Function at 0x4010d0
Capabilities:
Create directory
Create process on windows
Delete directory
Delete file
Get common file path

Disassembly:
mov eax, 0x1a74
call fcn.004014a0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1a70], eax
mov eax, dword [esp + 0x1a78]
push esi
mov esi, dword [esp + 0x1a84]
lea edx, [esp + 0x6c]
push edx
xor ecx, ecx
push 0x104
mov dword [0x40cdc0], eax
mov word [esp + 0x74], cx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp word [esp + 0x6c], 0
jne 0x401147
push 0x10
push 0
push 0x409290
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x1a70]
xor ecx, esp
call fcn.0040148e
add esp, 0x1a74
ret 0x10
lea eax, [esp + 0x6c]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401150
sub eax, edx
sar eax, 1
mov ecx, 0x5c
cmp cx, word [esp + eax*2 + 0x6a]
je 0x401182
push 0x40928c
lea edx, [esp + 0x70]
push 0x104
push edx
call fcn.00401419
add esp, 0xc
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x60]
push edx
mov dword [esp + 0xc], 0
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
mov eax, dword [esp + 4]
test eax, eax
je 0x40136a
push eax
lea eax, [esp + 0x70]
push eax
push str._s_s
push 0x200
lea ecx, [esp + 0x284]
push 0x200
push ecx
call fcn.004013f8
lea edx, [esp + 0x28c]
push edx
lea eax, [esp + 0x690]
push 0x200
push eax
call fcn.00401395
add esp, 0x24
push 0
lea ecx, [esp + 0x678]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.AvastSbcInstall.exe
lea edx, [esp + 0x278]
push 0x200
push edx
call fcn.00401419
lea eax, [esp + 0x280]
push eax
push 0x409248
push 0x69
call fcn.00401000
add esp, 0x18
test eax, eax
je 0x401306
push 0x44
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.004014d0
push esi
lea edx, [esp + 0x284]
push edx
xor eax, eax
push str.__s___s
push 0x400
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0xa90]
push 0x400
push eax
mov dword [esp + 0x3c], 0x44
call fcn.004013f8
add esp, 0x24
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0x4000200
push 0
push 0
push 0
lea eax, [esp + 0xa94]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4012d6
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0xc]
push eax
call esi
jmp 0x401341
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0xa78]
push ecx
push str.Cannot_execute__s_n._Error_code__d.
push 0x400
lea edx, [esp + 0x1284]
push 0x400
push edx
call fcn.004013f8
add esp, 0x18
jmp 0x40132d
lea ecx, [esp + 0x274]
push ecx
push str.Cannot_write__s_n.
push 0x400
lea edx, [esp + 0x1280]
push 0x400
push edx
call fcn.004013f8
add esp, 0x14
push 0x10
push 0
lea eax, [esp + 0x127c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x274]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x674]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [esp + 4]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
jmp 0x40137b
push 0x10
push 0
push str.Error:_out_of_memory_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x1a74]
pop esi
xor ecx, esp
xor eax, eax
call fcn.0040148e
add esp, 0x1a74
ret 0x10