Function at 0x43bee0
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5059e6
mov eax, dword fs:[0]
push eax
mov eax, 0x5084
call fcn.004ebbf0
mov eax, dword [0x528af4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x5090], edi
mov dword [ebp - 0x508c], esi
call fcn.004a0500
test al, al
je 0x43c683
push 0x800
lea eax, [ebp - 0x2010]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x800
push 0x50dfe8
lea eax, [ebp - 0x2010]
push eax
call fcn.00478fb0
call fcn.0046bee0
cmp eax, 0x600
mov byte [ebp - 0x5085], 0
push 0x10
lea eax, [ebp - 0x1010]
setae bh
push eax
call fcn.0043aac0
test bh, bh
je 0x43bfd2
test al, al
je 0x43bfc2
push 0x800
lea eax, [ebp - 0x1010]
push eax
call fcn.00477290
push 0x800
push str.WinRAR.lnk
lea eax, [ebp - 0x1010]
push eax
call fcn.0048e6d0
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne byte [ebp - 0x5085]
push 0x19
lea eax, [ebp - 0x1010]
push eax
call fcn.0043aac0
jmp 0x43bfda
test al, al
je 0x43c683
push 0x800
lea eax, [ebp - 0x1010]
push eax
call fcn.00477290
push 0x800
push str.WinRAR.lnk
lea eax, [ebp - 0x1010]
push eax
call fcn.0048e6d0
mov eax, dword [ebp + 8]
mov bl, byte [ebp + 0x14]
cmp byte [eax + 0x14], 0
je 0x43c0ef
test bl, bl
je 0x43c031
lea eax, [ebp - 0x1010]
push eax
call fcn.00469360
test al, al
jne 0x43c031
cmp byte [ebp - 0x5085], al
je 0x43c0fb
push 0
push esi
push 0x537
call fcn.00488530
push eax
push 0
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x2010]
push eax
push 1
call fcn.004c4630
test al, al
jne 0x43c0fb
test bh, bh
je 0x43c0fb
test bl, bl
je 0x43c0fb
lea eax, [ebp - 0x1010]
push eax
call fcn.00469360
test al, al
je 0x43c08f
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x43c0fb
push 0x10
lea eax, [ebp - 0x1010]
push eax
call fcn.0043aac0
test al, al
je 0x43c0fb
push 0x800
lea eax, [ebp - 0x1010]
push eax
call fcn.00477290
push 0x800
push str.WinRAR.lnk
lea eax, [ebp - 0x1010]
push eax
call fcn.0048e6d0
push 0
push esi
push 0x537
call fcn.00488530
push eax
push 0
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x2010]
push eax
push 1
call fcn.004c4630
jmp 0x43c0fb
lea eax, [ebp - 0x1010]
push eax
call fcn.00468f10
movzx eax, bh
neg eax
sbb eax, eax
and eax, 0xb
add eax, 0xb
push eax
lea eax, [ebp - 0x1010]
push eax
call fcn.0043aac0
push 0x800
lea eax, [ebp - 0x1010]
push eax
call fcn.00477290
push 0x800
push str.WinRAR.lnk
lea eax, [ebp - 0x1010]
push eax
call fcn.0048e6d0
mov eax, dword [ebp + 8]
cmp byte [eax + 0x15], 0
je 0x43c180
test bl, bl
je 0x43c159
lea eax, [ebp - 0x1010]
push eax
call fcn.00469360
test al, al
je 0x43c18c
push 0
push esi
push 0x537
call fcn.00488530
push eax
push 0
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x2010]
push eax
push 1
call fcn.004c4630
jmp 0x43c18c
lea eax, [ebp - 0x1010]
push eax
call fcn.00468f10
push 0x50dfe8
call fcn.004f253e
push str.WinRAR.chm
mov dword [ebp - 0x3024], eax
call fcn.004f253e
push str.Rar.txt
mov dword [ebp - 0x3020], eax
call fcn.004f253e
add esp, 0xc
mov dword [ebp - 0x301c], eax
push 0x391
call fcn.00488530
push eax
call fcn.004f253e
push 0x50e0ac
mov dword [ebp - 0x3018], eax
call fcn.004f253e
add esp, 8
mov dword [ebp - 0x3034], eax
push 0x38e
call fcn.00488530
push eax
call fcn.004f253e
add esp, 4
mov dword [ebp - 0x3030], eax
push 0x38f
call fcn.00488530
push eax
call fcn.004f253e
add esp, 4
mov dword [ebp - 0x302c], eax
push 0x390
call fcn.00488530
push eax
call fcn.004f253e
add esp, 4
mov dword [ebp - 0x3028], eax
lea eax, [ebp - 0x1010]
push 2
push eax
call fcn.0043aac0
push 0x800
lea eax, [ebp - 0x1010]
push eax
call fcn.00477290
push 0x800
push 0x50e0ac
lea eax, [ebp - 0x1010]
push eax
call fcn.0048e6d0
test bl, bl
je 0x43c280
lea eax, [ebp - 0x1010]
push eax
call fcn.00469360
test al, al
je 0x43c430
mov esi, dword [ebp + 8]
cmp byte [esi + 0x16], 0
je 0x43c640
test edi, edi
je 0x43c2b0
lea ecx, [ebp - 0x1010]
mov edx, edi
mov eax, ecx
sub edx, eax
lea ecx, [ecx]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x43c2a0
test bl, bl
jne 0x43c375
lea eax, [ebp - 0x1010]
push eax
call fcn.00469360
test al, al
je 0x43c366
push 0x802
lea eax, [ebp - 0x3014]
push eax
push 0x50ba14
lea eax, [ebp - 0x1010]
push eax
call fcn.004789f0
lea ecx, [ebp - 0x403c]
call fcn.0046abf0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x3014]
push eax
lea ecx, [ebp - 0x403c]
call fcn.0046adf0
lea ecx, [ebp - 0x5084]
call fcn.0040d460
push 0
lea eax, [ebp - 0x5084]
push eax
lea ecx, [ebp - 0x403c]
call fcn.0046acd0
test al, al
je 0x43c354
lea eax, [ebp - 0x5084]
push eax
call fcn.00468f10
push 0
lea eax, [ebp - 0x5084]
push eax
lea ecx, [ebp - 0x403c]
call fcn.0046acd0
test al, al
jne 0x43c330
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x403c]
call fcn.0046ac10
push 0
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, dword [ebp - 0x508c]
xor esi, esi
lea ecx, [ecx]
push 0x800
lea eax, [ebp - 0x3010]
push eax
push dword [ebp + esi*4 - 0x3034]
lea eax, [ebp - 0x1010]
push eax
call fcn.004789f0
push 0x800
push str..lnk
lea eax, [ebp - 0x3010]
push eax
call fcn.0048e6d0
push 0x800
push dword [ebp + esi*4 - 0x3024]
lea eax, [ebp - 0x2010]
push eax
call fcn.00478fb0
lea eax, [ebp - 0x2010]
push eax
call fcn.00469360
test al, al
je 0x43c420
test bl, bl
je 0x43c3f1
lea eax, [ebp - 0x3010]
push eax
call fcn.00469360
test al, al
je 0x43c420
mov eax, esi
neg eax
push 0
sbb eax, eax
not eax
and eax, edi
push eax
push 0x537
call fcn.00488530
push eax
push 0
lea eax, [ebp - 0x3010]
push eax
lea eax, [ebp - 0x2010]
push eax
push 1
call fcn.004c4630
inc esi
cmp esi, 4
jb 0x43c380
mov edi, dword [ebp - 0x5090]
mov esi, dword [ebp + 8]
push 0x17
lea eax, [ebp - 0x1010]
push eax
call fcn.0043aac0
test al, al
je 0x43c65d
push 0x800
lea eax, [ebp - 0x1010]
push eax
call fcn.00477290
push 0x800
push 0x50e0ac
lea eax, [ebp - 0x1010]
push eax
call fcn.0048e6d0
test bl, bl
je 0x43c488
lea eax, [ebp - 0x1010]
push eax
call fcn.00469360
test al, al
je 0x43c65d
cmp byte [esi + 0x16], 0
je 0x43c651
test bl, bl
jne 0x43c557
lea eax, [ebp - 0x1010]
push eax
call fcn.00469360
test al, al
je 0x43c548
push 0x802
lea eax, [ebp - 0x3014]
push eax
push 0x50ba14
lea eax, [ebp - 0x1010]
push eax
call fcn.004789f0
lea ecx, [ebp - 0x403c]
call fcn.0046abf0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x3014]
push eax
lea ecx, [ebp - 0x403c]
call fcn.0046adf0
lea ecx, [ebp - 0x5084]
call fcn.0040d460
push 0
lea eax, [ebp - 0x5084]
push eax
lea ecx, [ebp - 0x403c]
call fcn.0046acd0
test al, al
je 0x43c536
lea eax, [ebp - 0x5084]
push eax
call fcn.00468f10
push 0
lea eax, [ebp - 0x5084]
push eax
lea ecx, [ebp - 0x403c]
call fcn.0046acd0
test al, al
jne 0x43c512
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x403c]
call fcn.0046ac10
push 0
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test edi, edi
je 0x43c585
lea eax, [ebp - 0x1010]
push eax
call fcn.00469360
test al, al
je 0x43c585
lea ecx, [ebp - 0x1010]
mov eax, ecx
sub edi, eax
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edi + ecx - 2], ax
test ax, ax
jne 0x43c575
xor esi, esi
jmp 0x43c590
push 0x800
lea eax, [ebp - 0x3010]
push eax
push dword [ebp + esi*4 - 0x3034]
lea eax, [ebp - 0x1010]
push eax
call fcn.004789f0
push 0x800
push str..lnk
lea eax, [ebp - 0x3010]
push eax
call fcn.0048e6d0
push 0x800
push dword [ebp + esi*4 - 0x3024]
lea eax, [ebp - 0x2010]
push eax
call fcn.00478fb0
lea eax, [ebp - 0x2010]
push eax
call fcn.00469360
test al, al
je 0x43c634
test bl, bl
je 0x43c601
lea eax, [ebp - 0x3010]
push eax
call fcn.00469360
test al, al
je 0x43c634
mov eax, esi
neg eax
push 0
sbb eax, eax
not eax
and eax, dword [ebp - 0x508c]
push eax
push 0x537
call fcn.00488530
push eax
push 0
lea eax, [ebp - 0x3010]
push eax
lea eax, [ebp - 0x2010]
push eax
push 1
call fcn.004c4630
inc esi
cmp esi, 4
jb 0x43c590
jmp 0x43c65d
lea eax, [ebp - 0x1010]
push eax
call fcn.0043a990
jmp 0x43c433
lea eax, [ebp - 0x1010]
push eax
call fcn.0043a990
xor esi, esi
nop
push dword [ebp + esi - 0x3024]
call fcn.004f252e
push dword [ebp + esi - 0x3034]
call fcn.004f252e
add esi, 4
add esp, 8
cmp esi, 0x10
jb 0x43c660
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ebbd8
mov esp, ebp
pop ebp
ret 0x10