Function at 0x1002c370
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get disk information
Get file attributes
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24c0
call fcn.100428a0
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov eax, dword [eax + 0x318]
or ebx, 0xffffffff
mov dword [ebp - 0x14], 0x2000
mov dword [ebp - 0x10], edi
cmp eax, edi
je 0x1002c3ab
push esi
call eax
cmp eax, ebx
jne 0x1002c3b6
mov ecx, dword [esi]
cmp byte [ecx + 0x34c], 0xff
je 0x1002c3c6
call fcn.1002f0f0
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
movzx eax, byte [ebp + 0xc]
dec eax
cmp eax, 9
ja case.0x1002c3d4.2
jmp dword [eax*4 + 0x1002cae0]
movzx eax, byte [ebp + 0x10]
dec eax
je 0x1002c4b0
dec eax
jne case.0x1002c3d4.2
lea ecx, [ebp - 0x2ac]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea ecx, [eax - 3]
mov dword [ebp + 0x10], eax
cmp ecx, edi
jbe 0x1002c48f
lea ebx, [ebp - 0x18]
lea edx, [ebp - 0x2ac]
sub ebx, edx
jmp 0x1002c420
mov edi, dword [ebp - 0x10]
lea eax, [ebp + edi - 0x2ac]
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [eax + ebx], cl
inc eax
test cl, cl
jne 0x1002c430
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x1002c44c
jmp dword [eax*4 + 0x1002cb08]
mov byte [ebp + edi - 0x2aa], 0x6c
jmp case.default.0x1002c44c
mov byte [ebp + edi - 0x2aa], 0x66
jmp case.default.0x1002c44c
mov byte [ebp + edi - 0x2aa], 0x63
jmp case.default.0x1002c44c
mov byte [ebp + edi - 0x2aa], 0x6e
mov eax, dword [ebp + 0x10]
add edi, 4
add eax, 0xfffffffd
sub ebx, 4
mov dword [ebp - 0x10], edi
cmp edi, eax
jb 0x1002c420
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x2ac]
push ecx
push 3
mov edi, eax
push esi
xor eax, eax
mov cl, 2
call fcn.1002bd60
movsx eax, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edx, dword [ebp + 0x18]
push edx
mov eax, esi
call fcn.1002c0b0
mov ebx, eax
cmp ebx, edi
je 0x1002c3bb
mov eax, dword [ebp + 0x18]
push ebx
push eax
push esi
call fcn.1002be40
movsx ecx, al
mov dword [ebp - 8], ecx
push ebx
call dword [sym.imp.MSVCRT.dll_free]
mov al, byte [ebp - 8]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [ebp + 0x18]
push edx
mov eax, esi
call fcn.1002c0b0
mov ebx, eax
test ebx, ebx
je 0x1002c3bb
lea edx, [ebp - 0x1a4]
sub edx, ebx
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1002c511
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x1a4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x7624], eax
cmp eax, 0xffffffff
je 0x1002c635
lea ecx, [ebp - 0x5c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1002c61e
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx ecx, word [ebp - 0x1e]
movzx edx, word [ebp - 0x20]
movzx eax, word [ebp - 0x28]
push ecx
movzx ecx, word [ebp - 0x22]
push edx
movzx edx, word [ebp - 0x26]
push eax
push ecx
push edx
lea eax, [ebp - 0x9c]
push str._02d__02d__04d__02d:_02d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x9c]
add esp, 0x1c
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002c5a0
mov ecx, dword [ebp + 0x18]
sub eax, edx
lea edx, [eax + ecx + 2]
push edx
push ebx
call dword [sym.imp.MSVCRT.dll_realloc]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1002c3bb
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1002c5c8
mov ax, word [0x100489cc]
mov word [edi], ax
lea eax, [ebp - 0x9c]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002c5e1
sub eax, esi
lea edi, [ebx - 1]
lea ecx, [ecx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1002c5f0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, ebx
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
jmp 0x1002c610
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002c610
sub eax, edx
mov dword [ebp + 0x18], eax
jmp 0x1002c635
mov ecx, dword [esi + 0x7624]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x7624], 0xffffffff
mov eax, dword [ebp + 8]
xor edx, edx
cmp dword [ebp + 0x14], 1
sete dl
cmp dword [eax + 0x7624], 0xffffffff
mov dword [eax + 0x7628], edx
jne 0x1002c655
or eax, 0xffffffff
jmp 0x1002c658
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x18]
push ebx
push 0
push esi
mov cl, 4
call fcn.1002bd60
cmp dword [esi + 0x7624], 0xffffffff
movsx eax, al
mov dword [ebp - 8], eax
je 0x1002c4de
mov eax, dword [ebp - 0x38]
mov dword [esi + 0x762c], eax
shr eax, 0xd
mov dword [esi + 0x7630], eax
xor eax, eax
push 4
lea ecx, [ebp - 0xc]
mov dword [esi + 0x7634], eax
mov dword [esi + 0x7638], eax
mov dword [ebp - 0xc], eax
push ecx
mov eax, esi
call fcn.1002f3c0
test eax, eax
jns 0x1002c81e
call fcn.1002f0f0
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp dword [ebp + 0x14], ebx
jne 0x1002c6f1
mov edx, dword [esi + 0x7624]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x7624], ebx
or al, 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, esi
mov dword [esi + 0x7638], 1
call fcn.1002c140
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x18]
push eax
mov eax, esi
call fcn.1002c0b0
mov ebx, eax
test ebx, ebx
je 0x1002c3bb
mov cl, byte [ebx]
test cl, cl
je 0x1002c735
cmp cl, 0x2c
je 0x1002c735
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1002c726
jmp 0x1002c747
cmp byte [eax], 0
je 0x1002c747
mov byte [eax], 0
inc eax
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002c740
push 4
lea ecx, [ebp - 0xc]
push ecx
mov eax, esi
call fcn.1002f300
test eax, eax
jle 0x1002c6b4
cmp byte [0x1004c05d], 0
je 0x1002c78f
mov eax, dword [ebp - 0xc]
mov edx, eax
mov ecx, eax
shr ecx, 0x10
and edx, 0xff0000
or edx, ecx
mov ecx, eax
and ecx, 0xff00
shl eax, 0x10
or ecx, eax
shr edx, 8
shl ecx, 8
or edx, ecx
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x1a4]
mov eax, ebx
sub edx, ebx
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1002c7a0
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea edx, [ebp - 0x1a4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [ebp + 0x18]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
push ebx
mov dword [esi + 0x7624], eax
push 0
push esi
lea eax, [ecx - 1]
mov cl, 9
call fcn.1002bd60
cmp dword [esi + 0x7624], 0xffffffff
movsx edx, al
mov dword [ebp - 8], edx
je 0x1002c4de
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x762c], eax
shr eax, 0xd
mov dword [esi + 0x7630], eax
mov dword [esi + 0x7634], 1
mov dword [esi + 0x7638], 0
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
or al, 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edi, dword [ebp + 0x18]
push edi
mov eax, esi
call fcn.1002c0b0
mov ebx, eax
test ebx, ebx
je 0x1002c3bb
mov eax, dword [esi + 0x7624]
cmp eax, 0xffffffff
je 0x1002c81e
cmp dword [ebp + 0x14], 0
jne 0x1002c864
push 0
lea ecx, [ebp - 8]
push ecx
push edi
push ebx
push eax
jmp 0x1002c892
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x24bc]
push eax
mov ecx, edi
mov eax, ebx
call fcn.100366b0
mov edx, dword [ebp - 0x14]
push 0
lea ecx, [ebp - 8]
push ecx
push edx
lea eax, [ebp - 0x24bc]
mov ecx, esi
mov edx, dword [ecx + 0x7624]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 8], 0xffffffff
jne 0x1002c81e
mov eax, dword [esi + 0x7624]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [esi + 0x7624], 0xffffffff
mov dword [esi + 0x7638], eax
mov dword [esi + 0x7634], eax
jmp 0x1002c81e
mov eax, dword [esi + 0x7624]
cmp eax, ebx
je 0x1002c8d9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x7624], ebx
mov dword [esi + 0x7638], edi
mov dword [esi + 0x7634], edi
or al, 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [esi + 0x7624]
cmp eax, ebx
jne 0x1002c8d2
cmp byte [ebp + 0x10], 0
jne 0x1002c921
push 0x10048bc9
push edi
push esi
xor edi, edi
mov eax, ebx
mov cl, 7
call fcn.1002bd60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ecx + 0x318]
cmp eax, edi
je 0x1002c95e
push esi
call eax
push 0x10048bc9
push edi
xor edi, edi
mov cl, 0xe
push esi
cmp eax, ebx
jne 0x1002c94e
lea eax, [edi + 1]
call fcn.1002bd60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, ebx
call fcn.1002bd60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 0x10048bc9
push edi
xor edi, edi
push esi
lea eax, [edi + 1]
mov cl, 0xe
call fcn.1002bd60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 0x18]
mov edi, esi
push ecx
mov eax, edi
call fcn.1002c0b0
mov ebx, eax
test ebx, ebx
je 0x1002c3bb
movzx eax, byte [ebp + 0x10]
dec eax
je 0x1002caa3
sub eax, 3
je 0x1002ca36
dec eax
jne 0x1002c81e
mov al, byte [ebx]
mov esi, ebx
test al, al
je 0x1002c9c5
cmp al, 0x2a
je 0x1002c9c5
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1002c9b4
jmp 0x1002c81e
cmp byte [esi], 0
je 0x1002c81e
lea edx, [ebp - 0x1a4]
mov byte [esi], 0
mov eax, ebx
sub edx, ebx
jmp 0x1002c9e0
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1002c9e0
lea eax, [esi + 1]
lea edx, [ebp - 0x3b4]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1002c9f5
lea edx, [ebp - 0x3b4]
push edx
lea eax, [ebp - 0x1a4]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
neg eax
sbb eax, eax
neg eax
push ebx
dec eax
mov dword [ebp - 8], eax
push 8
mov byte [esi], 0x2a
mov eax, dword [ebp - 8]
push edi
mov edi, dword [ebp + 0x18]
mov cl, 0xb
call fcn.1002bd60
jmp 0x1002c4d8
lea edx, [ebp - 0x1a4]
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1002ca40
lea edx, [ebp - 0x1a4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1002ca60
or eax, eax
jmp 0x1002ca87
test al, 0x10
je 0x1002ca73
lea eax, [ebp - 0x1a4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x1002ca80
lea ecx, [ebp - 0x1a4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
neg eax
dec eax
push ebx
push 7
push edi
mov edi, dword [ebp + 0x18]
mov cl, 0xb
mov dword [ebp - 8], eax
call fcn.1002bd60
movsx edx, al
mov dword [ebp - 8], edx
jmp 0x1002c4de
lea edx, [ebp - 0x1a4]
mov eax, ebx
sub edx, ebx
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1002cab0
push 0
lea eax, [ebp - 0x1a4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ebx
push 4
push edi
mov edi, dword [ebp + 0x18]
mov cl, 0xb
mov dword [ebp - 8], eax
call fcn.1002bd60
jmp 0x1002c4d8