Function at 0x4025af
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x8078]
mov eax, 0x8078
call fcn.0040a9a0
push 0xffffffffffffffff
push 0x41fa4b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x42b7a4]
xor eax, ebp
mov dword [ebp + 0x8074], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x8084]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x808c]
mov dword [ebp - 0x14], eax
call fcn.00408e74
test al, al
je 0x402cbe
mov esi, 0x800
lea eax, [ebp + 0x6074]
push esi
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push str.WinRAR.exe
lea eax, [ebp + 0x6074]
push eax
call fcn.00405c32
call fcn.004055ca
cmp eax, 0x600
push 0x10
sbb al, al
inc al
mov byte [ebp - 0xe], al
xor eax, eax
mov word [ebp + 0x3070], ax
mov word [ebp + 0x4070], ax
lea eax, [ebp + 0x4070]
push esi
push eax
call fcn.004015ba
mov edi, str.WinRAR.lnk
test al, al
je 0x40267d
push esi
lea eax, [ebp + 0x4070]
push eax
push edi
push eax
call fcn.00405b09
jmp 0x402686
cmp byte [ebp - 0xe], bl
je 0x402cbe
push 0x19
push esi
lea eax, [ebp + 0x3070]
push eax
call fcn.004015ba
push esi
lea eax, [ebp + 0x3070]
push eax
push edi
push eax
call fcn.00405b09
cmp word [ebp + 0x4070], bx
je 0x4026c9
lea eax, [ebp + 0x4070]
push eax
call fcn.00404576
test al, al
je 0x4026c9
mov byte [ebp - 0xd], 1
lea esi, [ebp + 0x4070]
jmp 0x4026d2
mov byte [ebp - 0xd], bl
lea esi, [ebp + 0x3070]
mov edi, dword [ebp + 0x8080]
cmp byte [edi + 0x14], bl
je 0x40276c
cmp byte [ebp + 0x8090], bl
je 0x4026f3
push esi
call fcn.00404576
test al, al
je 0x402772
push ebx
push dword [ebp - 0x14]
push 0x13fb
call fcn.0040733d
push eax
push ebx
push esi
lea eax, [ebp + 0x6074]
push eax
push 1
call fcn.004091ea
test al, al
jne 0x402772
cmp byte [ebp + 0x8090], bl
je 0x402772
cmp byte [ebp - 0xd], bl
jne 0x402772
lea eax, [ebp + 0x3070]
push eax
call fcn.00404576
test al, al
je 0x402744
lea eax, [ebp + 0x3070]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x402772
mov esi, dword [ebp - 0x14]
push ebx
push esi
push 0x13fb
call fcn.0040733d
push eax
push ebx
lea eax, [ebp + 0x4070]
push eax
lea eax, [ebp + 0x6074]
push eax
push 1
call fcn.004091ea
jmp 0x402775
push esi
call fcn.00404510
mov esi, dword [ebp - 0x14]
xor eax, eax
push 0x10
mov word [ebp + 0x2070], ax
lea eax, [ebp + 0x2070]
push 0x800
push eax
call fcn.004015ba
xor eax, eax
cmp byte [ebp - 0xe], al
sete al
dec eax
and eax, 0xb
add eax, 0xb
push eax
push 0x800
lea eax, [ebp + 0x7074]
push eax
call fcn.004015ba
push 0x800
lea eax, [ebp + 0x7074]
push eax
call fcn.00405676
push 0x800
push str.WinRAR.lnk
lea eax, [ebp + 0x7074]
push eax
call fcn.00407829
cmp byte [edi + 0x15], bl
je 0x402821
cmp byte [ebp + 0x8090], bl
je 0x4027f6
lea eax, [ebp + 0x7074]
push eax
call fcn.00404576
test al, al
je 0x40282d
push ebx
push esi
push 0x13fb
call fcn.0040733d
push eax
lea eax, [ebp + 0x2070]
push eax
lea eax, [ebp + 0x7074]
push eax
lea eax, [ebp + 0x6074]
push eax
push 1
call fcn.004091ea
jmp 0x40282d
lea eax, [ebp + 0x7074]
push eax
call fcn.00404510
push str.WinRAR.exe
call fcn.00412d6a
mov dword [ebp + 0x2060], eax
mov dword [esp], str.WinRAR.chm
call fcn.00412d6a
mov dword [ebp + 0x2064], eax
mov dword [esp], str.Rar.txt
call fcn.00412d6a
mov dword [ebp + 0x2068], eax
mov dword [esp], 0x13f1
call fcn.0040733d
push eax
call fcn.00412d6a
mov dword [ebp + 0x206c], eax
mov dword [esp], 0x420984
call fcn.00412d6a
mov dword [ebp + 0x2050], eax
mov dword [esp], 0x13ee
call fcn.0040733d
push eax
call fcn.00412d6a
mov dword [ebp + 0x2054], eax
mov dword [esp], 0x13ef
call fcn.0040733d
push eax
call fcn.00412d6a
mov dword [ebp + 0x2058], eax
mov dword [esp], 0x13f0
call fcn.0040733d
push eax
call fcn.00412d6a
pop ecx
push 2
mov dword [ebp + 0x205c], eax
mov esi, 0x800
push esi
lea eax, [ebp + 0x7074]
push eax
call fcn.004015ba
push esi
lea eax, [ebp + 0x7074]
push eax
call fcn.00405676
push esi
push 0x420984
lea eax, [ebp + 0x7074]
push eax
call fcn.00407829
cmp byte [ebp + 0x8090], bl
je 0x402923
lea eax, [ebp + 0x7074]
push eax
call fcn.00404576
test al, al
je 0x402ab4
cmp byte [edi + 0x16], bl
je 0x402aa8
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x402946
push dword [ebp + 0x8088]
lea ecx, [ebp + 0x7074]
push ecx
push eax
call fcn.00407851
cmp byte [ebp + 0x8090], bl
jne 0x4029e3
lea eax, [ebp + 0x7074]
push eax
call fcn.00404576
test al, al
je 0x4029d5
push 0x802
lea eax, [ebp + 0x5070]
push eax
push 0x4210c8
lea eax, [ebp + 0x7074]
push eax
call fcn.00405b09
lea ecx, [ebp + 0x1048]
call fcn.00404ef3
mov dword [ebp - 4], ebx
lea eax, [ebp + 0x5070]
push eax
lea ecx, [ebp + 0x1048]
call fcn.00405060
lea ecx, [ebp]
call fcn.0040124f
jmp 0x4029b2
lea eax, [ebp]
push eax
call fcn.00404510
push ebx
lea eax, [ebp]
push eax
lea ecx, [ebp + 0x1048]
call fcn.00404fb3
test al, al
jne 0x4029a9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x1048]
call fcn.00404f09
push ebx
lea eax, [ebp + 0x7074]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, dword [ebp - 0x14]
mov esi, ebx
push 0x800
lea eax, [ebp + 0x5074]
push eax
push dword [ebp + esi*4 + 0x2050]
lea eax, [ebp + 0x7074]
push eax
call fcn.00405b09
push 0x800
push 0x4210cc
lea eax, [ebp + 0x5074]
push eax
call fcn.00407829
push 0x800
push dword [ebp + esi*4 + 0x2060]
lea eax, [ebp + 0x6074]
push eax
call fcn.00405c32
lea eax, [ebp + 0x6074]
push eax
call fcn.00404576
test al, al
je 0x402a91
cmp byte [ebp + 0x8090], 0
je 0x402a5e
lea eax, [ebp + 0x5074]
push eax
call fcn.00404576
test al, al
je 0x402a91
mov eax, esi
neg eax
push ebx
sbb eax, eax
not eax
and eax, edi
push eax
push 0x13fb
call fcn.0040733d
push eax
lea eax, [ebp + 0x2070]
push eax
lea eax, [ebp + 0x5074]
push eax
lea eax, [ebp + 0x6074]
push eax
push 1
call fcn.004091ea
inc esi
cmp esi, 4
jb 0x4029e8
mov edi, dword [ebp + 0x8080]
mov esi, 0x800
jmp 0x402ab4
lea eax, [ebp + 0x7074]
push eax
call fcn.004014da
push 0x17
push esi
lea eax, [ebp + 0x7074]
push eax
call fcn.004015ba
test al, al
je 0x402c9c
push esi
lea eax, [ebp + 0x7074]
push eax
call fcn.00405676
push esi
push 0x420984
lea eax, [ebp + 0x7074]
push eax
call fcn.00407829
mov al, byte [ebp + 0x8090]
test al, al
je 0x402b0e
lea eax, [ebp + 0x7074]
push eax
call fcn.00404576
test al, al
je 0x402c9c
mov al, byte [ebp + 0x8090]
cmp byte [edi + 0x16], 0
je 0x402c90
test al, al
jne 0x402bb5
lea eax, [ebp + 0x7074]
push eax
call fcn.00404576
test al, al
je 0x402ba7
push 0x802
lea eax, [ebp + 0x5070]
push eax
push 0x4210c8
lea eax, [ebp + 0x7074]
push eax
call fcn.00405b09
lea ecx, [ebp + 0x1048]
call fcn.00404ef3
mov dword [ebp - 4], 1
lea eax, [ebp + 0x5070]
push eax
lea ecx, [ebp + 0x1048]
call fcn.00405060
lea ecx, [ebp]
call fcn.0040124f
jmp 0x402b84
lea eax, [ebp]
push eax
call fcn.00404510
push ebx
lea eax, [ebp]
push eax
lea ecx, [ebp + 0x1048]
call fcn.00404fb3
test al, al
jne 0x402b7b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x1048]
call fcn.00404f09
push ebx
lea eax, [ebp + 0x7074]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x402bdf
lea eax, [ebp + 0x7074]
push eax
call fcn.00404576
test al, al
je 0x402bdf
push dword [ebp + 0x8088]
lea eax, [ebp + 0x7074]
push eax
push esi
call fcn.00407851
mov esi, ebx
mov edi, 0x800
push edi
lea eax, [ebp + 0x5074]
push eax
push dword [ebp + esi*4 + 0x2050]
lea eax, [ebp + 0x7074]
push eax
call fcn.00405b09
push edi
push 0x4210cc
lea eax, [ebp + 0x5074]
push eax
call fcn.00407829
push edi
push dword [ebp + esi*4 + 0x2060]
lea eax, [ebp + 0x6074]
push eax
call fcn.00405c32
lea eax, [ebp + 0x6074]
push eax
call fcn.00404576
test al, al
je 0x402c84
cmp byte [ebp + 0x8090], 0
je 0x402c50
lea eax, [ebp + 0x5074]
push eax
call fcn.00404576
test al, al
je 0x402c84
mov eax, esi
neg eax
push ebx
sbb eax, eax
not eax
and eax, dword [ebp - 0x14]
push eax
push 0x13fb
call fcn.0040733d
push eax
lea eax, [ebp + 0x2070]
push eax
lea eax, [ebp + 0x5074]
push eax
lea eax, [ebp + 0x6074]
push eax
push 1
call fcn.004091ea
inc esi
cmp esi, 4
jb 0x402be6
jmp 0x402c9c
lea eax, [ebp + 0x7074]
push eax
call fcn.004014da
push dword [ebp + ebx + 0x2060]
call fcn.0040e343
push dword [ebp + ebx + 0x2050]
call fcn.0040e343
add ebx, 4
pop ecx
pop ecx
cmp ebx, 0x10
jb 0x402c9c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8074]
xor ecx, ebp
call fcn.0040a986
add ebp, 0x8078
leave
ret 0x14