Function at 0x41eae0
Capabilities:
Check if file exists
Create directory
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46c320
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4914f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x28], edi
cmp dword [0x4937a0], 0
jne 0x41eb5b
call fcn.004154b0
test eax, eax
je 0x41eb5b
push 0
push 0x4748c4
push 0x474838
mov ecx, edi
call fcn.00426d28
call fcn.004154b0
test eax, eax
je 0x41eb5b
push 0
push 0x47480c
push 0x474798
mov ecx, edi
call fcn.00426d28
call fcn.004154b0
test eax, eax
jne 0x41f1de
mov esi, dword [ebp + 8]
push esi
call fcn.0045b990
add esp, 4
test eax, eax
je 0x41ebcd
push esi
lea ecx, [ebp - 0x18]
call fcn.00408390
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], 0
call fcn.00419340
add esp, 4
test eax, eax
je 0x41eb9d
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x4937c0
call fcn.00403a00
push 1
jmp 0x41eba7
push esi
mov ecx, edi
call fcn.0041dd10
push 2
mov ecx, edi
call fcn.0041e200
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x41f1d2
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push 0x474a44
push esi
call ebx
test eax, eax
jne 0x41ed33
push str..rar
push esi
call ebx
test eax, eax
jne 0x41ed33
push str..gif
push esi
call ebx
test eax, eax
jne 0x41ed0e
push str..bmp
push esi
call ebx
test eax, eax
jne 0x41ed0e
push 0x47512c
push esi
call ebx
test eax, eax
jne 0x41ed0e
push 0x475138
push esi
call ebx
test eax, eax
jne 0x41ed0e
push str..gft
push esi
call ebx
test eax, eax
jne 0x41ed0e
push 0x47515c
push esi
call ebx
test eax, eax
jne 0x41ed0e
push str..jpg
push esi
call ebx
test eax, eax
jne 0x41ed0e
push 0x47510c
push esi
call ebx
test eax, eax
je 0x41ec97
push esi
mov ecx, 0x4937c0
call fcn.00405850
push 1
mov ecx, edi
call fcn.0041e200
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x47878c
push esi
call ebx
mov ecx, edi
test eax, eax
je 0x41ece9
push esi
push 0
call fcn.00419fb0
mov ecx, dword [0x4938ac]
push 1
push 0
push 0
push ecx
push str.explore
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [0x4938ac]
push edx
mov ecx, edi
call fcn.0041dd10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0x474780
push 0x478730
call fcn.00426d28
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
mov ecx, edi
call fcn.0041a5a0
push 2
mov ecx, edi
call fcn.0041e200
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
lea ecx, [ebp + 8]
call fcn.00408390
push 0x471d88
push 0x474a44
lea ecx, [ebp + 8]
mov dword [ebp - 4], 1
call fcn.0040ba10
push 0x471d88
push str..rar
lea ecx, [ebp + 8]
call fcn.0040ba10
call fcn.0042fa4e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41ed81
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 2
call fcn.0042fa4e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41edae
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
push 1
push 0x472650
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
push eax
mov byte [ebp - 4], 3
call fcn.0045d8a0
mov ecx, dword [ebp - 0x1c]
push 0
push ecx
call fcn.0045ec40
add esp, 0x1c
test eax, eax
jne 0x41edef
xor ecx, ecx
jmp 0x41ee03
mov ecx, eax
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x41edf4
sub ecx, edi
sar ecx, 1
push ecx
push eax
lea ecx, [ebp + 8]
call fcn.00403400
mov edx, dword [ebp + 8]
push edx
call fcn.004140c0
mov eax, dword [ebp + 8]
add esp, 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x24]
push ecx
push esi
call fcn.0045bdd0
add esp, 8
cmp dword [ebp - 0x24], 0
ja 0x41f0bf
cmp eax, 0x3200000
ja 0x41f0bf
push 0x474a44
push esi
call ebx
test eax, eax
je 0x41ee68
push edi
push esi
call fcn.00416980
add esp, 8
test eax, eax
jne 0x41f0d3
call fcn.0042fa4e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41ee82
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 4], 4
call fcn.004152c0
mov ebx, dword [ebp - 0x10]
add esp, 4
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41ef51
push edi
lea ecx, [ebp - 0x14]
call fcn.00408390
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.00408390
push 0
push 1
push ebx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 6
call fcn.00416020
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
add esp, 0x14
mov byte [ebp - 4], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ef05
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ef28
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f0d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41f0d3
call fcn.0042fa4e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41ef6b
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x18]
push ecx
mov byte [ebp - 4], 7
call fcn.00414ee0
mov ebx, dword [ebp - 0x18]
add esp, 4
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41f03c
push edi
lea ecx, [ebp - 0x20]
call fcn.00408390
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 8
call fcn.00408390
push 0
push 2
push ebx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 9
call fcn.00416020
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
add esp, 0x14
mov byte [ebp - 4], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41efee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
mov byte [ebp - 4], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f011
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add ebx, 0xfffffff0
mov byte [ebp - 4], 4
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f031
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
jmp 0x41ef2b
lea ecx, [ebp - 0x14]
call fcn.00403080
lea ecx, [ebp - 0x14]
push ecx
mov byte [ebp - 4], 0xa
call fcn.004150d0
mov ebx, dword [ebp - 0x14]
add esp, 4
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41f0a1
push edi
lea ecx, [ebp - 0x24]
call fcn.00408390
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xb
call fcn.00408390
push 0
push 3
push ebx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0xc
call fcn.00416020
add esp, 0x14
lea ecx, [ebp - 0x20]
call fcn.00402b30
lea ecx, [ebp - 0x24]
call fcn.00402b30
lea ecx, [ebp - 0x14]
call fcn.00402b30
lea ecx, [ebp - 0x18]
call fcn.00402b30
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00402b30
jmp 0x41f0d3
push 0
push 0x474a7c
push 0x474a50
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push str._res.rdb
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.00413e40
add esp, 0xc
push eax
mov ecx, 0x4937c0
mov byte [ebp - 4], 0xd
call fcn.00403a00
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f11a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x4937c0]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push ecx
call esi
test eax, eax
jne 0x41f148
lea edx, [ebp + 8]
push edx
mov ecx, 0x4937c0
call fcn.00403a00
push 0x4937c0
call fcn.00419340
add esp, 4
mov eax, dword [0x4937c0]
push eax
call esi
test eax, eax
je 0x41f15b
mov ecx, dword [ebp - 0x28]
push 1
jmp 0x41f16d
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 0x28]
push ecx
mov ecx, esi
call fcn.0041dd10
push 2
mov ecx, esi
call fcn.0041e200
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f195
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f1b8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f1de
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4