
call fcn.00407c90
mov al, byte [ebp - 0x32d]
mov byte [esi + 5], al
test al, al
jne 0x40aac2
lea ecx, [ebp - 0x11c]
lea edx, [ecx + 1]
jmp 0x40aa00
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40aa00
sub ecx, edx
cmp ecx, 5
jb 0x40aa2f
push 5
lea eax, [ebp - 0x11c]
push str.cbsid
push eax
call fcn.0041a91f
add esp, 0xc
test eax, eax
jne 0x40aa2f
mov eax, 1
jmp 0x40aa31
xor eax, eax
mov byte [esi + 5], al
test al, al
je 0x40aac2
push 9
push str.PRNNAMEOK
lea ecx, [ebp - 0x380]
mov dword [ebp - 0x36c], 0xf
mov dword [ebp - 0x370], 0
mov byte [ebp - 0x380], 0
call fcn.00407c90
mov byte [ebp - 4], 3
cmp dword [ebp - 0x370], 0
je 0x40aaa7
cmp dword [esi + 0xc0], 0
je 0x40aa91
push 1
push 0x46cdb8
lea ecx, [esi + 0xb0]
call fcn.00409300
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x380]
push eax
lea ecx, [esi + 0xb0]
call fcn.00407b90
mov byte [ebp - 4], 1
cmp dword [ebp - 0x36c], 0x10
jb 0x40aac2
push dword [ebp - 0x380]
call fcn.0041a4c1
add esp, 4
lea eax, [ebp - 0x32c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x224]
push eax
push 0
push 0x46d0b4
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp byte [ebp - 0x224], 0
jne 0x40ab09
xor ecx, ecx
jmp 0x40ab1b
lea ecx, [ebp - 0x224]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ab12
sub ecx, edx
push ecx
lea eax, [ebp - 0x224]
lea edi, [esi + 0xcc]
push eax
mov ecx, edi
call fcn.00407c90
cmp dword [edi + 0x14], 0x10
jb 0x40ab3a
mov eax, dword [edi]
jmp 0x40ab3c
mov eax, edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [esi + 0xdc]
test eax, eax
je 0x40abed
inc eax
push eax
call fcn.0041aa39
add esp, 4
cmp dword [edi + 0x14], 0x10
mov ebx, eax
jb 0x40ab67
mov edi, dword [edi]
mov eax, dword [esi + 0xdc]
push edi
inc eax
push eax
push ebx
call fcn.0041b048
add esp, 0xc
mov byte [ebp - 0x334], 0
push dword [ebp - 0x334]
lea ecx, [ebp - 0x370]
push ebx
mov dword [ebp - 0x370], 0
mov dword [ebp - 0x36c], 0
call fcn.0040cb90
mov edi, dword [esi + 0xe8]
mov eax, dword [ebp - 0x36c]
mov dword [esi + 0xe8], eax
mov eax, dword [ebp - 0x370]
mov dword [esi + 0xe4], eax
test edi, edi
je 0x40abed
or ebx, 0xffffffff
lea ecx, [edi + 4]
mov eax, ebx
lock xadd dword [ecx], eax
jne 0x40abed
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lea eax, [edi + 8]
lock xadd dword [eax], ebx
dec ebx
jne 0x40abed
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov ebx, dword [ebp - 0x388]
mov dword [ebp - 0x338], 0xf
cmp byte [ebx], 0
mov dword [ebp - 0x33c], 0
mov byte [ebp - 0x34c], 0
jne 0x40ac17
xor ecx, ecx
jmp 0x40ac29
mov ecx, ebx
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ac20
sub ecx, edx
push ecx
push ebx
lea ecx, [ebp - 0x34c]
call fcn.00407c90
mov byte [ebp - 4], 4
push 0xa
push str._doinstall
lea ecx, [ebp - 0x380]
mov dword [ebp - 0x36c], 0xf
mov dword [ebp - 0x370], 0
mov byte [ebp - 0x380], 0
call fcn.00407c90
mov byte [ebp - 4], 5
push dword [ebp - 0x370]
cmp dword [ebp - 0x36c], 0x10
lea eax, [ebp - 0x380]
cmovae eax, dword [ebp - 0x380]
push 0
push eax
lea ecx, [ebp - 0x34c]
call fcn.0040c870
cmp eax, 0xffffffff
jne 0x40ac9c
xor al, al
jmp 0x40acb0
push dword [ebp - 0x370]
lea ecx, [ebp - 0x34c]
push eax
call fcn.00407190
mov al, 1
test al, al
sete bl
mov byte [ebp - 4], 4
cmp dword [ebp - 0x36c], 0x10
jb 0x40acd0
push dword [ebp - 0x380]
call fcn.0041a4c1
add esp, 4
test bl, bl
je 0x40aced
push 0x12
push str.ST_INVALID_COMMAND
lea ecx, [esi + 0x98]
call fcn.00407c90
xor bl, bl
jmp 0x40b1ba
push 0xb
push str._dooptimize
lea ecx, [ebp - 0x380]
mov dword [ebp - 0x36c], 0xf
mov dword [ebp - 0x370], 0
mov byte [ebp - 0x380], 0
call fcn.00407c90
mov byte [ebp - 4], 6
push dword [ebp - 0x370]
cmp dword [ebp - 0x36c], 0x10
lea eax, [ebp - 0x380]
cmovae eax, dword [ebp - 0x380]
push 0
push eax
lea ecx, [ebp - 0x34c]
call fcn.0040c870
cmp eax, 0xffffffff
jne 0x40ad4f
xor al, al
jmp 0x40ad63
push dword [ebp - 0x370]
lea ecx, [ebp - 0x34c]
push eax
call fcn.00407190
mov al, 1
mov byte [ebp - 4], 4
cmp dword [ebp - 0x36c], 0x10
mov byte [esi + 0xec], al
jb 0x40ad84
push dword [ebp - 0x380]
call fcn.0041a4c1
add esp, 4
push 3
push 0x46d0e4
lea ecx, [ebp - 0x380]
mov dword [ebp - 0x36c], 0xf
mov dword [ebp - 0x370], 0
mov byte [ebp - 0x380], 0
call fcn.00407c90
mov byte [ebp - 4], 7
push dword [ebp - 0x370]
cmp dword [ebp - 0x36c], 0x10
lea eax, [ebp - 0x380]
cmovae eax, dword [ebp - 0x380]
push 0
push eax
lea ecx, [ebp - 0x34c]
call fcn.0040c870
cmp eax, 0xffffffff
jne 0x40adeb
mov byte [ebp - 0x381], 0
jmp 0x40ae04
push dword [ebp - 0x370]
lea ecx, [ebp - 0x34c]
push eax
call fcn.00407190
mov byte [ebp - 0x381], 1
mov byte [ebp - 4], 4
cmp dword [ebp - 0x36c], 0x10
jb 0x40ae1f
push dword [ebp - 0x380]
call fcn.0041a4c1
add esp, 4
push 3
push 0x46d0e8
lea ecx, [ebp - 0x380]
mov dword [ebp - 0x36c], 0xf
mov dword [ebp - 0x370], 0
mov byte [ebp - 0x380], 0
call fcn.00407c90
mov byte [ebp - 4], 8
push dword [ebp - 0x370]
cmp dword [ebp - 0x36c], 0x10
lea eax, [ebp - 0x380]
cmovae eax, dword [ebp - 0x380]
push 0
push eax
lea ecx, [ebp - 0x34c]
call fcn.0040c870
cmp eax, 0xffffffff
jne 0x40ae81
xor bh, bh
jmp 0x40ae95
push dword [ebp - 0x370]
lea ecx, [ebp - 0x34c]
push eax
call fcn.00407190
mov bh, 1
mov byte [ebp - 4], 4
cmp dword [ebp - 0x36c], 0x10
jb 0x40aeb0
push dword [ebp - 0x380]
call fcn.0041a4c1
add esp, 4
push 3
push 0x46d0ec
lea ecx, [ebp - 0x380]
mov dword [ebp - 0x36c], 0xf
mov dword [ebp - 0x370], 0
mov byte [ebp - 0x380], 0
call fcn.00407c90
mov byte [ebp - 4], 9
push dword [ebp - 0x370]
cmp dword [ebp - 0x36c], 0x10
lea eax, [ebp - 0x380]
cmovae eax, dword [ebp - 0x380]
push 0
push eax
lea ecx, [ebp - 0x34c]
call fcn.0040c870
cmp eax, 0xffffffff
jne 0x40af12
xor bl, bl
jmp 0x40af26
push dword [ebp - 0x370]
lea ecx, [ebp - 0x34c]
push eax
call fcn.00407190
mov bl, 1
mov byte [ebp - 4], 4
cmp dword [ebp - 0x36c], 0x10
jb 0x40af41
push dword [ebp - 0x380]
call fcn.0041a4c1
add esp, 4
mov al, byte [ebp - 0x381]
test al, al
jne 0x40af9b
test bh, bh
jne 0x40af53
test bl, bl
je 0x40afa3
push 2
push 0x46cd0c
lea ecx, [esi + 0x98]
mov byte [esi + 0xed], al
mov byte [esi + 0xee], bh
mov byte [esi + 0xef], bl
mov byte [esi + 0xf0], 0
call fcn.00407c90
cmp byte [esi + 0xed], 0
mov edx, 0x46d0f0
mov eax, 0x46c99f
cmove edx, eax
cmp byte [edx], 0
jne 0x40afb2
xor ecx, ecx
jmp 0x40afc0
test bh, bh
je 0x40af53
test bl, bl
je 0x40af53
mov dword [esi + 0xed], 0x1010101
jmp 0x40b03e
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40afb7
sub ecx, ebx
push ecx
push edx
lea ecx, [esi + 0x98]
call fcn.00409300
cmp byte [esi + 0xee], 0
mov edx, 0x46d0f4
mov eax, 0x46c99f
cmove edx, eax
cmp byte [edx], 0
jne 0x40afea
xor ecx, ecx
jmp 0x40aff9
mov ecx, edx
lea ebx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40aff0
sub ecx, ebx
push ecx
push edx
lea ecx, [esi + 0x98]
call fcn.00409300
cmp byte [esi + 0xef], 0
mov edx, 0x46d0f8
mov eax, 0x46c99f
cmove edx, eax
cmp byte [edx], 0
jne 0x40b023
xor ecx, ecx
jmp 0x40b031
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40b028
sub ecx, ebx
push ecx
push edx
lea ecx, [esi + 0x98]
call fcn.00409300
xor edi, edi
cmp dword [ebp - 0x33c], edi
jbe 0x40b07a
jmp 0x40b050
cmp dword [ebp - 0x338], 0x10
lea eax, [ebp - 0x34c]
cmovae eax, dword [ebp - 0x34c]
movsx eax, byte [eax + edi]
push eax
call fcn.0041ac5b
inc edi
add esp, 4
cmp edi, dword [ebp - 0x33c]
jb 0x40b050
call fcn.0040be70
cmp eax, 4
mov dword [esi + 0xc8], eax
setne al
mov byte [esi + 6], al
test al, al
jne 0x40b0ab
push 0xd
push str.ST_INVALID_OS
lea ecx, [esi + 0x98]
call fcn.00407c90
xor bl, bl
jmp 0x40b1ba
mov ecx, esi
call fcn.0040bfa0
test al, al
jne 0x40b0bd
xor bl, bl
jmp 0x40b1ba
lea ecx, [ebp - 0x3a0]
call fcn.0040b410
mov ebx, eax
lea edi, [esi + 0x1f0]
cmp edi, ebx
je 0x40b0fd
cmp dword [edi + 0x14], 0x10
jb 0x40b0e4
push dword [edi]
call fcn.0041a4c1
add esp, 4
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
push ebx
mov ecx, edi
mov byte [edi], 0
call fcn.00406f50
cmp dword [ebp - 0x38c], 0x10
jb 0x40b114
push dword [ebp - 0x3a0]
call fcn.0041a4c1
add esp, 4
lea eax, [esi + 0x10c]
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0x334], 0
jb 0x40b130
mov eax, dword [eax]
lea ecx, [ebp - 0x334]
push ecx
push 0xf003f
push 0
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [ebp - 0x334]
lea ecx, [ebp - 0x3a0]
call fcn.0040bd00
mov edi, eax
add esi, 0x208
cmp esi, edi
je 0x40b190
cmp dword [esi + 0x14], 0x10
jb 0x40b177
push dword [esi]
call fcn.0041a4c1
add esp, 4
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push edi
mov ecx, esi
mov byte [esi], 0
call fcn.00406f50
cmp dword [ebp - 0x38c], 0x10
jb 0x40b1a7
push dword [ebp - 0x3a0]
call fcn.0041a4c1
add esp, 4
mov eax, dword [ebp - 0x334]
test eax, eax
je 0x40b1b8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
cmp dword [ebp - 0x338], 0x10
jb 0x40b1d1
push dword [ebp - 0x34c]
call fcn.0041a4c1
add esp, 4
cmp dword [ebp - 0x354], 0x10
mov dword [ebp - 0x338], 0xf
mov dword [ebp - 0x33c], 0
mov byte [ebp - 0x34c], 0
jb 0x40b203
push dword [ebp - 0x368]
call fcn.0041a4c1
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00419056
mov esp, ebp
pop ebp
ret 4