Function at 0x401c30
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe94
mov eax, dword [0x417020]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.004070e0
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
push 0
push 0
push 0x8026
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x401c88
mov eax, 1
jmp 0x40231d
xor eax, eax
mov word [ebp - 0x628], ax
push 0x206
push 0
lea ecx, [ebp - 0x626]
push ecx
call fcn.004070e0
add esp, 0xc
lea edx, [ebp - 0x628]
push edx
push 0
push 0x41563c
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [ebp - 0x628]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x103
lea edx, [ebp - 0x628]
push edx
lea eax, [ebp - 0x418]
push eax
call fcn.00406315
add esp, 0xc
push 0
lea ecx, [ebp - 0x418]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea edx, [ebp - 0x628]
push edx
push 0
push 0x415644
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [ebp - 0x628]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str..exe
lea edx, [ebp - 0x628]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004070e0
add esp, 0xc
push 0x103
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.00406315
add esp, 0xc
push str.log.dll
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x3e8
lea edx, [ebp - 0x628]
push edx
call fcn.004017d0
add esp, 8
test eax, eax
je 0x401db1
push 0x3e9
lea eax, [ebp - 0x210]
push eax
call fcn.004017d0
add esp, 8
test eax, eax
jne 0x401de4
lea ecx, [ebp - 0x628]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x418]
push eax
call fcn.00401c00
add esp, 4
mov eax, 2
jmp 0x40231d
xor ecx, ecx
mov word [ebp - 0x830], cx
push 0x206
push 0
lea edx, [ebp - 0x82e]
push edx
call fcn.004070e0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x830]
push ecx
call fcn.00406315
add esp, 0xc
push str..ini
lea edx, [ebp - 0x830]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
xor eax, eax
mov word [ebp - 0xa38], ax
push 0x206
push 0
lea ecx, [ebp - 0xa36]
push ecx
call fcn.004070e0
add esp, 0xc
push 0x104
lea edx, [ebp - 0xa38]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x415678
lea eax, [ebp - 0x830]
push eax
call fcn.004061bc
add esp, 8
mov dword [ebp - 0xa3c], eax
cmp dword [ebp - 0xa3c], 0
je 0x401f02
mov dword [ebp - 0xe78], str._domain__r_ndefault06:00_13:00_r_n_12:00_00:00_pcfaster.baidu.com_r_n00:00_06:00_pcfaster.baidu.com.eg_r_n06:00_13:00security.baidu.co.th_r_n_r_n_global__r_nVERSION_INFO_URLhttp:__download._domain___snewver_s.xml_r_nFULL_PACKAGE_URLhttp:__download._domain___sWiFiHotspot_Setup_s.exe_r_nPROMOTION_POLICY_FILE_URLhttp:__download._domain___sPromotionPolicy_s.dll_r_n_r_n_DataReport__r_nReportURLMinihttp:__sync._domain__cgi_bin_py_mini_install_statistic_info.cgi_r_nNewReportURLhttp:__sync._domain__cgi_bin_py_wifi_behavior_report.cgi_r_nUUReporthttp:__sync._domain__cgi_bin_py_wifi_report.cgi_r_n_r_n_params__r_nProductNameBaidu_WiFi_Hotspot_r_nRegistryKeySOFTWAREBaidu_WiFiHotspot_r_nInstallDirBaidu_WiFiHotspot_r_nLICENCE_URL_r_nPRIVACY_URL_r_nSHELL_PACK_BGLINK_URL_r_nS2S_REPORT_URL_r_nPIXEL_THANK_PAGE_URL_r_nINSTALL_LP_URL_r_nSubDirwifi_r_nChannelNamewebglofficialdirect_r_nChannelNumberGL_r_nSilent0_r_nNoTray0_r_n
mov ecx, dword [ebp - 0xe78]
add ecx, 2
mov dword [ebp - 0xe7c], ecx
mov edx, dword [ebp - 0xe78]
mov ax, word [edx]
mov word [ebp - 0xe7e], ax
add dword [ebp - 0xe78], 2
cmp word [ebp - 0xe7e], 0
jne 0x401e9f
mov ecx, dword [ebp - 0xe78]
sub ecx, dword [ebp - 0xe7c]
sar ecx, 1
mov dword [ebp - 0xe84], ecx
mov edx, dword [ebp - 0xa3c]
push edx
mov eax, dword [ebp - 0xe84]
shl eax, 1
push eax
push 1
push str._domain__r_ndefault06:00_13:00_r_n_12:00_00:00_pcfaster.baidu.com_r_n00:00_06:00_pcfaster.baidu.com.eg_r_n06:00_13:00security.baidu.co.th_r_n_r_n_global__r_nVERSION_INFO_URLhttp:__download._domain___snewver_s.xml_r_nFULL_PACKAGE_URLhttp:__download._domain___sWiFiHotspot_Setup_s.exe_r_nPROMOTION_POLICY_FILE_URLhttp:__download._domain___sPromotionPolicy_s.dll_r_n_r_n_DataReport__r_nReportURLMinihttp:__sync._domain__cgi_bin_py_mini_install_statistic_info.cgi_r_nNewReportURLhttp:__sync._domain__cgi_bin_py_wifi_behavior_report.cgi_r_nUUReporthttp:__sync._domain__cgi_bin_py_wifi_report.cgi_r_n_r_n_params__r_nProductNameBaidu_WiFi_Hotspot_r_nRegistryKeySOFTWAREBaidu_WiFiHotspot_r_nInstallDirBaidu_WiFiHotspot_r_nLICENCE_URL_r_nPRIVACY_URL_r_nSHELL_PACK_BGLINK_URL_r_nS2S_REPORT_URL_r_nPIXEL_THANK_PAGE_URL_r_nINSTALL_LP_URL_r_nSubDirwifi_r_nChannelNamewebglofficialdirect_r_nChannelNumberGL_r_nSilent0_r_nNoTray0_r_n
call fcn.0040676b
add esp, 0x10
mov ecx, dword [ebp - 0xa3c]
push ecx
call fcn.0040699a
add esp, 4
lea edx, [ebp - 0x830]
push edx
lea eax, [ebp - 0xa38]
push eax
push str.mini_path
push 0x415694
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x830]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push str.mini_command_line
push str.params
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x420]
call fcn.00402350
lea ecx, [ebp - 0x420]
call fcn.004024d0
lea ecx, [ebp - 0x420]
call fcn.00402610
test eax, eax
je 0x401f74
push 0x4156d8
lea ecx, [ebp - 0x420]
call fcn.00402430
push 0x4156dc
lea ecx, [ebp - 0x420]
call fcn.00402430
lea ecx, [ebp - 0x830]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x420]
call fcn.00402430
mov dword [ebp - 4], 0
mov dword [ebp - 0x41c], 0
lea edx, [ebp - 0x41c]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xa38]
push ecx
call fcn.00401760
add esp, 0xc
test eax, eax
je 0x402007
cmp dword [ebp - 4], 0x300000
jbe 0x402007
push str.__FullInstallSrc_
lea ecx, [ebp - 0x420]
call fcn.00402430
lea edx, [ebp - 0xa38]
push edx
lea ecx, [ebp - 0x420]
call fcn.00402430
push 0x415718
lea ecx, [ebp - 0x420]
call fcn.00402430
push 0x41571c
lea ecx, [ebp - 0x420]
call fcn.00402430
push 0x415748
lea ecx, [ebp - 0x420]
call fcn.00402430
lea ecx, [ebp - 0xc54]
call fcn.00402330
xor eax, eax
mov word [ebp - 0xc50], ax
push 0x208
push 0
lea ecx, [ebp - 0xc4e]
push ecx
call fcn.004070e0
add esp, 0xc
push 0x104
lea edx, [ebp - 0xc50]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0xc5c], 0
mov dword [ebp - 0xc58], 0
push 0x5f
lea eax, [ebp - 0xc50]
push eax
call fcn.00401000
add esp, 8
mov dword [ebp - 0xc5c], eax
push 0x2e
lea ecx, [ebp - 0xc50]
push ecx
call fcn.00401000
add esp, 8
mov dword [ebp - 0xc58], eax
cmp dword [ebp - 0xc5c], 0
je 0x4020ec
cmp dword [ebp - 0xc58], 0
je 0x4020ec
mov edx, dword [ebp - 0xc58]
sub edx, dword [ebp - 0xc5c]
sar edx, 1
cmp edx, 1
jl 0x4020ec
xor eax, eax
mov ecx, dword [ebp - 0xc58]
mov word [ecx], ax
mov edx, dword [ebp - 0xc5c]
add edx, 2
push edx
lea ecx, [ebp - 0xc54]
call fcn.004023f0
push 0
push 0x415830
lea ecx, [ebp - 0xc54]
call fcn.00402450
test eax, eax
jl 0x40210d
lea ecx, [ebp - 0xc54]
call fcn.00402540
push str.___sid
lea ecx, [ebp - 0x420]
call fcn.00402430
lea eax, [ebp - 0xc54]
push eax
lea ecx, [ebp - 0x420]
call fcn.00402410
push 0x415854
lea ecx, [ebp - 0x420]
call fcn.00402430
lea ecx, [ebp - 0xc54]
call fcn.004023d0
xor ecx, ecx
mov word [ebp - 0xe70], cx
push 0x208
push 0
lea edx, [ebp - 0xe6e]
push edx
call fcn.004070e0
add esp, 0xc
push 0x104
lea eax, [ebp - 0xe70]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0xe70]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push 0x415858
lea edx, [ebp - 0xe70]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov dword [ebp - 0xc60], eax
cmp dword [ebp - 0xc60], 0
je 0x402244
mov dword [ebp - 0xe88], str.LPDirect_
mov eax, dword [ebp - 0xe88]
add eax, 2
mov dword [ebp - 0xe8c], eax
mov ecx, dword [ebp - 0xe88]
mov dx, word [ecx]
mov word [ebp - 0xe8e], dx
add dword [ebp - 0xe88], 2
cmp word [ebp - 0xe8e], 0
jne 0x4021c8
mov eax, dword [ebp - 0xe88]
sub eax, dword [ebp - 0xe8c]
sar eax, 1
mov dword [ebp - 0xe94], eax
mov ecx, dword [ebp - 0xe94]
mov edx, dword [ebp - 0xc60]
lea eax, [edx + ecx*2]
mov dword [ebp - 0xc60], eax
push str.___LPDirect
lea ecx, [ebp - 0x420]
call fcn.00402430
mov ecx, dword [ebp - 0xc60]
push ecx
lea ecx, [ebp - 0x420]
call fcn.00402430
push 0x41589c
lea ecx, [ebp - 0x420]
call fcn.00402430
push 1
push 1
push 0
push 1
lea ecx, [ebp - 0x420]
call fcn.00402530
push eax
lea edx, [ebp - 0x628]
push edx
call fcn.004015c0
add esp, 0x18
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [ebp - 0x830]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4022c1
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4022c1
lea edx, [ebp - 0x830]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4022f3
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [ebp - 0x830]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x418]
push eax
call fcn.00401c00
add esp, 4
mov dword [ebp - 0xe74], 0
lea ecx, [ebp - 0x420]
call fcn.004023d0
mov eax, dword [ebp - 0xe74]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004060e7
mov esp, ebp
pop ebp
ret 0x10