Function at 0x410008
Capabilities:
Create directory
Encode data using xor
Get common file path

Disassembly:
push 0xa20
mov eax, 0x4de06d
call fcn.004c1130
mov edi, ecx
mov ebx, dword [ebp + 8]
mov ecx, ebx
push str.items
mov dword [ebp - 0x954], ebx
call fcn.00427cf0
mov ecx, eax
mov dword [ebp - 0x94c], eax
call fcn.00427900
test al, al
je 0x410046
xor eax, eax
jmp 0x410983
push 0x104
lea eax, [ebp - 0x123]
mov byte [ebp - 0x124], 0
push 0
push eax
call fcn.004be330
add esp, 0xc
mov esi, str.tempdir
mov ecx, ebx
push esi
call fcn.00427cf0
mov ecx, eax
call fcn.004281d0
test al, al
jne 0x4100cc
lea eax, [ebp - 0x96c]
mov ecx, ebx
push eax
push esi
call fcn.00427cf0
mov ecx, eax
call fcn.00427300
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
jb 0x41009d
mov eax, dword [eax]
push 0x104
push eax
lea eax, [ebp - 0x124]
push 0x105
push eax
call fcn.004bb5cc
add esp, 0x10
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x96c]
call fcn.004019c4
jmp 0x410105
mov dword [ebp - 0x1a], 0x4244484a
xor ecx, ecx
mov word [ebp - 0x1c], 0x4f5b
mov al, byte [ebp + ecx - 0x1c]
sub al, 3
xor al, 0x3f
mov byte [ebp + ecx - 0x1c], al
inc ecx
cmp ecx, 6
jl 0x4100db
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x124]
push 0x105
push eax
call fcn.004bb363
add esp, 0xc
push 0x3ff
lea eax, [ebp - 0x523]
mov byte [ebp - 0x524], 0
push 0
push eax
call fcn.004be330
add esp, 0xc
lea eax, [ebp - 0x524]
mov esi, 0x400
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x524]
push esi
push eax
call fcn.004bab23
add esp, 0xc
lea eax, [ebp - 0x524]
push 0x4ff810
push esi
push eax
call fcn.004bab23
add esp, 0xc
lea eax, [ebp - 0x524]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x3ff
lea eax, [ebp - 0x923]
mov byte [ebp - 0x924], 0
push 0
push eax
call fcn.004be330
add esp, 0xc
mov esi, str.logo
mov ecx, ebx
push esi
call fcn.00427cf0
mov ecx, eax
call fcn.004281d0
test al, al
jne 0x4101f7
lea eax, [ebp - 0x96c]
mov ecx, ebx
push eax
push esi
call fcn.00427cf0
mov ecx, eax
call fcn.00427300
mov dword [ebp - 4], 1
cmp dword [eax + 0x14], 0x10
jb 0x4101ca
mov eax, dword [eax]
push 0x3ff
push eax
lea eax, [ebp - 0x924]
push 0x400
push eax
call fcn.004bb5cc
add esp, 0x10
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x96c]
call fcn.004019c4
mov ecx, dword [ebp - 0x94c]
xor esi, esi
mov dword [ebp - 0x950], esi
call fcn.00427850
test eax, eax
je 0x4108d9
mov ebx, dword [ebp - 0x94c]
push esi
mov ecx, ebx
call fcn.004279e0
mov ecx, eax
mov dword [ebp - 0x948], eax
call fcn.00427900
test al, al
jne 0x4108bd
push 0x24bc
call fcn.004b9c5d
mov esi, eax
mov dword [esp], 0x24bc
push 0
push esi
mov dword [ebp - 0x1c], esi
call fcn.004be330
mov eax, dword [ebp - 0x950]
xor ecx, ecx
mov byte [esi + 0x249a], cl
add esp, 0xc
mov dword [esi + 0x249c], eax
mov word [esi + 0x180d], 1
mov byte [esi + 0x24a5], cl
mov dword [esi + 0x2474], ecx
mov ecx, dword [ebp - 0x948]
push str.list_id
call fcn.00427cf0
mov ecx, eax
call fcn.00427420
mov ecx, dword [ebp - 0x948]
push str.list_rd
mov dword [esi], eax
call fcn.00427cf0
mov ecx, eax
call fcn.004281d0
test al, al
jne 0x4102d0
mov ecx, dword [ebp - 0x948]
push str.list_rd
call fcn.00427cf0
mov ecx, eax
call fcn.00427420
mov dword [esi + 0x24a0], eax
mov ecx, dword [ebp - 0x948]
lea eax, [ebp - 0x96c]
push eax
push str.list_type
call fcn.00427cf0
mov ecx, eax
call fcn.00427300
mov dword [ebp - 4], 2
cmp dword [eax + 0x14], 0x10
jb 0x4102fd
mov eax, dword [eax]
push eax
call fcn.004bb30b
pop ecx
mov byte [esi + 0x180c], al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x96c]
push 0
push 1
call fcn.004019c4
mov al, byte [esi + 0x180c]
cmp al, 0x10
jne 0x410330
mov byte [esi + 0x249a], 1
jmp 0x410370
cmp al, 0x11
jne 0x410344
mov byte [esi + 0x249a], 1
mov byte [esi + 0x180c], 9
jmp 0x410377
cmp al, 0x12
jne 0x410358
mov byte [esi + 0x249a], 1
mov byte [esi + 0x180c], 3
jmp 0x410377
cmp al, 0xb
jne 0x410365
mov byte [esi + 0x24a5], 1
jmp 0x410370
cmp al, 0xc
jne 0x410377
mov byte [esi + 0x24a6], 1
mov byte [esi + 0x180c], 1
cmp dword [edi + 0x258], 0
je 0x410387
mov byte [esi + 0x249a], 0
mov ecx, dword [ebp - 0x948]
lea eax, [ebp - 0x9b4]
push eax
push str.list_nameT
call fcn.00427cf0
mov ecx, eax
call fcn.00427300
mov dword [ebp - 4], 3
cmp dword [eax + 0x14], 0x10
jb 0x4103b4
mov eax, dword [eax]
lea edx, [esi + 0xc04]
mov ecx, eax
call fcn.004226b0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9b4]
push 0
push 1
call fcn.004019c4
mov ecx, dword [ebp - 0x948]
lea eax, [ebp - 0x9e4]
push eax
push str.list_desc
call fcn.00427cf0
mov ecx, eax
call fcn.00427300
mov dword [ebp - 4], 4
cmp dword [eax + 0x14], 0x10
jb 0x410401
mov eax, dword [eax]
lea edx, [esi + 0xc08]
mov ecx, eax
call fcn.004226b0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e4]
push 0
push 1
call fcn.004019c4
mov ecx, dword [ebp - 0x948]
push str.list_url
call fcn.00427cf0
mov ecx, eax
call fcn.004281d0
test al, al
jne 0x4104c1
mov ecx, dword [ebp - 0x948]
lea eax, [ebp - 0x99c]
and dword [ebp - 0x94c], 0
push eax
push str.list_url
call fcn.00427cf0
mov ecx, eax
call fcn.00427300
mov dword [ebp - 4], 5
cmp dword [eax + 0x14], 0x10
jb 0x410474
mov eax, dword [eax]
lea edx, [ebp - 0x94c]
mov ecx, eax
call fcn.004226b0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x99c]
push 0
push 1
call fcn.004019c4
cmp dword [ebp - 0x94c], 0
je 0x4104c1
mov ecx, 0x400
lea eax, [esi + 4]
push ecx
push dword [ebp - 0x94c]
push ecx
push eax
call fcn.004bb5cc
push dword [ebp - 0x94c]
call fcn.004bb670
add esp, 0x14
mov ecx, dword [ebp - 0x948]
push str.list_cmd
call fcn.00427cf0
mov ecx, eax
call fcn.004281d0
test al, al
jne 0x41057e
mov ecx, dword [ebp - 0x948]
lea eax, [ebp - 0x9cc]
push eax
push str.list_cmd
call fcn.00427cf0
mov ecx, eax
call fcn.00427300
mov dword [ebp - 4], 6
cmp dword [eax + 0x14], 0x10
jb 0x41050d
mov eax, dword [eax]
push 0x3ff
push eax
lea ecx, [esi + 0x1824]
push 0x400
push ecx
call fcn.004bb5cc
add esp, 0x10
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x9cc]
call fcn.004019c4
cmp byte [esi + 0x24a6], 0
je 0x41057e
lea eax, [esi + 0x1824]
push 0x7c
push eax
call fcn.004bb1e0
mov dword [ebp - 0x94c], eax
pop ecx
pop ecx
test eax, eax
je 0x41057e
lea ecx, [eax + 1]
push ecx
lea edx, [esi + 0x140c]
push 0x400
push edx
call fcn.004bb363
mov eax, dword [ebp - 0x94c]
add esp, 0xc
mov byte [eax], 0
mov ecx, dword [ebp - 0x948]
push str.list_mimelist
call fcn.00427cf0
mov ecx, eax
call fcn.004281d0
test al, al
jne 0x4105f5
mov ecx, dword [ebp - 0x948]
lea eax, [ebp - 0x9fc]
push eax
push str.list_mimelist
call fcn.00427cf0
mov ecx, eax
call fcn.00427300
mov ecx, eax
mov dword [ebp - 4], 7
cmp dword [ecx + 0x14], 0x10
jb 0x4105c8
mov ecx, dword [ecx]
push 0x3ff
push ecx
lea eax, [esi + 0xc0c]
push 0x400
push eax
call fcn.004bb5cc
add esp, 0x10
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x9fc]
call fcn.004019c4
mov ecx, dword [ebp - 0x948]
push str.list_rename
call fcn.00427cf0
mov ecx, eax
call fcn.004281d0
test al, al
jne 0x41062d
mov ecx, dword [ebp - 0x948]
push str.list_rename
call fcn.00427cf0
mov ecx, eax
call fcn.00427420
mov dword [esi + 0x24b8], eax
mov ecx, dword [ebp - 0x948]
push str.list_ckmd5
call fcn.00427cf0
mov ecx, eax
call fcn.004281d0
test al, al
jne 0x410665
mov ecx, dword [ebp - 0x948]
push str.list_ckmd5
call fcn.00427cf0
mov ecx, eax
call fcn.00427750
mov byte [esi + 0x2478], al
mov ecx, dword [ebp - 0x948]
push str.list_md5
call fcn.00427cf0
mov ecx, eax
call fcn.004281d0
test al, al
jne 0x4106d9
mov ecx, dword [ebp - 0x948]
lea eax, [ebp - 0xa2c]
push eax
push str.list_md5
call fcn.00427cf0
mov ecx, eax
call fcn.00427300
mov ecx, eax
mov dword [ebp - 4], 8
cmp dword [ecx + 0x14], 0x10
jb 0x4106af
mov ecx, dword [ecx]
push 0x3ff
push ecx
lea eax, [esi + 0x2479]
push 0x21
push eax
call fcn.004bb5cc
add esp, 0x10
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0xa2c]
call fcn.004019c4
mov ecx, dword [ebp - 0x948]
push str.list_nameS
call fcn.00427cf0
mov ecx, eax
call fcn.004281d0
test al, al
jne 0x4107e0
mov ecx, dword [ebp - 0x948]
lea eax, [ebp - 0xa14]
and dword [ebp - 0x94c], 0
push eax
push str.list_nameS
call fcn.00427cf0
mov ecx, eax
call fcn.00427300
mov dword [ebp - 4], 9
cmp dword [eax + 0x14], 0x10
jb 0x41072c
mov eax, dword [eax]
lea edx, [ebp - 0x94c]
mov ecx, eax
call fcn.004226b0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa14]
push 0
push 1
call fcn.004019c4
cmp dword [ebp - 0x94c], 0
je 0x4107e0
mov al, byte [esi + 0x180c]
cmp al, 1
je 0x410788
cmp al, 0x10
je 0x410788
push 0x3ff
push dword [ebp - 0x94c]
lea eax, [esi + 0x404]
push 0x400
push eax
call fcn.004bb5cc
add esp, 0x10
jmp 0x4107d4
lea ecx, [ebp - 0x524]
push ecx
lea eax, [esi + 0x804]
push 0x400
push eax
call fcn.004bb363
add esp, 0xc
lea eax, [esi + 0x404]
push dword [ebp - 0x94c]
push 0x400
push eax
call fcn.004bb363
add esp, 0xc
cmp byte [esi + 0x180c], 0x10
jne 0x4107d4
mov byte [esi + 0x249a], 1
mov byte [esi + 0x180c], 1
push dword [ebp - 0x94c]
call fcn.004bb670
pop ecx
mov ecx, dword [ebp - 0x948]
lea eax, [ebp - 0x93c]
push eax
push str.list_sleep
call fcn.00427cf0
mov ecx, eax
call fcn.00427300
mov dword [ebp - 4], 0xa
cmp dword [eax + 0x14], 0x10
jb 0x41080d
mov eax, dword [eax]
push eax
call fcn.004bb30b
pop ecx
mov dword [esi + 0x2030], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x93c]
push 0
push 1
call fcn.004019c4
mov ecx, dword [ebp - 0x948]
lea eax, [ebp - 0x984]
push eax
push str.list_logo
call fcn.00427cf0
mov ecx, eax
call fcn.00427300
mov dword [ebp - 4], 0xb
cmp dword [eax + 0x14], 0x10
jb 0x41085a
mov eax, dword [eax]
push 0x3ff
push eax
lea ecx, [esi + 0x100c]
push 0x400
push ecx
call fcn.004bb5cc
add esp, 0x10
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x984]
call fcn.004019c4
cmp byte [esi + 0x180c], 3
je 0x4108a8
cmp byte [esi + 0x100c], 0
je 0x4108a8
push esi
lea eax, [ebp - 0x924]
mov ecx, edi
push eax
call fcn.0040fe64
lea eax, [ebp - 0x1c]
push eax
lea ecx, [edi + 0xf9c]
call fcn.0041242b
mov esi, dword [ebp - 0x950]
inc esi
mov ecx, ebx
mov dword [ebp - 0x950], esi
call fcn.00427850
cmp esi, eax
jb 0x410218
mov ebx, dword [ebp - 0x954]
push ebx
lea eax, [ebp - 0x524]
mov ecx, edi
push eax
call fcn.0041137f
push ebx
mov ecx, edi
call fcn.00410de1
push ebx
mov ecx, edi
call fcn.004115b7
push ebx
mov ecx, edi
call fcn.00411243
mov ecx, edi
call fcn.00411cae
cmp dword [edi + 0x258], 0
je 0x410918
push ebx
mov ecx, edi
call fcn.00410fff
push ebx
mov ecx, edi
call fcn.004112d5
cmp dword [edi + 0x268], 0
je 0x410980
lea ecx, [ebp - 0x944]
call fcn.00424aa0
mov dword [ebp - 4], 0xc
lea eax, [ebp - 0x984]
push ebx
push eax
lea ecx, [ebp - 0x944]
call fcn.00424b30
mov byte [ebp - 4], 0xd
lea ecx, [edi + 0x2ac]
push eax
call fcn.00408ba8
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x984]
push 0
push 1
call fcn.004019c4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x944]
call fcn.004063a0
xor eax, eax
inc eax
call fcn.004c10df
ret 4