Function at 0x4e0ed0
Capabilities:
Check if file exists
Create directory
Delete directory
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
mov eax, dword [eax + 0xf8]
mov dword [esp], eax
call fcn.00484d60
test eax, eax
je 0x4e0ff3
mov dword [esp], eax
call fcn.004de7a0
mov ebp, eax
mov eax, dword [ebx + 0xfc]
mov dword [esp], eax
call fcn.004de7a0
test ebp, ebp
mov esi, eax
je 0x4e0fe0
test eax, eax
je 0x4e0fe0
test byte [ebx + 0x126], 4
jne 0x4e1332
mov eax, dword [0x62f9b4]
test eax, eax
je 0x4e12f0
mov eax, dword [0x62f9b0]
test eax, eax
je 0x4e16e0
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], esi
call eax
sub esp, 0xc
test al, al
je 0x4e1200
cmp dword [ebx + 0x14c], 0
jl 0x4e11dd
jle 0x4e11d0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 5
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
mov dword [ebx + 0x128], eax
je 0x4e1660
xor edi, edi
mov dword [esp], ebp
call sub.msvcrt.dll_free
mov dword [esp], esi
call sub.msvcrt.dll_free
add esp, 0x3c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.msvcrt.dll__errno]
mov edi, 0xffffffff
mov dword [eax], 0x16
jmp 0x4e0fbc
mov eax, dword [ebx + 0xf8]
mov dword [esp], eax
call fcn.00485260
test eax, eax
mov esi, eax
je 0x4e10f5
mov eax, dword [ebx + 0xfc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x24], eax
call eax
sub esp, 4
cmp eax, 0xffffffff
je 0x4e1048
mov edi, dword [ebx + 0xfc]
test al, 0x10
mov dword [esp], edi
je 0x4e13b0
mov ebp, dword [sym.imp.msvcrt.dll__wrmdir]
call ebp
test eax, eax
jne 0x4e13c0
mov edi, dword [sym.imp.msvcrt.dll__errno]
call edi
mov dword [eax], 0
mov eax, dword [ebx + 0xf8]
mov dword [esp], eax
call fcn.004851e0
mov ebp, eax
mov eax, dword [0x62f9a4]
mov ebx, dword [ebx + 0xfc]
test eax, eax
je 0x4e13f0
mov eax, dword [0x62f9a0]
test eax, eax
je 0x4e139b
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
test eax, eax
mov edx, eax
je 0x4e1393
lea eax, [eax + eax + 2]
mov dword [esp + 0x2c], edx
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov ecx, eax
mov dword [esp + 0x28], eax
je 0x4e139b
movzx eax, word [esi]
mov edx, dword [esp + 0x2c]
test ax, ax
jne 0x4e10e5
jmp 0x4e15a0
mov word [ecx], ax
add esi, 2
movzx eax, word [esi]
add ecx, 2
test ax, ax
je 0x4e15a0
cmp ax, 0x2f
jne 0x4e10d0
mov eax, 0x5c
mov word [ecx], ax
jmp 0x4e10d3
movzx eax, word [ebx + 0x154]
movzx esi, word [ebx + 0x68]
mov edi, eax
not esi
and ax, 0xf000
and di, 0xfff
and esi, edi
and si, 0x1ff
cmp ax, 0x2000
je 0x4e158d
jbe 0x4e1583
cmp ax, 0x4000
jne 0x4e1474
mov eax, dword [ebx + 0xfc]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [esp + 4], 0
mov dword [esp + 0x24], eax
mov dword [esp], eax
call ebp
sub esp, 8
test eax, eax
je 0x4e1690
mov eax, dword [ebx + 0x11c]
and si, 0x1fd
mov edx, dword [ebx + 0xfc]
or si, 0x1c0
mov ebp, eax
mov ecx, eax
and ebp, 4
or ebp, dword [ebx + 0x120]
and ecx, 0xfffffffb
mov dword [ebx + 0x11c], ecx
mov ecx, eax
and ecx, 0xcbfffffb
cmp di, si
mov dword [ebx + 0x120], ebp
je 0x4e1540
and eax, 0x34000000
mov dword [ebx + 0x11c], ecx
or eax, ebp
cmp edx, dword [esp + 0x24]
mov dword [ebx + 0x120], eax
je 0x4e11c7
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
cmp di, si
je 0x4e156a
xor edi, edi
jmp 0x4e0fcc
cmp dword [ebx + 0x148], 0
ja 0x4e0f6f
mov dword [ebx + 0x11c], 0
mov dword [ebx + 0x120], 0
xor edi, edi
jmp 0x4e0fbc
mov dword [esp + 8], 4
mov dword [esp + 4], 0x5fb094
mov edi, esi
mov dword [esp], esi
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x4e1252
movzx eax, word [esi + 8]
lea edi, [esi + 8]
and eax, 0xffffffdf
cmp ax, 0x55
jne 0x4e1252
movzx eax, word [esi + 0xa]
and eax, 0xffffffdf
cmp ax, 0x4e
jne 0x4e1252
movzx eax, word [esi + 0xc]
and eax, 0xffffffdf
cmp ax, 0x43
jne 0x4e1252
cmp word [esi + 0xe], 0x5c
jne 0x4e1252
lea edi, [esi + 0x10]
mov dword [esp + 8], 4
mov dword [esp + 4], 0x5fb094
mov dword [esp], ebp
call sub.msvcrt.dll_wcsncmp
test eax, eax
mov edx, ebp
jne 0x4e12a4
movzx eax, word [ebp + 8]
lea edx, [ebp + 8]
and eax, 0xffffffdf
cmp ax, 0x55
jne 0x4e12a4
movzx eax, word [ebp + 0xa]
and eax, 0xffffffdf
cmp ax, 0x4e
jne 0x4e12a4
movzx eax, word [ebp + 0xc]
and eax, 0xffffffdf
cmp ax, 0x43
jne 0x4e12a4
cmp word [ebp + 0xe], 0x5c
jne 0x4e12a4
lea edx, [ebp + 0x10]
mov dword [esp], edi
mov dword [esp + 8], 0
mov dword [esp + 4], edx
call dword [0x62f9b0]
sub esp, 0xc
test al, al
mov edi, dword [sym.imp.msvcrt.dll__errno]
jne 0x4e0f5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], eax
call fcn.004df080
call edi
mov edi, dword [eax]
test edi, edi
jne 0x4e0fbc
jmp 0x4e0f5c
mov eax, dword [0x62f9ac]
mov dword [0x62f9b4], 1
test eax, eax
je 0x4e1450
mov eax, dword [0x62f9a8]
test eax, eax
je 0x4e1934
mov dword [esp + 4], str.CreateHardLinkW
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
mov dword [0x62f9b0], eax
jmp 0x4e0f38
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x4e0f26
test al, 0x10
mov dword [esp], esi
je 0x4e1432
mov edi, dword [sym.imp.msvcrt.dll__wrmdir]
call edi
test eax, eax
je 0x4e0f26
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
jne 0x4e0f26
mov dword [esp], esi
call fcn.004de7a0
mov dword [esp], eax
mov dword [esp + 0x24], eax
call edi
mov edx, dword [esp + 0x24]
mov dword [esp], edx
call sub.msvcrt.dll_free
jmp 0x4e0f26
call edi
mov dword [eax], 0x16
call edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4e1500
call edi
mov edi, dword [eax]
jmp 0x4e0fcc
mov ebp, dword [sym.imp.msvcrt.dll__wunlink]
call ebp
test eax, eax
je 0x4e1048
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
jne 0x4e1048
mov dword [esp], edi
call fcn.004de7a0
mov edi, eax
mov dword [esp], eax
call ebp
mov dword [esp], edi
call sub.msvcrt.dll_free
jmp 0x4e1048
mov eax, dword [0x62f9ac]
mov dword [0x62f9a4], 1
test eax, eax
je 0x4e1513
mov eax, dword [0x62f9a8]
test eax, eax
je 0x4e1934
mov dword [esp + 4], str.CreateSymbolicLinkW
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
mov dword [0x62f9a0], eax
jmp 0x4e107e
mov edi, dword [sym.imp.msvcrt.dll__wunlink]
call edi
test eax, eax
je 0x4e0f26
jmp 0x4e1362
mov dword [0x62f9ac], 1
mov dword [esp], str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
mov dword [0x62f9a8], eax
jmp 0x4e130c
cmp ax, 0x6000
je 0x4e158d
mov ebp, dword [ebx + 0xfc]
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 0x10c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], ebp
mov dword [esp + 0x24], eax
call eax
sub esp, 0x1c
cmp eax, 0xffffffff
mov dword [ebx + 0x128], eax
je 0x4e1748
cmp dword [ebx + 0xfc], ebp
je 0x4e11be
mov dword [esp], ebp
call sub.msvcrt.dll_free
jmp 0x4e11be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], eax
call fcn.004df080
jmp 0x4e13a7
mov dword [0x62f9ac], 1
mov dword [esp], str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
mov dword [0x62f9a8], eax
jmp 0x4e140c
test byte [ebx + 0x124], 2
je 0x4e17aa
and eax, 0x34000000
mov dword [ebx + 0x11c], ecx
or eax, ebp
cmp edx, dword [esp + 0x24]
mov dword [ebx + 0x120], eax
jne 0x4e11b2
mov ecx, dword [ebx + 0x11c]
and ecx, 0xcbffffff
xor edi, edi
mov dword [ebx + 0x11c], ecx
jmp 0x4e0fcc
cmp ax, 0x1000
jne 0x4e147e
mov edi, 0x16
jmp 0x4e0fcc
xor esi, esi
cmp ebp, 1
mov word [ecx], si
je 0x4e16f3
cmp ebp, 2
je 0x4e1680
movzx eax, word [ecx - 2]
cmp ax, 0x5c
je 0x4e1680
xor esi, esi
cmp ax, 0x2e
mov ebp, 2
je 0x4e1813
lea esi, [esi]
lea edi, [edi]
mov dword [esp], ebx
mov eax, dword [esp + 0x24]
call eax
sub esp, 4
cmp eax, 0xffffffff
je 0x4e160f
test al, 0x10
mov dword [esp], ebx
je 0x4e1700
mov eax, dword [sym.imp.msvcrt.dll__wrmdir]
mov dword [esp + 0x24], eax
call eax
test eax, eax
jne 0x4e1713
mov dword [esp + 8], ebp
mov ebp, dword [esp + 0x28]
mov dword [esp], ebx
mov dword [esp + 4], ebp
call dword [0x62f9a0]
sub esp, 0xc
test al, al
jne 0x4e1800
mov dword [esp], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], ebp
call dword [0x62f9a0]
sub esp, 0xc
mov ebx, eax
mov dword [esp], ebp
call sub.msvcrt.dll_free
test bl, bl
je 0x4e139b
xor edi, edi
jmp 0x4e0fcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], eax
call fcn.004df080
call dword [sym.imp.msvcrt.dll__errno]
mov edi, dword [eax]
jmp 0x4e0fbc
mov ebp, 3
mov esi, 1
jmp 0x4e15e0
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x28], ecx
call ecx
cmp eax, 0x7b
mov ecx, dword [esp + 0x28]
je 0x4e17bf
call ecx
mov dword [esp], eax
call fcn.004df080
mov eax, dword [esp + 0x24]
cmp dword [ebx + 0xfc], eax
mov edi, dword [sym.imp.msvcrt.dll__errno]
je 0x4e13a7
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x4e13a7
mov edi, dword [sym.imp.msvcrt.dll__errno]
call edi
mov dword [eax], 0x81
jmp 0x4e12ca
mov ebp, 2
xor esi, esi
jmp 0x4e15e0
mov eax, dword [sym.imp.msvcrt.dll__wunlink]
mov dword [esp + 0x24], eax
call eax
test eax, eax
je 0x4e160f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
jne 0x4e160f
mov dword [esp], ebx
call fcn.004de7a0
mov dword [esp], eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x24]
call eax
mov edx, dword [esp + 0x2c]
mov dword [esp], edx
call sub.msvcrt.dll_free
jmp 0x4e160f
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x28], ecx
call ecx
cmp eax, 0x7b
mov ecx, dword [esp + 0x28]
je 0x4e188b
cmp dword [ebx + 0x128], 0xffffffff
jne 0x4e14de
mov dword [esp + 0x24], ecx
call ecx
cmp eax, 5
mov ecx, dword [esp + 0x24]
je 0x4e1853
call ecx
mov dword [esp], eax
call fcn.004df080
cmp dword [ebx + 0xfc], ebp
mov edi, dword [sym.imp.msvcrt.dll__errno]
je 0x4e13a7
mov dword [esp], ebp
call sub.msvcrt.dll_free
jmp 0x4e13a7
cmp edx, dword [esp + 0x24]
mov dword [ebx + 0x11c], ecx
jne 0x4e11b2
jmp 0x4e1570
mov eax, dword [esp + 0x24]
cmp dword [ebx + 0xfc], eax
jne 0x4e16a9
mov dword [esp], eax
call fcn.004de7a0
mov dword [esp + 4], 0
mov dword [esp + 0x24], eax
mov dword [esp], eax
call ebp
test eax, eax
push edx
push edx
mov ecx, dword [esp + 0x28]
je 0x4e16a9
jmp 0x4e1156
mov eax, dword [esp + 0x28]
xor edi, edi
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x4e0fcc
cmp edx, 1
je 0x4e1680
movzx eax, word [ecx - 4]
cmp ax, 0x5c
je 0x4e1680
cmp ax, 0x2e
jne 0x4e15e0
cmp edx, 2
je 0x4e1680
xor eax, eax
cmp word [ecx - 6], 0x5c
sete al
mov ebp, eax
mov esi, eax
add ebp, 2
jmp 0x4e15e0
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
mov ecx, dword [esp + 0x24]
je 0x4e18be
test al, 0x10
mov edi, dword [sym.imp.msvcrt.dll__errno]
je 0x4e18a5
call edi
cmp ebp, dword [ebx + 0xfc]
mov dword [eax], 0x15
jne 0x4e179d
jmp 0x4e13a7
cmp dword [ebx + 0xfc], ebp
je 0x4e18df
cmp dword [ebx + 0x128], 0xffffffff
je 0x4e176e
jmp 0x4e14ea
call edi
cmp ebp, dword [ebx + 0xfc]
mov dword [eax], 0xd
jne 0x4e179d
jmp 0x4e13a7
call ecx
mov dword [esp], eax
call fcn.004df080
cmp ebp, dword [ebx + 0xfc]
mov edi, dword [sym.imp.msvcrt.dll__errno]
jne 0x4e179d
jmp 0x4e13a7
mov dword [esp], ebp
call fcn.004de7a0
mov dword [esp + 0x18], 0
mov dword [esp], eax
mov ebp, eax
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov eax, dword [esp + 0x24]
call eax
sub esp, 0x1c
mov dword [ebx + 0x128], eax
mov ecx, dword [esp + 0x28]
jmp 0x4e1761
call fcn.00532baf
lea esi, [esi]