Function at 0x401de0
Capabilities:
Create directory
Delete file
Enumerate files on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d1638
push 0x467578
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, 0x1570
call fcn.00467540
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x1588], esi
xor edi, edi
mov dword [ebp - 0x101c], edi
mov dword [ebp - 4], edi
lea eax, [esi + 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x402307
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x402307
mov ecx, esi
call fcn.00402360
lea ecx, [ebp - 0x1430]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov word [ebp - 0x1428], di
mov word [ebp - 0x1426], di
mov word [ebp - 0x1424], di
mov word [ebp - 0x1422], di
lea edx, [ebp - 0x1438]
push edx
lea eax, [ebp - 0x1430]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x4022f9
lea ebx, [esi + 0x414]
push ebx
lea ecx, [ebp - 0x1438]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
je 0x4022f9
mov edx, dword [ebx]
add edx, 0x2a69c000
mov eax, dword [ebx + 4]
adc eax, 0xc9
mov dword [esi + 0x41c], edx
mov dword [esi + 0x420], eax
mov ebx, dword [ebp + 0xc]
cmp ebx, edi
je 0x401f41
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x401efc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401efc
push 0xa3
mov ecx, dword [0x4df848]
push ecx
jmp 0x40231a
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + ebx - 1], 0x5c
lea edi, [esi + 4]
jne 0x401f27
mov edx, dword [ebp + 8]
push edx
push ebx
push 0x4df9b4
push 0x3ff
push edi
call fcn.00466ca7
add esp, 0x14
jmp 0x401f5b
mov eax, dword [ebp + 8]
push eax
push ebx
push 0x4df9ac
push 0x3ff
push edi
call fcn.00466ca7
add esp, 0x14
jmp 0x401f5b
lea edi, [esi + 4]
mov ecx, dword [ebp + 8]
push ecx
push 0x4df9a8
push 0x3ff
push edi
call fcn.00466ca7
add esp, 0x10
mov byte [ebp - 0x1021], 0
mov byte [ebp - 0x1420], 0
lea ebx, [esi + 0x440]
push ebx
mov edx, dword [ebp - 0x142a]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x142e]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x1430]
and ecx, 0xffff
push ecx
push edi
push str._s__04d_02d_02d._s
push 0x3ff
lea edx, [ebp - 0x1420]
push edx
call fcn.00466ca7
add esp, 0x20
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x1420]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x404], eax
cmp eax, 0xffffffff
jne 0x401feb
push 0xbc
mov ecx, dword [0x4df848]
push ecx
jmp 0x40231a
push ebx
push edi
push str._s_._s
push 0x3ff
lea edx, [ebp - 0x1420]
push edx
call fcn.00466ca7
add esp, 0x14
lea eax, [ebp - 0x1578]
push eax
lea ecx, [ebp - 0x1420]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
mov dword [ebp - 0x1020], ebx
cmp ebx, 0xffffffff
jne 0x402038
push 0xc5
mov edx, dword [0x4df848]
push edx
jmp 0x40231a
lea eax, [ebp - 0x1584]
push eax
lea ecx, [ebp - 0x154c]
push ecx
call fcn.00402ab0
add esp, 8
mov edx, dword [esi + 0x410]
inc edx
push 0xc9
push 0x2a69c000
push 0
push edx
call fcn.00467650
mov edi, dword [esi + 0x414]
sub edi, dword [ebp - 0x1584]
mov ecx, dword [esi + 0x418]
sbb ecx, dword [ebp - 0x1580]
cmp ecx, edx
jb 0x402126
ja 0x402091
cmp edi, eax
jb 0x402126
lea eax, [ebp - 0x1438]
push eax
lea ecx, [ebp - 0x1584]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x402126
lea edx, [ebp - 0x1430]
push edx
lea eax, [ebp - 0x1438]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x402126
mov byte [ebp - 0x1021], 0
mov byte [ebp - 0x1420], 0
lea ecx, [esi + 0x440]
push ecx
mov edx, dword [ebp - 0x142a]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x142e]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x1430]
and ecx, 0xffff
push ecx
lea edx, [esi + 4]
push edx
push str._s__04d_02d_02d._s
push 0x3ff
lea eax, [ebp - 0x1420]
push eax
call fcn.00466ca7
add esp, 0x20
lea ecx, [ebp - 0x1420]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x1578]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
je 0x402038
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 2
push 0
push 0
mov eax, dword [esi + 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40216d
push 0xdc
mov ecx, dword [0x4df848]
push ecx
jmp 0x40231a
mov byte [ebp - 0x19], 0
mov byte [ebp - 0x1018], 0
lea edx, [ebp - 0x1430]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [str._r_n]
push eax
push 0x4df9a8
push 0xfff
lea ecx, [ebp - 0x1018]
push ecx
call fcn.00466ca7
add esp, 0x10
mov dword [ebp - 0x157c], eax
push 0
lea edx, [ebp - 0x157c]
push edx
push eax
lea eax, [ebp - 0x1018]
push eax
mov ecx, dword [esi + 0x404]
push ecx
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
call edi
test eax, eax
jne 0x4021df
push 0xec
mov edx, dword [0x4df848]
push edx
jmp 0x40231a
mov eax, dword [str.AgentFileLog]
push eax
mov ecx, dword [ebp - 0x1422]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x1424]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x1426]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x1428]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x142a]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x142e]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x1430]
and ecx, 0xffff
push ecx
push str._04d__02d__02d__02d:_02d:_02d._03d:__s
push 0xfff
lea edx, [ebp - 0x1018]
push edx
call fcn.00466ca7
add esp, 0x2c
mov dword [ebp - 0x157c], eax
push 0
lea ecx, [ebp - 0x157c]
push ecx
push eax
lea edx, [ebp - 0x1018]
push edx
mov eax, dword [esi + 0x404]
push eax
call edi
test eax, eax
jne 0x40228c
push 0xf9
mov ecx, dword [0x4df848]
push ecx
jmp 0x40231a
mov edx, dword [str._r_n]
push edx
push 0x4df9a8
push 0xfff
lea eax, [ebp - 0x1018]
push eax
call fcn.00466ca7
add esp, 0x10
mov dword [ebp - 0x157c], eax
push 0
lea ecx, [ebp - 0x157c]
push ecx
push eax
lea edx, [ebp - 0x1018]
push edx
mov eax, dword [esi + 0x404]
push eax
call edi
test eax, eax
jne 0x4022de
push 0x105
mov ecx, dword [0x4df848]
push ecx
jmp 0x40231a
mov byte [esi + 0x408], 1
mov dword [ebp - 0x101c], 1
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x402321
push 0x99
mov edx, dword [0x4df848]
push edx
jmp 0x40231a
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x8a
mov eax, dword [0x4df848]
push eax
mov ecx, esi
call fcn.004029b0
mov dword [ebp - 4], 0xffffffff
call fcn.0040234c
mov eax, dword [ebp - 0x101c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8