Function at 0x875980
Capabilities:
Create directory
Delete file
Get common file path
Terminate process

Disassembly:
mov edi, 0x818850
mov ecx, 0x104
mov al, 0
rep stosb byte es:[edi], al
push 0x818850
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, 0x818850
mov al, 0
mov ecx, 0x104
repne scasb al, byte es:[edi]
dec edi
cmp byte [edi - 1], 0x5c
jne 0x8759b4
dec edi
mov eax, 0x736f525c
stosd dword es:[edi], eax
mov eax, 0x556d7341
stosd dword es:[edi], eax
mov ax, 0x646e
stosw word es:[edi], ax
mov al, 0x6f
stosb byte es:[edi], al
push edi
push 0
push 0x818850
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebx, eax
pop edi
cmp byte [0x4658e2], 0
jne 0x875a07
push edi
mov dword [edi], 0x646e555c
mov dword [edi + 4], 0x242e2a6f
mov word [edi + 8], 0x2424
mov byte [edi + 9], 0
push 0x818850
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
mov eax, 0x646e555c
stosd dword es:[edi], eax
mov eax, 0x3130306f
stosd dword es:[edi], eax
mov eax, 0x2424242e
stosd dword es:[edi], eax
mov byte [edi], 0
sub edi, 5
mov dword [str.000._r_nBlock_Delete_Undo_Files_have_been_found_in_the_r_nTemporary_Directory__...RosAsmUndo_._r_n_r_nThe_existing_Undo_Files_are_going_to_be_deleted_and_r_nthe_previous_instance_of_RosAsm_will_no_more_be_able_to_r_nUnDelete_its_saved_Blocks._r_n_r_nYou_are_runing_several_instances_of_RosAsm._Do_not_________r_nDelete_UnDelete_Blocks_of_text__Ctrl__X_____Ctrl__Z__r_nThe_results_could_be_unwished._r_n_r_n], edi
sub dword [str.000._r_nBlock_Delete_Undo_Files_have_been_found_in_the_r_nTemporary_Directory__...RosAsmUndo_._r_n_r_nThe_existing_Undo_Files_are_going_to_be_deleted_and_r_nthe_previous_instance_of_RosAsm_will_no_more_be_able_to_r_nUnDelete_its_saved_Blocks._r_n_r_nYou_are_runing_several_instances_of_RosAsm._Do_not_________r_nDelete_UnDelete_Blocks_of_text__Ctrl__X_____Ctrl__Z__r_nThe_results_could_be_unwished._r_n_r_n], 2
mov esi, 0x818850
mov edi, 0x818954
mov ecx, 0x104
rep movsb byte es:[edi], byte [esi]
mov eax, dword [str.000._r_nBlock_Delete_Undo_Files_have_been_found_in_the_r_nTemporary_Directory__...RosAsmUndo_._r_n_r_nThe_existing_Undo_Files_are_going_to_be_deleted_and_r_nthe_previous_instance_of_RosAsm_will_no_more_be_able_to_r_nUnDelete_its_saved_Blocks._r_n_r_nYou_are_runing_several_instances_of_RosAsm._Do_not_________r_nDelete_UnDelete_Blocks_of_text__Ctrl__X_____Ctrl__Z__r_nThe_results_could_be_unwished._r_n_r_n]
sub eax, 0x818850
mov edi, 0x818954
add edi, eax
mov eax, 0x2e3f3f3f
stosd dword es:[edi], eax
cmp ebx, 0
jne 0x875ad7
push 0x509de8
push 0x818954
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x875aaf
cmp byte [0x4658e2], 1
jne 0x875aa5
push 0x11
push str.Arghhh___...
push 0x46596c
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x875aa5
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.0087923b
jmp 0x875ad7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [0x4658e2], 1
jne 0x875ad7
push 0
push str.Arghhh___...
push 0x465a52
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, dword [str.000._r_nBlock_Delete_Undo_Files_have_been_found_in_the_r_nTemporary_Directory__...RosAsmUndo_._r_n_r_nThe_existing_Undo_Files_are_going_to_be_deleted_and_r_nthe_previous_instance_of_RosAsm_will_no_more_be_able_to_r_nUnDelete_its_saved_Blocks._r_n_r_nYou_are_runing_several_instances_of_RosAsm._Do_not_________r_nDelete_UnDelete_Blocks_of_text__Ctrl__X_____Ctrl__Z__r_nThe_results_could_be_unwished._r_n_r_n]
mov eax, 0x2e303030
stosd dword es:[edi], eax
ret