Function at 0x402e94
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
push eax
add esp, 0xffffffec
mov ebx, edx
mov esi, eax
lea edi, [esp + 0x414]
mov ebp, 0x40f567
push 0x400
lea eax, [esp + 0x18]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
lea edx, [ebp + 0x13b]
push edx
lea eax, [esp + 0x18]
call fcn.00403e8c
push eax
call fcn.004066d0
add esp, 8
lea edx, [esp + 4]
push edx
call sub.SHELL32.DLL_SHGetMalloc
mov eax, edi
call fcn.00403b00
mov eax, edi
call fcn.00403f70
lea edx, [ebp + 0x527]
push edx
push edi
call fcn.004065f4
add esp, 8
cmp byte [esi + 0x14], 0
je 0x402f27
push 0
push 0
mov eax, 0x13f9
call fcn.004046f0
mov ecx, eax
mov edx, edi
lea eax, [esp + 0x1c]
call fcn.00403a28
jmp 0x402f2d
push edi
call sub.KERNEL32.DLL_DeleteFileA
push esp
push 0xb
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push edi
push dword [esp + 4]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp]
mov edx, dword [esp + 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
mov eax, edi
call fcn.00403f70
lea edx, [ebp + 0x527]
push edx
push edi
call fcn.004065f4
add esp, 8
cmp byte [esi + 0x15], 0
je 0x402f88
push 0
push 0
mov eax, 0x13f9
call fcn.004046f0
mov ecx, eax
mov edx, edi
lea eax, [esp + 0x1c]
call fcn.00403a28
jmp 0x402f8e
push edi
call sub.KERNEL32.DLL_DeleteFileA
mov edx, dword [str.WinRAR]
mov eax, 0x13ee
mov dword [esp + 8], edx
mov edx, dword [0x40f4d0]
mov dword [esp + 0xc], edx
mov edx, dword [0x40f4d4]
mov dword [esp + 0x10], edx
call fcn.004046f0
mov dword [esp + 0xc], eax
mov eax, 0x13ef
call fcn.004046f0
mov dword [esp + 0x10], eax
push esp
push 2
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push edi
push dword [esp + 4]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp]
mov edx, dword [esp + 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
mov eax, edi
call fcn.00403f70
lea edx, [ebp + 0x1c2]
push edx
push edi
call fcn.004065f4
add esp, 8
cmp byte [esi + 0x16], 0
je 0x4030bf
test ebx, ebx
je 0x403018
push edi
push ebx
call fcn.004066d0
add esp, 8
push 0
push edi
call sub.KERNEL32.DLL_CreateDirectoryA
xor ebx, ebx
mov eax, dword [ebx*4 + 0x40f4c0]
cmp byte [eax], 0
je 0x4030b3
push edi
lea edx, [esp + 0x818]
push edx
call fcn.004066d0
add esp, 8
lea eax, [esp + 0x814]
call fcn.00403f70
push dword [esp + ebx*4 + 8]
lea edx, [esp + 0x818]
push edx
call fcn.004065f4
add esp, 8
lea ecx, [ebp + 0x52d]
push ecx
lea eax, [esp + 0x818]
push eax
call fcn.004065f4
add esp, 8
push dword [ebx*4 + 0x40f4c0]
lea eax, [esp + 0x18]
call fcn.00403e8c
push eax
call fcn.004066d0
add esp, 8
push 0
push 0
mov eax, 0x13f9
call fcn.004046f0
mov ecx, eax
lea edx, [esp + 0x81c]
lea eax, [esp + 0x1c]
call fcn.00403a28
inc ebx
cmp ebx, 3
jl 0x403022
jmp 0x4030c6
mov eax, edi
call fcn.00403b38
call fcn.0040490c
test eax, eax
je 0x4031cb
push esp
push 0x17
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
test eax, eax
jne 0x4031cb
push edi
push dword [esp + 4]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp]
mov edx, dword [esp + 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
mov eax, edi
call fcn.00403f70
lea edx, [ebp + 0x1c2]
push edx
push edi
call fcn.004065f4
add esp, 8
cmp byte [esi + 0x16], 0
je 0x4031c4
push 0
push edi
call sub.KERNEL32.DLL_CreateDirectoryA
xor ebx, ebx
mov eax, dword [ebx*4 + 0x40f4c0]
cmp byte [eax], 0
je 0x4031b8
push edi
lea edx, [esp + 0xc18]
push edx
call fcn.004066d0
add esp, 8
lea eax, [esp + 0xc14]
call fcn.00403f70
push dword [esp + ebx*4 + 8]
lea edx, [esp + 0xc18]
push edx
call fcn.004065f4
add esp, 8
lea ecx, [ebp + 0x52d]
push ecx
lea eax, [esp + 0xc18]
push eax
call fcn.004065f4
add esp, 8
push dword [ebx*4 + 0x40f4c0]
lea eax, [esp + 0x18]
call fcn.00403e8c
push eax
call fcn.004066d0
add esp, 8
push 0
push 0
mov eax, 0x13f9
call fcn.004046f0
mov ecx, eax
lea edx, [esp + 0xc1c]
lea eax, [esp + 0x1c]
call fcn.00403a28
inc ebx
cmp ebx, 3
jl 0x403127
jmp 0x4031cb
mov eax, edi
call fcn.00403b38
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 8]
add esp, 0x1014
pop ebp
pop edi
pop esi
pop ebx
ret