Function at 0x4e2250
Capabilities:
Create directory
Delete directory
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x138
mov edi, dword [0x7cf770]
test edi, edi
je 0x4e2dae
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea edi, [ebp - 0x118]
mov dword [esp + 4], str.unknown.dll
mov dword [esp], edi
mov dword [ebp - 0x128], esi
call esi
lea eax, [ebp - 0x120]
sub esp, 8
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x7cf770]
sub esp, 0x14
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x535
xor eax, eax
cmp ebx, 0xc0000135
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], 0x5e6b4e
call fcn.004df840
mov dword [esp + 4], str.authz.dll
mov dword [esp], edi
call esi
mov eax, dword [ebp - 0x114]
sub esp, 8
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_LoadLibraryW]
mov dword [ebp - 0x124], eax
call eax
sub esp, 4
mov dword [ebp - 0x11c], eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x539
xor eax, eax
mov dword [esp + 4], str.Failed_to_load_module._n
mov esi, dword [ebp - 0x11c]
test esi, esi
setne al
mov dword [esp], eax
call fcn.004df840
lea eax, [ebp - 0x120]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x7cf770]
sub esp, 0x14
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x53b
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], 0x5e6b4e
call fcn.004df840
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x53c
mov eax, dword [ebp - 0x120]
mov dword [esp + 4], 0x5e6a4c
mov dword [esp + 8], eax
cmp dword [ebp - 0x11c], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004df840
mov dword [esp], str.Flags_0
call fcn.004ded40
mov eax, dword [ebp - 0x11c]
mov edx, 2
call fcn.004dfdd0
call fcn.0057d110
mov edx, dword [eax + 0xbec]
test edx, edx
je 0x4e2414
sub edx, 1
mov dword [eax + 0xbec], edx
mov eax, dword [ebp - 0x114]
mov dword [esp], eax
mov eax, dword [ebp - 0x124]
call eax
sub esp, 4
mov dword [ebp - 0x11c], eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x542
xor eax, eax
mov dword [esp + 4], str.Failed_to_load_module._n
mov ebx, dword [ebp - 0x11c]
test ebx, ebx
setne al
mov dword [esp], eax
call fcn.004df840
lea eax, [ebp - 0x120]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [0x7cf770]
sub esp, 0x14
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x545
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], 0x5e6b4e
call fcn.004df840
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x546
mov eax, dword [ebp - 0x120]
mov dword [esp + 4], 0x5e6a4c
mov dword [esp + 8], eax
cmp dword [ebp - 0x11c], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004df840
mov dword [esp], str.LDR_GET_DLL_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT
call fcn.004ded40
mov eax, dword [ebp - 0x11c]
mov edx, 1
call fcn.004dfdd0
call fcn.0057d110
mov edx, dword [eax + 0xbec]
test edx, edx
je 0x4e2526
sub edx, 1
mov dword [eax + 0xbec], edx
mov eax, dword [ebp - 0x114]
mov dword [esp], eax
mov eax, dword [ebp - 0x124]
call eax
sub esp, 4
mov dword [ebp - 0x11c], eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x54c
xor eax, eax
mov dword [esp + 4], str.Failed_to_load_module._n
mov ecx, dword [ebp - 0x11c]
test ecx, ecx
setne al
mov dword [esp], eax
call fcn.004df840
lea eax, [ebp - 0x120]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0
call dword [0x7cf774]
sub esp, 0x10
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x54e
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], 0x5e6b4e
call fcn.004df840
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x54f
mov eax, dword [ebp - 0x120]
mov dword [esp + 4], 0x5e6a4c
mov dword [esp + 8], eax
cmp dword [ebp - 0x11c], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004df840
mov dword [esp], str.LdrGetDllHandle
call fcn.004ded40
mov eax, dword [ebp - 0x11c]
mov edx, 1
call fcn.004dfdd0
call fcn.0057d110
mov edx, dword [eax + 0xbec]
test edx, edx
je 0x4e2630
sub edx, 1
mov dword [eax + 0xbec], edx
mov eax, dword [ebp - 0x114]
mov dword [esp], eax
mov eax, dword [ebp - 0x124]
call eax
sub esp, 4
mov dword [ebp - 0x11c], eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x555
xor eax, eax
mov dword [esp + 4], str.Failed_to_load_module._n
mov edx, dword [ebp - 0x11c]
test edx, edx
setne al
mov dword [esp], eax
call fcn.004df840
lea eax, [ebp - 0x120]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 4
call dword [0x7cf770]
sub esp, 0x14
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x557
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], 0x5e6b4e
call fcn.004df840
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x558
mov eax, dword [ebp - 0x120]
mov dword [esp + 4], 0x5e6a4c
mov dword [esp + 8], eax
cmp dword [ebp - 0x11c], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004df840
mov dword [esp], str.Flag_4
call fcn.004ded40
mov eax, dword [ebp - 0x11c]
mov edx, 2
call fcn.004dfdd0
call fcn.0057d110
mov edx, dword [eax + 0xbec]
test edx, edx
jne 0x4e2da0
mov ebx, 3
lea esi, [esi]
mov eax, dword [ebp - 0x114]
mov dword [esp], eax
mov eax, dword [ebp - 0x124]
call eax
sub esp, 4
mov dword [ebp - 0x11c], eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x560
xor eax, eax
mov dword [esp + 4], str.Failed_to_load_module._n
mov esi, dword [ebp - 0x11c]
test esi, esi
setne al
mov dword [esp], eax
call fcn.004df840
lea eax, [ebp - 0x120]
mov ecx, ebx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], eax
mov eax, 1
shl eax, cl
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [0x7cf770]
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x562
xor eax, eax
cmp esi, 0xc000000d
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], 0x5e6b4e
call fcn.004df840
mov dword [esp + 4], ebx
mov dword [esp], str.Invalid_flags__i__u
call fcn.004ded40
mov eax, dword [ebp - 0x11c]
mov edx, 1
call fcn.004dfdd0
call fcn.0057d110
mov edx, dword [eax + 0xbec]
test edx, edx
je 0x4e282f
sub edx, 1
mov dword [eax + 0xbec], edx
add ebx, 1
cmp ebx, 0x20
jne 0x4e2748
lea eax, [ebp - 0x120]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 3
call dword [0x7cf770]
sub esp, 0x14
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x56a
xor eax, eax
cmp ebx, 0xc000000d
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], 0x5e6b4e
call fcn.004df840
mov eax, dword [ebp - 0x114]
mov dword [esp], eax
mov eax, dword [ebp - 0x124]
call eax
sub esp, 4
mov dword [ebp - 0x11c], eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x56d
xor eax, eax
mov dword [esp + 4], str.Failed_to_load_module._n
mov ecx, dword [ebp - 0x11c]
test ecx, ecx
setne al
mov dword [esp], eax
call fcn.004df840
lea eax, [ebp - 0x120]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 2
call dword [0x7cf770]
sub esp, 0x14
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x570
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], 0x5e6b4e
call fcn.004df840
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x571
mov eax, dword [ebp - 0x120]
mov dword [esp + 4], 0x5e6a4c
mov dword [esp + 8], eax
cmp dword [ebp - 0x11c], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004df840
mov dword [esp], str.LDR_GET_DLL_HANDLE_EX_FLAG_PIN
call fcn.004ded40
mov eax, dword [ebp - 0x11c]
mov edx, 0xffffffff
call fcn.004dfdd0
call fcn.0057d110
mov edx, dword [eax + 0xbec]
test edx, edx
jne 0x4e2d88
lea eax, [ebp - 0x110]
mov dword [esp], 0x104
lea ebx, [ebp - 0x11c]
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
mov eax, 0x5e6c1b
sub esp, 8
call fcn.004dfcb0
mov dword [esp], 0x5e6c1b
call dword [sym.imp.kernel32.dll_LoadLibraryA]
sub esp, 4
mov dword [ebp - 0x120], eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x579
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x34]
mov dword [ebp - 0x12c], edx
mov dword [esp + 4], 0x5e6c23
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x120]
xor eax, eax
test edx, edx
setne al
mov dword [esp], eax
call fcn.004df840
mov dword [esp], edi
mov dword [esp + 4], str.d01.dll
mov eax, dword [ebp - 0x128]
call eax
sub esp, 8
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [0x7cf770]
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x57c
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], 0x5e6c44
call fcn.004df840
mov dword [esp], edi
mov dword [esp + 4], 0x5e6c50
mov eax, dword [ebp - 0x128]
call eax
sub esp, 8
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [0x7cf770]
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x580
xor eax, eax
cmp esi, 0xc0000135
sete al
mov dword [esp + 8], esi
mov dword [esp + 4], 0x5e6c44
mov dword [esp], eax
call fcn.004df840
mov ecx, dword [sym.imp.kernel32.dll_DeleteFileA]
mov dword [esp], str.d02.dll
mov dword [ebp - 0x124], ecx
call ecx
mov ecx, dword [sym.imp.kernel32.dll_MoveFileA]
sub esp, 4
mov dword [esp + 4], str.d02.dll
mov dword [esp], 0x5e6c1b
mov dword [ebp - 0x130], ecx
call ecx
sub esp, 8
mov esi, eax
call fcn.0057d110
mov edx, dword [ebp - 0x12c]
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x585
mov eax, dword [edx + 0x34]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5e6c23
call fcn.004df840
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [0x7cf770]
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x587
xor eax, eax
cmp esi, 0xc0000135
sete al
mov dword [esp + 8], esi
mov dword [esp + 4], 0x5e6c44
mov dword [esp], eax
call fcn.004df840
mov dword [esp + 4], 0
mov dword [esp], str.testdir
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
sub esp, 8
mov dword [esp], 0x5e6c70
mov ecx, dword [ebp - 0x124]
call ecx
sub esp, 4
mov dword [esp + 4], 0x5e6c70
mov dword [esp], str.d02.dll
mov ecx, dword [ebp - 0x130]
call ecx
sub esp, 8
mov esi, eax
call fcn.0057d110
mov edx, dword [ebp - 0x12c]
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x58b
mov eax, dword [edx + 0x34]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5e6c23
call fcn.004df840
mov dword [esp], edi
mov dword [esp + 4], str.testdird02.dll
mov eax, dword [ebp - 0x128]
call eax
sub esp, 8
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [0x7cf770]
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x58e
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], 0x5e6c44
call fcn.004df840
call fcn.0057d110
mov dword [eax], 0x5e6553
mov edx, dword [ebp - 0x120]
mov dword [eax + 4], 0x58f
mov eax, dword [ebp - 0x11c]
mov dword [esp + 0xc], edx
cmp edx, eax
mov dword [esp + 8], eax
sete al
mov dword [esp + 4], str.got__p___p._n
movzx eax, al
mov dword [esp], eax
call fcn.004df840
mov eax, dword [ebp - 0x120]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
sub esp, 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [0x7cf770]
sub esp, 0x14
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x592
xor eax, eax
cmp ebx, 0xc0000135
sete al
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x5e6c44
mov dword [esp], eax
call fcn.004df840
mov dword [esp], 0x5e6c70
mov ecx, dword [ebp - 0x124]
call ecx
sub esp, 4
mov dword [esp], str.testdir
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub edx, 1
mov dword [eax + 0xbec], edx
jmp 0x4e29a9
sub edx, 1
mov dword [eax + 0xbec], edx
jmp 0x4e273d
call fcn.0057d110
mov dword [eax], 0x5e6553
mov dword [eax + 4], 0x52f
mov dword [esp], str.LdrGetDllHandleEx_is_not_available._n
call fcn.004dfda0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret