Function at 0x41444c
Capabilities:
Create directory
Delete file
Get common file path
Read .ini file

Disassembly:
sub esp, 0xa10
mov eax, dword [0x43b004]
xor eax, esp
mov dword [esp + 0xa0c], eax
push dword [0x444940]
call fcn.0041ff39
push 2
push 0x32
call fcn.0041ff54
add esp, 0xc
mov dword [0x444940], eax
push 0x444388
push 0x32
push eax
push 0x4355cc
push 0x4375a4
push 0x4375a8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x414609
push esi
push dword [0x444940]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
cmp eax, 0x14
jl 0x414608
push ebx
push ebp
push edi
push dword [0x444940]
call esi
mov ecx, 0x16d
lea edi, [esp + 0x21c]
mov esi, str.SRGM5890GWVJ7OV8WM547TVYOMW7NT67GM67GJ67G679ZG967WG96WXO4KCRTOS754YTLWV7KY57TWJ578GTKWOV5YOTWJ754YHT9O78WM4JT5PO7WCVYJT47IT5FLS8YTLI47YTFSL84TYMSP84A849NVAP89N4PT89Q47NP8TYN47YTC7MSPRT7YSVP7RTYPSV4YMV5S74YTMPS45TBV85YSK897SY589TSYMVRS9JEF7S89J5YF89T5K8T7FSP895JT89VS89T54MKJS89CVJTSYR89T6F89KFS75489T7FJS8957JT6M8VYT89S6RYFS7HT8J69ET6FH85S67J8GS957NGSY6489FS6JDVHMDO87MV578OEYKF785YJ9W07RJTHMELGDU5L8JYT49678S6T5ASZXQZXQ2AZ32A221VU1J3V4AYUK4AU4KAFB1KAB1FULA35IJ1FAL5NTG1FLTJ2F738FYV8K27J045YJ074YK7Y0W7KY4078WJY78456YH8N5MNYNCXYCV7NJ54Y8IE57HTIJC6R4U857HRC476HR57CFSERT7UCF4H6T5V457F786C4FR856RG568ERG35W4H5CSR36R5478J66HV5RGC6R47ER6ERG5GD475FEF354EC3W42WX56C3W6G4RC4S7XHT8H46RTWV85643HR854WHRV78HW34RCF8WF4HR856WCF8H4R5FCW854RF7W
mov ebx, eax
rep movsd dword es:[edi], dword [esi]
push 0x24a
lea eax, [esp + 0x7d6]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.004162b0
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
add esp, 0xc
mov ebp, 0x444990
push 0x4375ac
push ebp
call esi
push str.pred.dll
mov edi, 0x444948
push edi
call esi
mov eax, dword [0x43b8c0]
cmp eax, 0x64
je 0x41453a
cmp eax, 0x12c
jne 0x414559
push str.rmed
push ebp
call esi
push str._rmed.dll
push edi
call esi
push str.UMVWE4785YMOB7B5W654WTVUMY5UWVYN547T805Y7VW0B754Y7WC4N7WYR4M7SYTM47T0SY7T40SY7V0TSYM47TYVNWB47YNV7TYS7TYVSB74TNRC7ST47DF7SHJ74YT7FTW647TFJ67WJTC6TSI3476RH56DRG54EC6F34FWEGSF45GWR3FCH6T5RCHW856CRW86H5R48367WR3HX58WR6GDRTUW364D6784WRT34SH64WTD67HT867W5SHR48DWR6SD436W786T637W5F678D485C744C4544464BC444448B546C5N7783NC5N346563TNZ564TBX8678T234763C6V4CM5W30895M89W34MSLUICGSKRGFMV85YW078934YJ57D8WY3478965TGFNWG4567HT8J6S7HETDG678B57CHNJT546784785V67W55RFR5DCV564D653F4R7G67RTH56FT675TBVH476RT8W67R3465WF4U65W3U64X5FRUW654EC6UWEUX35WRV45CVW4756RWC36GV456TFC54W6VW406054WB60W406VB05W4BC0WV0TC5WV04T5Y7CFN57TW67E4T467U5RHG564DV754DHR56R65RF567RG756R7H5T4H6DC37WEC56F4R7HF47C6435W6FRG67W34G5F6745T3HD6F7354RHF675
jmp 0x41454f
push str.hmed
push ebp
call esi
push str.hmed.dll
push edi
call esi
push str.MV5UH0687E54WBSVM84P89OSYHM7G967TBF475H8C64HJ3496VYTME5T64NGC67WBRTF87C5F4W54HR6WT34HDS6ETS6ETRFH6S8T3467CW68HTR8C67HRFS7364GTD4X6FDW4B56RCF8W5RB68WFV6WBFRTV6478WGCF648HWG3F6CFW3648HRXFW76F4H786WT3486S7H35F487W35F4867W3594W350W3640R734C60RW364R074W36R0WC76R4G79WT3649RCW35407RC5W03C4R6W3504RC34RW340RC0W37RB504W37NRC5W03647R40OVWT345OV0W80TVO854YVWO4V5Y8V54Y00OO4V5O03W4IV95IWM43TWO5M849F3FSM84CWV0T5OBV0WM54OIMWTB50FM54IOYTO5XTR34267SBST4TV540TO0E4V5YU4Y50BY0MU49E5YUUEF9MCYUE8M5UY8VEM54V5E4WY05OVWTO54TO0459V03O450T3V405YIEBORTVSNRTO0SNOVE0RSNO0VEORFV0SERFVO0RSOFRO0NETVN054OTO045OT4WYOBV405OTV4W0O54WO0JT9W45VYW78549JTC7Y9W4K7XC58OTYS8JF4YT457J89TCV7SH8JTS7YTY54789JVYS54Y9JC7SY5T78KCJY578T9JYEHRTV78YJS75YV7DY67HTCDJ4S8C5T75TY8K477T
lea eax, [esp + 0x220]
push eax
call esi
lea ecx, [esp + 0x21c]
call fcn.00413c7f
mov eax, dword [0x444940]
lea eax, [eax + ebx*2]
add eax, 0xffffffe8
push eax
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x4145a7
call fcn.00413b6a
test eax, eax
je 0x4145a0
xor eax, eax
inc eax
mov dword [0x44493c], eax
mov dword [0x444938], eax
mov dword [0x444934], eax
jmp 0x414605
mov edx, 0x435734
jmp 0x414600
lea eax, [esp + 0x10]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
test eax, eax
jne 0x4145e8
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push str.WinTools
lea eax, [esp + 0x18]
push eax
call esi
push 0
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
lea eax, [esp + 0x18]
push eax
call esi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x435730
call fcn.00413c04
pop edi
pop ebp
pop ebx
pop esi
mov ecx, dword [esp + 0xa0c]
xor ecx, esp
call fcn.00415673
add esp, 0xa10
ret