Function at 0x4ef0f0
Capabilities:
Create directory
Delete file
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x568d8a
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x104c
call fcn.00543120
mov eax, dword [0x5b3680]
xor eax, esp
mov dword [esp + 0x1048], eax
push ebx
push esi
push edi
mov eax, dword [0x5b3680]
xor eax, esp
push eax
lea eax, [esp + 0x1060]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [0x5ba520]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], edi
mov eax, dword [edi]
mov eax, dword [eax + 4]
add eax, 0x54
add eax, edi
push eax
call fcn.004729c0
test eax, eax
je 0x4ef72c
call fcn.00402a00
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4ef179
push 0x80004005
call fcn.004027b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x28], eax
mov dword [esp + 0x1068], 1
mov edx, 0x581a44
push 1
push 1
lea ecx, [esp + 0x30]
call fcn.004820b0
mov eax, dword [esp + 0x30]
add esp, 8
or ebx, 0xffffffff
cmp dword [eax - 0xc], 0
je 0x4ef706
mov ecx, dword [0x5ba51c]
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.0045c1a0
mov byte [esp + 0x1068], 2
lea ecx, [esp + 0x1c]
push 1
push 0x58af04
call fcn.00443ec0
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x1c]
push dword [eax - 0xc]
push eax
call fcn.00443ec0
push 1
push 0x58af04
lea ecx, [esp + 0x24]
call fcn.00443ec0
mov eax, dword [edi + 0xb8]
mov dword [esp + 0x38], eax
cmp eax, 1
jl 0x4ef6ae
jle 0x4ef24b
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x5c], ax
lea eax, [esp + 0x5e]
push eax
call fcn.00531bd0
push str.Oo__File_more_one_email_files_n
push 0x400
lea eax, [esp + 0x68]
push 0x400
push eax
call fcn.0052de9c
add esp, 0x1c
lea ecx, [esp + 0x18]
call fcn.00402b10
mov byte [esp + 0x1068], 3
lea ecx, [esp + 0x14]
call fcn.00482350
mov byte [esp + 0x1068], 4
mov eax, dword [edi + 0xf4]
sub eax, 0
je 0x4ef3c3
dec eax
je 0x4ef353
dec eax
jne 0x4ef478
push eax
push eax
mov edx, str.postlogi
lea ecx, [esp + 0x20]
call fcn.004820b0
mov ebx, dword [esp + 0x34]
lea edx, [esp + 0x20]
add esp, 8
add ebx, 8
mov ecx, ebx
mov esi, 0x3e8
call fcn.00441610
test al, al
je 0x4ef2e9
test esi, esi
je 0x4ef2e9
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
mov edx, str.postlogi
lea ecx, [esp + 0x20]
dec esi
call fcn.004820b0
add esp, 8
lea edx, [esp + 0x18]
mov ecx, ebx
call fcn.00441610
test al, al
jne 0x4ef2b8
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call fcn.00416320
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], 0
je 0x4ef67d
mov eax, dword [0x5ba51c]
test eax, eax
je 0x4ef32b
cmp dword [eax + 0x180], 0
je 0x4ef32b
mov eax, dword [edi]
lea ecx, [esp + 0x14]
mov eax, dword [eax + 4]
mov eax, dword [eax + edi + 0x54]
push dword [eax - 0xc]
push eax
call fcn.00443ec0
mov edi, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0
push dword [esp + 0x18]
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 2
push dword [esp + 0x18]
call esi
push 0x588b30
jmp 0x4ef431
push 0
push 0
mov edx, str.postlogp
lea ecx, [esp + 0x20]
call fcn.004820b0
mov eax, dword [esp + 0x20]
add esp, 8
cmp dword [eax - 0xc], 0
je 0x4ef680
mov eax, dword [0x5ba51c]
test eax, eax
je 0x4ef39e
cmp dword [eax + 0x180], 0
je 0x4ef39e
mov eax, dword [edi]
lea ecx, [esp + 0x14]
mov eax, dword [eax + 4]
mov eax, dword [eax + edi + 0x54]
push dword [eax - 0xc]
push eax
call fcn.00443ec0
mov edi, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0
push dword [esp + 0x18]
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 2
push dword [esp + 0x18]
call esi
push 0x588b70
jmp 0x4ef431
push 0
push 0
mov edx, str.postlog
lea ecx, [esp + 0x20]
call fcn.004820b0
mov eax, dword [esp + 0x20]
add esp, 8
cmp dword [eax - 0xc], 0
je 0x4ef680
mov eax, dword [0x5ba51c]
test eax, eax
je 0x4ef40e
cmp dword [eax + 0x180], 0
je 0x4ef40e
mov eax, dword [edi]
lea ecx, [esp + 0x14]
mov eax, dword [eax + 4]
mov eax, dword [eax + edi + 0x54]
push dword [eax - 0xc]
push eax
call fcn.00443ec0
mov edi, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0
push dword [esp + 0x18]
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 2
push dword [esp + 0x18]
call esi
push 0x588b68
lea eax, [esp + 0x18]
push 0x58b238
push eax
call fcn.00443ea0
add esp, 0xc
push 0
push dword [esp + 0x18]
push 0
call edi
push 2
push dword [esp + 0x18]
call esi
push 0x58af04
lea ecx, [esp + 0x18]
call fcn.00443fd0
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push dword [eax - 0xc]
push eax
call fcn.00443ec0
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x34], ebx
cmp dword [esp + 0x38], ebx
jle 0x4ef62e
xor esi, esi
mov dword [esp + 0x2c], esi
mov edi, edi
mov ecx, dword [esp + 0x1c]
lea ecx, [ecx - 0x10]
call fcn.004022c0
add eax, 0x10
mov dword [esp + 0x30], eax
mov byte [esp + 0x1068], 6
cmp ebx, dword [edi + 0xb8]
jae 0x4ef6a4
mov ecx, dword [edi + 0xb4]
lea eax, [esp + 0x3c]
add ecx, 4
push eax
add ecx, esi
call fcn.00436c90
mov byte [esp + 0x1068], 7
lea ecx, [esp + 0x30]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00443ec0
mov byte [esp + 0x1068], 6
or ecx, 0xffffffff
mov edx, dword [esp + 0x3c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4ef509
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [esp + 0x30]
push 0x58bc64
push esi
call fcn.0052e5ea
push 0x58c254
push dword [esp + 0x20]
mov ebx, eax
call fcn.0052e5ea
add esp, 0x10
mov edi, eax
test ebx, ebx
je 0x4ef5dd
test edi, edi
je 0x4ef5ea
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push edi
push 1
lea eax, [esp + 0x4c]
push 0x10
push eax
call fcn.0052b6e4
push edi
push 1
lea eax, [esp + 0x38]
mov word [esp + 0x38], 0xa0d
push 2
push eax
call fcn.0052b6e4
push ebx
push 0x1000
lea eax, [esp + 0x7c]
push 1
push eax
call fcn.0052d4e2
mov edx, eax
mov dword [esp + 0x70], 0
add esp, 0x30
test edx, edx
je 0x4ef5cd
mov esi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x58]
call fcn.004fb8d0
push edi
push edx
mov esi, eax
lea eax, [esp + 0x60]
push 1
push eax
call fcn.0052b6e4
push ebx
push 0x1000
lea eax, [esp + 0x70]
push 1
push eax
call fcn.0052d4e2
mov edx, eax
add esp, 0x24
test edx, edx
jne 0x4ef594
mov esi, dword [esp + 0x30]
push ebx
call fcn.0052c324
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test edi, edi
je 0x4ef5ea
push edi
call fcn.0052c324
add esp, 4
mov byte [esp + 0x1068], 4
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4ef60c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [esp + 0x34]
mov esi, dword [esp + 0x2c]
inc ebx
mov edi, dword [esp + 0x24]
add esi, 0x50
mov dword [esp + 0x34], ebx
mov dword [esp + 0x2c], esi
cmp ebx, dword [esp + 0x38]
jl 0x4ef490
mov byte [esp + 0x1068], 3
or ebx, 0xffffffff
mov edx, dword [esp + 0x14]
mov ecx, ebx
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4ef656
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0x1068], 2
mov ecx, ebx
mov edx, dword [esp + 0x18]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4ef6e1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4ef6e1
or ebx, 0xffffffff
mov byte [esp + 0x1068], 3
lea ecx, [esp + 0x14]
call fcn.00402750
mov byte [esp + 0x1068], 2
lea ecx, [esp + 0x18]
call fcn.00402750
jmp 0x4ef6e1
push 0x80070057
call fcn.004027b0
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x5c], ax
lea eax, [esp + 0x5e]
push eax
call fcn.00531bd0
push str.No_mail_log_files__n
push 0x400
lea eax, [esp + 0x68]
push 0x400
push eax
call fcn.0052de9c
add esp, 0x1c
mov byte [esp + 0x1068], 1
mov ecx, ebx
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4ef706
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x1068], 0xffffffff
mov edx, dword [esp + 0x28]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x4ef72c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [esp + 0x1060]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1048]
xor ecx, esp
call fcn.005295e2
mov esp, ebp
pop ebp
ret 4