Function at 0x423050
Capabilities:
Create directory
Delete file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb60
mov eax, dword [0x47a42c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xb58], eax
call fcn.00425d70
test ebx, ebx
mov eax, 0x45d894
cmovne eax, ebx
push eax
push str.ShowUserDialog
push str._ws__s_
call fcn.00420880
add esp, 0xc
test ebx, ebx
jne 0x4230a8
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a27
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0x100
lea eax, [ebp - 0xb40]
push 0
push eax
call fcn.0042b800
push 1
lea eax, [ebp - 0xb40]
push 0x40
push eax
call fcn.00415da0
add esp, 0x18
mov esi, eax
mov dword [ebp - 0xb5c], esi
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov edi, eax
mov dword [ebp - 0xb60], edi
cmp edi, 0xffffffff
jne 0x423115
test esi, esi
jne 0x423115
push str.ShowUserDialog
push str._ws____no_user_currently_logged_on_at_console
call fcn.00420880
add esp, 8
lea eax, [esi - 0xb]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a27
mov esp, ebp
pop ebp
ret
push edi
push str.ShowUserDialog
push str._ws____using_session__d
call fcn.00420880
add esp, 0xc
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0xb50]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x20a
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.0042b800
add esp, 0xc
lea eax, [ebp - 0x628]
push 0x104
push eax
lea eax, [ebp - 0xb50]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
cmp dword [0x479ba8], 0
je 0x423289
mov esi, 0x479bb0
nop dword [eax]
nop dword [eax + eax]
push 0x20a
lea eax, [ebp - 0x41c]
push 0
push eax
call fcn.0042b800
lea eax, [ebp - 0x628]
push eax
push str.__temp___s
lea eax, [ebp - 0x41c]
push 0x104
push eax
call fcn.00410d00
add esp, 0x1c
lea eax, [ebp - 0x41c]
push 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
call fcn.0043b2c1
push dword [esi - 4]
lea eax, [ebp - 0x628]
push eax
push str.__temp___s_s
lea eax, [ebp - 0x41c]
push 0x104
push eax
call fcn.00410d00
add esp, 0x18
lea eax, [ebp - 0x41c]
push 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
movzx eax, word [esi - 8]
push esi
push eax
push 0x17
call fcn.0041d9f0
mov edi, eax
add esp, 0xc
test edi, edi
jns 0x42326d
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.ShowUserDialog
push str._ws____ExtractResouceFile___returned__d__err_d__path_s
call fcn.00420880
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x423450
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.ShowUserDialog
push str._ws____failed_to_extract_file__it_is_being_used_by_another_process__skip_the_extract_and_continue_to_call_it
call fcn.00420880
add esp, 0x14
add esi, 0x214
cmp dword [esi - 8], 0
jne 0x423190
mov esi, dword [ebp - 0xb5c]
mov edi, dword [ebp - 0xb60]
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0042b800
cmp dword [0x47bc58], 0
mov ecx, str._s__a__s
push ebx
mov eax, str._s__a__s__u
cmove eax, ecx
push 0x479bb0
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00410d00
push 0
push dword [ebp - 0xb58]
lea eax, [ebp - 0xb54]
mov dword [ebp - 0xb54], 0
push eax
lea eax, [ebp - 0x210]
push eax
push edi
call fcn.004156b0
add esp, 0x34
mov ebx, eax
lea eax, [ebp - 0x210]
push eax
push edi
push dword [ebp - 0xb54]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.ShowUserDialog
push str._ws____CreateProcessInSession___returned__d__err_d__pid_d__session_d__cmd_s
call fcn.00420880
add esp, 0x1c
test ebx, ebx
jns 0x42338d
xor edi, edi
test esi, esi
je 0x42338d
nop word [eax + eax]
mov esi, dword [ebp + edi*4 - 0xb40]
lea eax, [ebp - 0xb54]
push 0
push dword [ebp - 0xb58]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.004156b0
add esp, 0x14
mov ebx, eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0xb54]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.ShowUserDialog
push str._ws____CreateProcessInSession___returned__d__err_d__pid_d__session_d__cmd_s
call fcn.00420880
add esp, 0x1c
test ebx, ebx
je 0x42338d
inc edi
cmp edi, dword [ebp - 0xb5c]
jb 0x423330
sar ebx, 0x1f
mov esi, 0x479ba8
and ebx, 0xffffff9c
cmp dword [0x479ba8], 0
je 0x4233ba
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esi + 0x214], 0
lea esi, [esi + 0x214]
jne 0x4233a1
push 0x20a
lea eax, [ebp - 0x834]
push 0
push eax
call fcn.0042b800
push 0x20a
lea eax, [ebp - 0xa40]
push 0
push eax
call fcn.0042b800
lea eax, [ebp - 0x628]
push eax
push str.__temp___s
push 0xffffffffffffffff
lea eax, [ebp - 0x834]
push 0x105
push eax
call fcn.00414570
add esp, 0x2c
lea eax, [ebp - 0xa40]
push 0x104
push eax
lea eax, [ebp - 0x834]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0xa40]
push eax
call fcn.0043d180
add esp, 4
push ebx
push str.ShowUserDialog
push str._ws____returned__d
call fcn.00420880
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, ebx
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00428a27
mov esp, ebp
pop ebp
ret
mov ebx, 0xfffffffc
jmp 0x42342a