Function at 0x4150f0
Capabilities:
Create directory
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7dc
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x350]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x350]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea eax, [ebp - 0x350]
mov dword [ebp - 0x45c], eax
jmp 0x415138
mov ecx, dword [ebp - 0x45c]
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x45c], eax
mov edx, dword [ebp - 0x45c]
movsx eax, byte [edx]
test eax, eax
je 0x415147
jmp 0x415125
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x568]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea ecx, [ebp - 0x568]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x415187
push 0
lea edx, [ebp - 0x568]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x415187
xor al, al
jmp 0x41591a
lea eax, [ebp - 0x568]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea ecx, [ebp - 0x568]
mov dword [ebp - 0x570], ecx
jmp 0x4151b5
mov edx, dword [ebp - 0x570]
push edx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x570], eax
mov eax, dword [ebp - 0x570]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4151c4
jmp 0x4151a2
push 0x42c54c
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea ecx, [ebp - 0x248]
push ecx
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x56c], eax
cmp dword [ebp - 0x56c], 0xffffffff
jne 0x415204
xor al, al
jmp 0x41591a
mov eax, dword [ebp - 0x248]
and eax, 0x10
je 0x415214
jmp 0x4152e2
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
mov dword [ebp - 0x574], eax
cmp dword [ebp - 0x574], 0
je 0x41524a
push 0x42c844
mov edx, dword [ebp - 0x574]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4152e2
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x45c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x570]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x568]
push ecx
mov ecx, dword [ebp + 0x20]
call fcn.0041a3a0
lea edx, [ebp - 0x568]
push edx
lea eax, [ebp - 0x350]
push eax
call fcn.00413ca0
add esp, 8
test eax, eax
jne 0x4152af
mov ecx, dword [ebp - 0x56c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x41591a
call fcn.0040e680
mov edx, dword [ebp - 0x248]
and edx, 1
je 0x4152e2
mov eax, dword [ebp - 0x248]
xor eax, 1
mov dword [ebp - 0x578], eax
mov ecx, dword [ebp - 0x578]
push ecx
lea edx, [ebp - 0x568]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x248]
push eax
mov ecx, dword [ebp - 0x56c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x415204
mov edx, dword [ebp - 0x56c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x57c], 0
jmp 0x415326
mov eax, dword [ebp - 0x57c]
add eax, 1
mov dword [ebp - 0x57c], eax
mov ecx, dword [ebp + 0x1c]
call fcn.00411c00
cmp dword [ebp - 0x57c], eax
jge 0x4153cb
mov ecx, dword [ebp - 0x57c]
push ecx
mov ecx, dword [ebp + 0x1c]
call fcn.004012c0
mov dword [ebp - 0x580], eax
cmp dword [ebp - 0x580], 0
jne 0x41535a
jmp 0x415317
mov edx, dword [ebp - 0x580]
push edx
mov eax, dword [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0x580]
push ecx
mov edx, dword [ebp - 0x570]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x568]
push eax
mov ecx, dword [ebp + 0x20]
call fcn.0041a3a0
lea ecx, [ebp - 0x568]
push ecx
lea edx, [ebp - 0x350]
push edx
call fcn.00413ca0
add esp, 8
test eax, eax
jne 0x4153b2
xor al, al
jmp 0x41591a
lea eax, [ebp - 0x568]
push eax
call fcn.00415920
add esp, 4
call fcn.0040e680
jmp 0x415317
mov dword [ebp - 0x584], 0
jmp 0x4153e6
mov ecx, dword [ebp - 0x584]
add ecx, 1
mov dword [ebp - 0x584], ecx
mov ecx, dword [ebp + 0x18]
call fcn.00411c00
cmp dword [ebp - 0x584], eax
jge 0x415484
mov edx, dword [ebp - 0x584]
push edx
mov ecx, dword [ebp + 0x18]
call fcn.004012c0
mov dword [ebp - 0x588], eax
cmp dword [ebp - 0x588], 0
jne 0x41541a
jmp 0x4153d7
mov eax, dword [ebp - 0x588]
push eax
mov ecx, dword [ebp - 0x45c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x350]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x415441
jmp 0x4153d7
mov eax, dword [ebp - 0x588]
push eax
mov ecx, dword [ebp - 0x570]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
mov edx, dword [ebp + 0x20]
push edx
lea eax, [ebp - 0x568]
push eax
lea ecx, [ebp - 0x350]
push ecx
call fcn.00413d10
add esp, 0x10
movzx edx, al
test edx, edx
jne 0x41547f
xor al, al
jmp 0x41591a
jmp 0x4153d7
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x458]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x458]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [ebp - 0x458]
push eax
lea ecx, [ebp - 0x350]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x350]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea eax, [ebp - 0x350]
mov dword [ebp - 0x45c], eax
jmp 0x4154e4
mov ecx, dword [ebp - 0x45c]
push ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x45c], eax
mov edx, dword [ebp - 0x45c]
movsx eax, byte [edx]
test eax, eax
je 0x4154f3
jmp 0x4154d1
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x568]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x568]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea ecx, [ebp - 0x568]
mov dword [ebp - 0x570], ecx
jmp 0x415532
mov edx, dword [ebp - 0x570]
push edx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x570], eax
mov eax, dword [ebp - 0x570]
movsx ecx, byte [eax]
test ecx, ecx
je 0x415541
jmp 0x41551f
push 0x42c54c
lea edx, [ebp - 0x458]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea ecx, [ebp - 0x248]
push ecx
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x56c], eax
cmp dword [ebp - 0x56c], 0xffffffff
je 0x415918
mov eax, dword [ebp - 0x248]
and eax, 0x10
je 0x4157fd
push 0x42c4e4
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4155ab
jmp 0x4158ef
lea edx, [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x570]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x568]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x4155f7
push 0
lea edx, [ebp - 0x568]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4155f7
mov eax, dword [ebp - 0x56c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x41591a
push str.MISC.
lea ecx, [ebp - 0x458]
push ecx
lea edx, [ebp - 0x7d8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [ebp - 0x6c8]
push eax
lea ecx, [ebp - 0x7d8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x6cc], eax
mov byte [ebp - 0x7d9], 0
cmp dword [ebp - 0x6cc], 0xffffffff
je 0x4157f8
mov edx, dword [ebp - 0x6c8]
and edx, 0x10
je 0x415706
movzx eax, byte [ebp + 0x24]
test eax, eax
jne 0x41565a
jmp 0x4157b0
push str.MSDE
lea ecx, [ebp - 0x69c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x415686
push str.MYDB
lea edx, [ebp - 0x69c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x415701
push str.MISC_
mov eax, dword [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x69c]
push ecx
mov edx, dword [ebp - 0x45c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.MISC_
mov eax, dword [ebp - 0x570]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x69c]
push ecx
mov edx, dword [ebp - 0x570]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
mov eax, dword [ebp + 0x20]
push eax
lea ecx, [ebp - 0x568]
push ecx
lea edx, [ebp - 0x350]
push edx
call fcn.00413d10
add esp, 0x10
movzx eax, al
test eax, eax
jne 0x415701
mov byte [ebp - 0x7d9], 1
jmp 0x4157cc
jmp 0x4157b0
push str.MISC_
mov ecx, dword [ebp - 0x45c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x69c]
push edx
mov eax, dword [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.MISC_
mov ecx, dword [ebp - 0x570]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x69c]
push edx
mov eax, dword [ebp - 0x570]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x568]
push ecx
lea edx, [ebp - 0x350]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4157b0
lea eax, [ebp - 0x568]
push eax
mov ecx, dword [ebp + 0x20]
call fcn.0041a3a0
lea ecx, [ebp - 0x568]
push ecx
lea edx, [ebp - 0x350]
push edx
call fcn.00413ca0
add esp, 8
test eax, eax
jne 0x41579c
mov byte [ebp - 0x7d9], 1
jmp 0x4157cc
lea eax, [ebp - 0x568]
push eax
call fcn.00415920
add esp, 4
call fcn.0040e680
lea ecx, [ebp - 0x6c8]
push ecx
mov edx, dword [ebp - 0x6cc]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41563e
mov eax, dword [ebp - 0x6cc]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
movzx ecx, byte [ebp - 0x7d9]
test ecx, ecx
je 0x4157f8
mov edx, dword [ebp - 0x56c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x41591a
jmp 0x4158ef
push str.Setup.
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecA]
test eax, eax
jne 0x41583f
push str.Setup32.
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecA]
test eax, eax
jne 0x41583f
push str.Setup64.
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecA]
test eax, eax
je 0x415844
jmp 0x4158ef
push str.autorun.inf
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x41585f
jmp 0x4158ef
lea ecx, [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x45c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x570]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x568]
push edx
lea eax, [ebp - 0x350]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4158a1
jmp 0x41590b
lea ecx, [ebp - 0x568]
push ecx
mov ecx, dword [ebp + 0x20]
call fcn.0041a3a0
lea edx, [ebp - 0x568]
push edx
lea eax, [ebp - 0x350]
push eax
call fcn.00413ca0
add esp, 8
test eax, eax
jne 0x4158db
mov ecx, dword [ebp - 0x56c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x41591a
lea edx, [ebp - 0x568]
push edx
call fcn.00415920
add esp, 4
call fcn.0040e680
lea eax, [ebp - 0x248]
push eax
mov ecx, dword [ebp - 0x56c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x415581
mov edx, dword [ebp - 0x56c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
mov esp, ebp
pop ebp
ret