Function at 0x1002e090
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get disk information
Get file attributes
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x26c8
call fcn.10044de0
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov eax, dword [eax + 0x318]
or ebx, 0xffffffff
mov dword [ebp - 0x14], 0x2000
mov dword [ebp - 0x10], edi
cmp eax, edi
je 0x1002e0cb
push esi
call eax
cmp eax, ebx
jne 0x1002e0d6
mov ecx, dword [esi]
cmp byte [ecx + 0x34c], 0xff
je 0x1002e0e6
call fcn.10030ea0
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
movzx eax, byte [ebp + 0xc]
dec eax
cmp eax, 9
ja case.0x1002e0f4.2
jmp dword [eax*4 + 0x1002e830]
movzx eax, byte [ebp + 0x10]
dec eax
je 0x1002e1d0
dec eax
jne case.0x1002e0f4.2
lea ecx, [ebp - 0x2ac]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea ecx, [eax - 3]
mov dword [ebp + 0x10], eax
cmp ecx, edi
jbe 0x1002e1af
lea ebx, [ebp - 0x18]
lea edx, [ebp - 0x2ac]
sub ebx, edx
jmp 0x1002e140
mov edi, dword [ebp - 0x10]
lea eax, [ebp + edi - 0x2ac]
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x1002e150
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x1002e16c
jmp dword [eax*4 + 0x1002e858]
mov byte [ebp + edi - 0x2aa], 0x6c
jmp case.default.0x1002e16c
mov byte [ebp + edi - 0x2aa], 0x66
jmp case.default.0x1002e16c
mov byte [ebp + edi - 0x2aa], 0x63
jmp case.default.0x1002e16c
mov byte [ebp + edi - 0x2aa], 0x6e
mov eax, dword [ebp + 0x10]
add edi, 4
add eax, 0xfffffffd
sub ebx, 4
mov dword [ebp - 0x10], edi
cmp edi, eax
jb 0x1002e140
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x2ac]
push ecx
push 3
mov edi, eax
push esi
xor eax, eax
mov cl, 2
call fcn.1002d970
movsx eax, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edx, dword [ebp + 0x18]
push edx
mov eax, esi
call fcn.1002ddd0
mov ebx, eax
cmp ebx, edi
je 0x1002e0db
mov eax, dword [ebp + 0x18]
push ebx
push eax
push esi
call fcn.1002da50
movsx ecx, al
mov dword [ebp - 8], ecx
push ebx
call dword [sym.imp.MSVCRT.dll_free]
mov al, byte [ebp - 8]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [ebp + 0x18]
push edx
mov eax, esi
call fcn.1002ddd0
mov ebx, eax
test ebx, ebx
je 0x1002e0db
lea edx, [ebp - 0x164]
sub edx, ebx
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1002e231
lea eax, [ebp - 0x164]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002e244
sub eax, edx
inc eax
push eax
lea ecx, [ebp - 0x5bc]
push ecx
push eax
lea edx, [ebp - 0x164]
push edx
push 0
push 0x4e3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x5bc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x7624], eax
cmp eax, 0xffffffff
je 0x1002e385
lea ecx, [ebp - 0x5c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1002e36e
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx ecx, word [ebp - 0x1e]
movzx edx, word [ebp - 0x20]
movzx eax, word [ebp - 0x28]
push ecx
movzx ecx, word [ebp - 0x22]
push edx
movzx edx, word [ebp - 0x26]
push eax
push ecx
push edx
lea eax, [ebp - 0x1a4]
push str._02d__02d__04d__02d:_02d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x1a4]
add esp, 0x1c
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002e2f0
mov ecx, dword [ebp + 0x18]
sub eax, edx
lea edx, [eax + ecx + 2]
push edx
push ebx
call dword [sym.imp.MSVCRT.dll_realloc]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1002e0db
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1002e318
mov ax, word [0x1004aaa0]
mov word [edi], ax
lea eax, [ebp - 0x1a4]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002e331
sub eax, esi
lea edi, [ebx - 1]
lea ecx, [ecx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1002e340
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, ebx
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
jmp 0x1002e360
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002e360
sub eax, edx
mov dword [ebp + 0x18], eax
jmp 0x1002e385
mov ecx, dword [esi + 0x7624]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x7624], 0xffffffff
mov eax, dword [ebp + 8]
xor edx, edx
cmp dword [ebp + 0x14], 1
sete dl
cmp dword [eax + 0x7624], 0xffffffff
mov dword [eax + 0x7628], edx
jne 0x1002e3a5
or eax, 0xffffffff
jmp 0x1002e3a8
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x18]
push ebx
push 0
push esi
mov cl, 4
call fcn.1002d970
cmp dword [esi + 0x7624], 0xffffffff
movsx eax, al
mov dword [ebp - 8], eax
je 0x1002e1fe
mov eax, dword [ebp - 0x38]
mov dword [esi + 0x762c], eax
shr eax, 0xd
mov dword [esi + 0x7630], eax
xor eax, eax
push 4
lea ecx, [ebp - 0xc]
mov dword [esi + 0x7634], eax
mov dword [esi + 0x7638], eax
mov dword [ebp - 0xc], eax
push ecx
mov eax, esi
call fcn.10031170
test eax, eax
jns 0x1002e56e
call fcn.10030ea0
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp dword [ebp + 0x14], ebx
jne 0x1002e441
mov edx, dword [esi + 0x7624]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x7624], ebx
or al, 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, esi
mov dword [esi + 0x7638], 1
call fcn.1002de60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x18]
push eax
mov eax, esi
call fcn.1002ddd0
mov ebx, eax
test ebx, ebx
je 0x1002e0db
mov cl, byte [ebx]
test cl, cl
je 0x1002e485
cmp cl, 0x2c
je 0x1002e485
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1002e476
jmp 0x1002e497
cmp byte [eax], 0
je 0x1002e497
mov byte [eax], 0
inc eax
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002e490
push 4
lea ecx, [ebp - 0xc]
push ecx
mov eax, esi
call fcn.100310b0
test eax, eax
jle 0x1002e404
cmp byte [0x1004e05d], 0
je 0x1002e4df
mov eax, dword [ebp - 0xc]
mov edx, eax
mov ecx, eax
shr ecx, 0x10
and edx, 0xff0000
or edx, ecx
mov ecx, eax
and ecx, 0xff00
shl eax, 0x10
or ecx, eax
shr edx, 8
shl ecx, 8
or edx, ecx
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x164]
mov eax, ebx
sub edx, ebx
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1002e4f0
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea edx, [ebp - 0x164]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [ebp + 0x18]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
push ebx
mov dword [esi + 0x7624], eax
push 0
push esi
lea eax, [ecx - 1]
mov cl, 9
call fcn.1002d970
cmp dword [esi + 0x7624], 0xffffffff
movsx edx, al
mov dword [ebp - 8], edx
je 0x1002e1fe
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x762c], eax
shr eax, 0xd
mov dword [esi + 0x7630], eax
mov dword [esi + 0x7634], 1
mov dword [esi + 0x7638], 0
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
or al, 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edi, dword [ebp + 0x18]
push edi
mov eax, esi
call fcn.1002ddd0
mov ebx, eax
test ebx, ebx
je 0x1002e0db
mov eax, dword [esi + 0x7624]
cmp eax, 0xffffffff
je 0x1002e56e
cmp dword [ebp + 0x14], 0
jne 0x1002e5b4
push 0
lea ecx, [ebp - 8]
push ecx
push edi
push ebx
push eax
jmp 0x1002e5e2
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x26c4]
push eax
mov ecx, edi
mov eax, ebx
call fcn.10038bf0
mov edx, dword [ebp - 0x14]
push 0
lea ecx, [ebp - 8]
push ecx
push edx
lea eax, [ebp - 0x26c4]
mov ecx, esi
mov edx, dword [ecx + 0x7624]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 8], 0xffffffff
jne 0x1002e56e
mov eax, dword [esi + 0x7624]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [esi + 0x7624], 0xffffffff
mov dword [esi + 0x7638], eax
mov dword [esi + 0x7634], eax
jmp 0x1002e56e
mov eax, dword [esi + 0x7624]
cmp eax, ebx
je 0x1002e629
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x7624], ebx
mov dword [esi + 0x7638], edi
mov dword [esi + 0x7634], edi
or al, 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [esi + 0x7624]
cmp eax, ebx
jne 0x1002e622
cmp byte [ebp + 0x10], 0
jne 0x1002e671
push 0x1004ad19
push edi
push esi
xor edi, edi
mov eax, ebx
mov cl, 7
call fcn.1002d970
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ecx + 0x318]
cmp eax, edi
je 0x1002e6ae
push esi
call eax
push 0x1004ad19
push edi
xor edi, edi
mov cl, 0xe
push esi
cmp eax, ebx
jne 0x1002e69e
lea eax, [edi + 1]
call fcn.1002d970
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, ebx
call fcn.1002d970
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 0x1004ad19
push edi
xor edi, edi
push esi
lea eax, [edi + 1]
mov cl, 0xe
call fcn.1002d970
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 0x18]
mov edi, esi
push ecx
mov eax, edi
call fcn.1002ddd0
mov ebx, eax
test ebx, ebx
je 0x1002e0db
movzx eax, byte [ebp + 0x10]
dec eax
je 0x1002e7f3
sub eax, 3
je 0x1002e786
dec eax
jne 0x1002e56e
mov al, byte [ebx]
mov esi, ebx
test al, al
je 0x1002e715
cmp al, 0x2a
je 0x1002e715
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1002e704
jmp 0x1002e56e
cmp byte [esi], 0
je 0x1002e56e
lea edx, [ebp - 0x164]
mov byte [esi], 0
mov eax, ebx
sub edx, ebx
jmp 0x1002e730
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1002e730
lea eax, [esi + 1]
lea edx, [ebp - 0x3b4]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1002e745
lea edx, [ebp - 0x3b4]
push edx
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
neg eax
sbb eax, eax
neg eax
push ebx
dec eax
mov dword [ebp - 8], eax
push 8
mov byte [esi], 0x2a
mov eax, dword [ebp - 8]
push edi
mov edi, dword [ebp + 0x18]
mov cl, 0xb
call fcn.1002d970
jmp 0x1002e1f8
lea edx, [ebp - 0x164]
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1002e790
lea edx, [ebp - 0x164]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1002e7b0
or eax, eax
jmp 0x1002e7d7
test al, 0x10
je 0x1002e7c3
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x1002e7d0
lea ecx, [ebp - 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
neg eax
dec eax
push ebx
push 7
push edi
mov edi, dword [ebp + 0x18]
mov cl, 0xb
mov dword [ebp - 8], eax
call fcn.1002d970
movsx edx, al
mov dword [ebp - 8], edx
jmp 0x1002e1fe
lea edx, [ebp - 0x164]
mov eax, ebx
sub edx, ebx
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x1002e800
push 0
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ebx
push 4
push edi
mov edi, dword [ebp + 0x18]
mov cl, 0xb
mov dword [ebp - 8], eax
call fcn.1002d970
jmp 0x1002e1f8