Function at 0x111d2f0
Capabilities:
Access peb ldr_data
Check if file exists
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11461ce
mov eax, dword fs:[0]
push eax
sub esp, 0x350
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x33c], esi
mov eax, dword [0x1161d94]
mov edx, dword [eax + 0xc]
xor ebx, ebx
mov ecx, 0x1161d94
mov dword [ebp - 4], ebx
mov dword [ebp - 0x32c], ebx
mov dword [ebp - 0x334], ebx
mov dword [ebp - 0x338], ebx
call edx
add eax, 0x10
mov dword [ebp - 0x330], eax
push ebx
push 0x1064a6c
lea eax, [ebp - 0x32c]
push eax
push 0x10649f0
lea ecx, [ebp - 0x328]
push 2
push ecx
mov byte [ebp - 4], 1
call fcn.01075110
add esp, 0x18
lea edx, [ebp + 8]
add esi, 0x30
push edx
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0109c210
call fcn.01127f00
test al, al
je 0x111d3ae
mov eax, dword [esi]
push eax
push 0x10649c4
push 0x1064948
push 3
call fcn.01128b70
add esp, 0x10
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x111d4bd
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x111d4bd
push 0x20c
lea ecx, [ebp - 0x21c]
push ebx
push ecx
call fcn.01084910
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
lea edx, [ecx + ecx]
add esp, 0xc
cmp edx, 0x104
jae 0x111d3f9
add ecx, ecx
jmp 0x111d3fe
mov ecx, 0x104
push ecx
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.01086710
xor eax, eax
add esp, 0xc
lea edx, [ebp - 0x35c]
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x358], eax
mov dword [ebp - 0x354], eax
mov dword [ebp - 0x34c], eax
push edx
mov dword [ebp - 0x35c], eax
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x344], eax
mov word [ebp - 0x340], ax
mov dword [ebp - 0x358], 3
mov dword [ebp - 0x354], ecx
mov word [ebp - 0x34c], 0x14
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp eax, ebx
je 0x111d484
jle 0x111d47e
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], ebx
jge 0x111d4bd
call fcn.01127f00
test al, al
je 0x111d4b2
mov eax, dword [ebp - 0x32c]
mov ecx, dword [esi]
push eax
push ecx
push 0x10648d0
push 0x1064850
push ebx
call fcn.01128b70
add esp, 0x14
mov dword [ebp - 0x32c], ebx
jmp 0x111d61f
push esi
lea ecx, [ebp - 0x330]
call fcn.0109c210
mov edi, dword [ebp - 0x330]
push 0x5c
push edi
call fcn.01084ad7
add esp, 8
cmp eax, ebx
je 0x111d4e4
sub eax, edi
sar eax, 1
jns 0x111d4f3
mov dword [ebp - 0x32c], 0x8004825a
jmp 0x111d61f
push eax
lea ecx, [ebp - 0x330]
call fcn.0109bff0
mov eax, dword [esi]
mov edx, dword [ebp - 0x330]
push ebx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
cmp eax, ebx
jne 0x111d565
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x111d524
call edi
jmp 0x111d530
call edi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x32c], eax
call fcn.01127f00
test al, al
je 0x111d61f
mov eax, dword [ebp - 0x32c]
mov ecx, dword [esi]
push eax
push ecx
push 0x10647e8
push 0x1064768
push ebx
call fcn.01128b70
add esp, 0x14
jmp 0x111d61f
lea edx, [ebp - 0x338]
push edx
lea eax, [ebp - 0x334]
push eax
push 0x1064750
call fcn.011308e0
cmp eax, ebx
mov dword [ebp - 0x32c], eax
jge 0x111d5b0
call fcn.01127f00
test al, al
je 0x111d61f
mov ecx, dword [ebp - 0x32c]
push ecx
push 0x10646f8
push 0x1064678
push ebx
call fcn.01128b70
add esp, 0x10
jmp 0x111d61f
mov eax, dword [esi]
mov edx, dword [ebp - 0x334]
push ebx
push eax
push edx
call fcn.0112dba0
cmp eax, ebx
mov dword [ebp - 0x32c], eax
jge 0x111d5f2
call fcn.01127f00
test al, al
je 0x111d61f
mov eax, dword [ebp - 0x32c]
mov ecx, dword [esi]
push eax
push ecx
push 0x1064628
push 0x10645a8
push ebx
call fcn.01128b70
add esp, 0x14
jmp 0x111d61f
call fcn.01127f00
test al, al
je 0x111d612
mov edx, dword [esi]
push edx
push 0x1064558
push 0x10644d8
push 3
call fcn.01128b70
add esp, 0x10
mov eax, dword [ebp - 0x33c]
mov dword [eax + 0x44], 1
mov eax, dword [ebp - 0x334]
cmp eax, ebx
je 0x111d630
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov esi, dword [ebp - 0x32c]
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 1
call fcn.01075230
mov eax, dword [ebp - 0x330]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x111d66a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x111d690
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 4