Function at 0x1002dbf0
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get disk information
Get file attributes
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x26c8
call fcn.10044950
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov eax, dword [eax + 0x318]
or ebx, 0xffffffff
mov dword [ebp - 0x14], 0x2000
mov dword [ebp - 0x10], edi
cmp eax, edi
je 0x1002dc2b
push esi
call eax
cmp eax, ebx
jne 0x1002dc36
mov ecx, dword [esi]
cmp byte [ecx + 0x34c], 0xff
je 0x1002dc46
call fcn.10030a00
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
movzx eax, byte [ebp + 0xc]
dec eax
cmp eax, 9
ja case.0x1002dc54.2
jmp dword [eax*4 + 0x1002e390]
movzx eax, byte [ebp + 0x10]
dec eax
je 0x1002dd30
dec eax
jne case.0x1002dc54.2
lea ecx, [ebp - 0x2ac]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea ecx, [eax - 3]
mov dword [ebp + 0x10], eax
cmp ecx, edi
jbe 0x1002dd0f
lea ebx, [ebp - 0x18]
lea edx, [ebp - 0x2ac]
sub ebx, edx
jmp 0x1002dca0
mov edi, dword [ebp - 0x10]
lea eax, [ebp + edi - 0x2ac]
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x1002dcb0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x1002dccc
jmp dword [eax*4 + 0x1002e3b8]
mov byte [ebp + edi - 0x2aa], 0x6c
jmp case.default.0x1002dccc
mov byte [ebp + edi - 0x2aa], 0x66
jmp case.default.0x1002dccc
mov byte [ebp + edi - 0x2aa], 0x63
jmp case.default.0x1002dccc
mov byte [ebp + edi - 0x2aa], 0x6e
mov eax, dword [ebp + 0x10]
add edi, 4
add eax, 0xfffffffd
sub ebx, 4
mov dword [ebp - 0x10], edi
cmp edi, eax
jb 0x1002dca0
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x2ac]
push ecx
push 3
mov edi, eax
push esi
xor eax, eax
mov cl, 2
call fcn.1002d4c0
movsx eax, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edx, dword [ebp + 0x18]
push edx
mov eax, esi
call fcn.1002d920
mov ebx, eax
cmp ebx, edi
je 0x1002dc3b
mov eax, dword [ebp + 0x18]
push ebx
push eax
push esi
call fcn.1002d5a0
movsx ecx, al
mov dword [ebp - 8], ecx
push ebx
call dword [sym.imp.MSVCRT.dll_free]
mov al, byte [ebp - 8]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [ebp + 0x18]
push edx
mov eax, esi
call fcn.1002d920
mov ebx, eax
test ebx, ebx
je 0x1002dc3b
lea edx, [ebp - 0x164]
sub edx, ebx
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1002dd91
lea eax, [ebp - 0x164]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002dda4
sub eax, edx
inc eax
push eax
lea ecx, [ebp - 0x5bc]
push ecx
push eax
lea edx, [ebp - 0x164]
push edx
push 0
push 0x4e3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x5bc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x7624], eax
cmp eax, 0xffffffff
je 0x1002dee5
lea ecx, [ebp - 0x5c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1002dece
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx ecx, word [ebp - 0x1e]
movzx edx, word [ebp - 0x20]
movzx eax, word [ebp - 0x28]
push ecx
movzx ecx, word [ebp - 0x22]
push edx
movzx edx, word [ebp - 0x26]
push eax
push ecx
push edx
lea eax, [ebp - 0x1a4]
push str._02d__02d__04d__02d:_02d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x1a4]
add esp, 0x1c
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002de50
mov ecx, dword [ebp + 0x18]
sub eax, edx
lea edx, [eax + ecx + 2]
push edx
push ebx
call dword [sym.imp.MSVCRT.dll_realloc]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1002dc3b
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1002de78
mov ax, word [0x1004aa50]
mov word [edi], ax
lea eax, [ebp - 0x1a4]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002de91
sub eax, esi
lea edi, [ebx - 1]
lea ecx, [ecx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1002dea0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, ebx
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
jmp 0x1002dec0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002dec0
sub eax, edx
mov dword [ebp + 0x18], eax
jmp 0x1002dee5
mov ecx, dword [esi + 0x7624]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x7624], 0xffffffff
mov eax, dword [ebp + 8]
xor edx, edx
cmp dword [ebp + 0x14], 1
sete dl
cmp dword [eax + 0x7624], 0xffffffff
mov dword [eax + 0x7628], edx
jne 0x1002df05
or eax, 0xffffffff
jmp 0x1002df08
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x18]
push ebx
push 0
push esi
mov cl, 4
call fcn.1002d4c0
cmp dword [esi + 0x7624], 0xffffffff
movsx eax, al
mov dword [ebp - 8], eax
je 0x1002dd5e
mov eax, dword [ebp - 0x38]
mov dword [esi + 0x762c], eax
shr eax, 0xd
mov dword [esi + 0x7630], eax
xor eax, eax
push 4
lea ecx, [ebp - 0xc]
mov dword [esi + 0x7634], eax
mov dword [esi + 0x7638], eax
mov dword [ebp - 0xc], eax
push ecx
mov eax, esi
call fcn.10030cd0
test eax, eax
jns 0x1002e0ce
call fcn.10030a00
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp dword [ebp + 0x14], ebx
jne 0x1002dfa1
mov edx, dword [esi + 0x7624]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x7624], ebx
or al, 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, esi
mov dword [esi + 0x7638], 1
call fcn.1002d9b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x18]
push eax
mov eax, esi
call fcn.1002d920
mov ebx, eax
test ebx, ebx
je 0x1002dc3b
mov cl, byte [ebx]
test cl, cl
je 0x1002dfe5
cmp cl, 0x2c
je 0x1002dfe5
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1002dfd6
jmp 0x1002dff7
cmp byte [eax], 0
je 0x1002dff7
mov byte [eax], 0
inc eax
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002dff0
push 4
lea ecx, [ebp - 0xc]
push ecx
mov eax, esi
call fcn.10030c10
test eax, eax
jle 0x1002df64
cmp byte [0x1004e05d], 0
je 0x1002e03f
mov eax, dword [ebp - 0xc]
mov edx, eax
mov ecx, eax
shr ecx, 0x10
and edx, 0xff0000
or edx, ecx
mov ecx, eax
and ecx, 0xff00
shl eax, 0x10
or ecx, eax
shr edx, 8
shl ecx, 8
or edx, ecx
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x164]
mov eax, ebx
sub edx, ebx
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1002e050
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea edx, [ebp - 0x164]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [ebp + 0x18]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
push ebx
mov dword [esi + 0x7624], eax
push 0
push esi
lea eax, [ecx - 1]
mov cl, 9
call fcn.1002d4c0
cmp dword [esi + 0x7624], 0xffffffff
movsx edx, al
mov dword [ebp - 8], edx
je 0x1002dd5e
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x762c], eax
shr eax, 0xd
mov dword [esi + 0x7630], eax
mov dword [esi + 0x7634], 1
mov dword [esi + 0x7638], 0
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
or al, 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edi, dword [ebp + 0x18]
push edi
mov eax, esi
call fcn.1002d920
mov ebx, eax
test ebx, ebx
je 0x1002dc3b
mov eax, dword [esi + 0x7624]
cmp eax, 0xffffffff
je 0x1002e0ce
cmp dword [ebp + 0x14], 0
jne 0x1002e114
push 0
lea ecx, [ebp - 8]
push ecx
push edi
push ebx
push eax
jmp 0x1002e142
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x26c4]
push eax
mov ecx, edi
mov eax, ebx
call fcn.10038760
mov edx, dword [ebp - 0x14]
push 0
lea ecx, [ebp - 8]
push ecx
push edx
lea eax, [ebp - 0x26c4]
mov ecx, esi
mov edx, dword [ecx + 0x7624]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 8], 0xffffffff
jne 0x1002e0ce
mov eax, dword [esi + 0x7624]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [esi + 0x7624], 0xffffffff
mov dword [esi + 0x7638], eax
mov dword [esi + 0x7634], eax
jmp 0x1002e0ce
mov eax, dword [esi + 0x7624]
cmp eax, ebx
je 0x1002e189
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x7624], ebx
mov dword [esi + 0x7638], edi
mov dword [esi + 0x7634], edi
or al, 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [esi + 0x7624]
cmp eax, ebx
jne 0x1002e182
cmp byte [ebp + 0x10], 0
jne 0x1002e1d1
push 0x1004ac8d
push edi
push esi
xor edi, edi
mov eax, ebx
mov cl, 7
call fcn.1002d4c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ecx + 0x318]
cmp eax, edi
je 0x1002e20e
push esi
call eax
push 0x1004ac8d
push edi
xor edi, edi
mov cl, 0xe
push esi
cmp eax, ebx
jne 0x1002e1fe
lea eax, [edi + 1]
call fcn.1002d4c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, ebx
call fcn.1002d4c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 0x1004ac8d
push edi
xor edi, edi
push esi
lea eax, [edi + 1]
mov cl, 0xe
call fcn.1002d4c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 0x18]
mov edi, esi
push ecx
mov eax, edi
call fcn.1002d920
mov ebx, eax
test ebx, ebx
je 0x1002dc3b
movzx eax, byte [ebp + 0x10]
dec eax
je 0x1002e353
sub eax, 3
je 0x1002e2e6
dec eax
jne 0x1002e0ce
mov al, byte [ebx]
mov esi, ebx
test al, al
je 0x1002e275
cmp al, 0x2a
je 0x1002e275
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1002e264
jmp 0x1002e0ce
cmp byte [esi], 0
je 0x1002e0ce
lea edx, [ebp - 0x164]
mov byte [esi], 0
mov eax, ebx
sub edx, ebx
jmp 0x1002e290
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1002e290
lea eax, [esi + 1]
lea edx, [ebp - 0x3b4]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1002e2a5
lea edx, [ebp - 0x3b4]
push edx
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
neg eax
sbb eax, eax
neg eax
push ebx
dec eax
mov dword [ebp - 8], eax
push 8
mov byte [esi], 0x2a
mov eax, dword [ebp - 8]
push edi
mov edi, dword [ebp + 0x18]
mov cl, 0xb
call fcn.1002d4c0
jmp 0x1002dd58
lea edx, [ebp - 0x164]
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1002e2f0
lea edx, [ebp - 0x164]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1002e310
or eax, eax
jmp 0x1002e337
test al, 0x10
je 0x1002e323
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x1002e330
lea ecx, [ebp - 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
neg eax
dec eax
push ebx
push 7
push edi
mov edi, dword [ebp + 0x18]
mov cl, 0xb
mov dword [ebp - 8], eax
call fcn.1002d4c0
movsx edx, al
mov dword [ebp - 8], edx
jmp 0x1002dd5e
lea edx, [ebp - 0x164]
mov eax, ebx
sub edx, ebx
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1002e360
push 0
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ebx
push 4
push edi
mov edi, dword [ebp + 0x18]
mov cl, 0xb
mov dword [ebp - 8], eax
call fcn.1002d4c0
jmp 0x1002dd58