Function at 0x4add26
Capabilities:
Create directory
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51298c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x42c
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x410]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp + 8]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x210]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push str..VIR
lea edx, [ebp - 0x210]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x410]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x410]
push ecx
call fcn.00401fca
add esp, 4
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
test eax, eax
jne 0x4added
lea eax, [ebp - 0x210]
push eax
push str._s_____Eliminado._n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push str.WINDOWSEXPLORER.EXE
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ade2a
mov dword [ebp - 0x414], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x414]
jmp 0x4ae6b3
push ecx
mov ecx, esp
mov dword [ebp - 0x418], esp
lea edx, [ebp + 8]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x42c], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0
je 0x4ae694
lea eax, [ebp - 0x410]
push eax
call fcn.004ae6c1
add esp, 4
push 0x5b79a4
push 0x5b7778
push str._s_s1WINLOGON.EXE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
lea ecx, [ebp + 8]
call fcn.0050f0b0
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4adeb2
lea ecx, [ebp - 0x410]
push ecx
call fcn.00402131
add esp, 4
push 0x5b8d78
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x414]
cmp eax, 0x2e
jne 0x4adf08
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x413]
cmp edx, 0x42
jne 0x4adf08
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x412]
cmp ecx, 0x41
jne 0x4adf08
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x411]
cmp eax, 0x4b
je 0x4ae470
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x414]
cmp edx, 0x2e
jne 0x4adf4c
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x413]
cmp ecx, 0x42
jne 0x4adf4c
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x412]
cmp eax, 0x41
jne 0x4adf4c
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x411]
cmp edx, 0x54
je 0x4ae470
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x414]
cmp ecx, 0x2e
jne 0x4adf90
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x413]
cmp eax, 0x43
jne 0x4adf90
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x412]
cmp edx, 0x43
jne 0x4adf90
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x411]
cmp ecx, 0x33
je 0x4ae470
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x414]
cmp eax, 0x2e
jne 0x4adfd4
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x413]
cmp edx, 0x43
jne 0x4adfd4
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x412]
cmp ecx, 0x4d
jne 0x4adfd4
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x411]
cmp eax, 0x44
je 0x4ae470
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x414]
cmp edx, 0x2e
jne 0x4ae018
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x413]
cmp ecx, 0x43
jne 0x4ae018
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x412]
cmp eax, 0x4f
jne 0x4ae018
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x411]
cmp edx, 0x4d
je 0x4ae470
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x414]
cmp ecx, 0x2e
jne 0x4ae05c
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x413]
cmp eax, 0x43
jne 0x4ae05c
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x412]
cmp edx, 0x50
jne 0x4ae05c
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x411]
cmp ecx, 0x4c
je 0x4ae470
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x414]
cmp eax, 0x2e
jne 0x4ae0a0
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x413]
cmp edx, 0x43
jne 0x4ae0a0
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x412]
cmp ecx, 0x50
jne 0x4ae0a0
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x411]
cmp eax, 0x50
je 0x4ae470
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x414]
cmp edx, 0x2e
jne 0x4ae0e4
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x413]
cmp ecx, 0x44
jne 0x4ae0e4
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x412]
cmp eax, 0x41
jne 0x4ae0e4
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x411]
cmp edx, 0x54
je 0x4ae470
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x414]
cmp ecx, 0x2e
jne 0x4ae128
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x413]
cmp eax, 0x44
jne 0x4ae128
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x412]
cmp edx, 0x4c
jne 0x4ae128
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x411]
cmp ecx, 0x4c
je 0x4ae470
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x414]
cmp eax, 0x2e
jne 0x4ae16c
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x413]
cmp edx, 0x44
jne 0x4ae16c
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x412]
cmp ecx, 0x53
jne 0x4ae16c
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x411]
cmp eax, 0x53
je 0x4ae470
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x414]
cmp edx, 0x2e
jne 0x4ae1b0
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x413]
cmp ecx, 0x45
jne 0x4ae1b0
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x412]
cmp eax, 0x58
jne 0x4ae1b0
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x411]
cmp edx, 0x45
je 0x4ae470
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x414]
cmp ecx, 0x2e
jne 0x4ae1f4
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x413]
cmp eax, 0x46
jne 0x4ae1f4
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x412]
cmp edx, 0x41
jne 0x4ae1f4
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x411]
cmp ecx, 0x53
je 0x4ae470
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x414]
cmp eax, 0x2e
jne 0x4ae238
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x413]
cmp edx, 0x4a
jne 0x4ae238
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x412]
cmp ecx, 0x53
jne 0x4ae238
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x411]
cmp eax, 0x53
je 0x4ae470
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x414]
cmp edx, 0x2e
jne 0x4ae27c
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x413]
cmp ecx, 0x4f
jne 0x4ae27c
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x412]
cmp eax, 0x43
jne 0x4ae27c
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x411]
cmp edx, 0x58
je 0x4ae470
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x414]
cmp ecx, 0x2e
jne 0x4ae2c0
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x413]
cmp eax, 0x52
jne 0x4ae2c0
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x412]
cmp edx, 0x45
jne 0x4ae2c0
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x411]
cmp ecx, 0x53
je 0x4ae470
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x414]
cmp eax, 0x2e
jne 0x4ae304
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x413]
cmp edx, 0x53
jne 0x4ae304
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x412]
cmp ecx, 0x43
jne 0x4ae304
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x411]
cmp eax, 0x52
je 0x4ae470
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x414]
cmp edx, 0x2e
jne 0x4ae348
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x413]
cmp ecx, 0x53
jne 0x4ae348
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x412]
cmp eax, 0x59
jne 0x4ae348
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x411]
cmp edx, 0x53
je 0x4ae470
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x414]
cmp ecx, 0x2e
jne 0x4ae38c
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x413]
cmp eax, 0x54
jne 0x4ae38c
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x412]
cmp edx, 0x4d
jne 0x4ae38c
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x411]
cmp ecx, 0x50
je 0x4ae470
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x416]
cmp eax, 0x2e
jne 0x4ae3f0
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x415]
cmp edx, 0x54
jne 0x4ae3f0
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x414]
cmp ecx, 0x4d
jne 0x4ae3f0
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x413]
cmp eax, 0x50
jne 0x4ae3f0
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x412]
cmp edx, 0x46
jne 0x4ae3f0
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x411]
cmp ecx, 0x53
je 0x4ae470
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x414]
cmp eax, 0x2e
jne 0x4ae430
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x413]
cmp edx, 0x56
jne 0x4ae430
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x412]
cmp ecx, 0x42
jne 0x4ae430
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x411]
cmp eax, 0x53
je 0x4ae470
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x414]
cmp edx, 0x2e
jne 0x4ae47f
mov eax, dword [ebp - 0x10]
movsx ecx, byte [ebp + eax - 0x413]
cmp ecx, 0x56
jne 0x4ae47f
mov edx, dword [ebp - 0x10]
movsx eax, byte [ebp + edx - 0x412]
cmp eax, 0x4d
jne 0x4ae47f
mov ecx, dword [ebp - 0x10]
movsx edx, byte [ebp + ecx - 0x411]
cmp edx, 0x58
jne 0x4ae47f
lea eax, [ebp - 0x410]
push eax
call fcn.004aea44
add esp, 4
push 0x5b6404
push 0x5b5c04
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ae4ba
push 0x56ac78
push 0x5b5c04
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6404
push 0x5b5c04
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
lea ecx, [ebp + 8]
call fcn.0050f0b0
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea ecx, [ebp + 8]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push ecx
mov ecx, esp
mov dword [ebp - 0x41c], esp
lea edx, [ebp + 8]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x434], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
jne 0x4ae571
cmp dword [0x5b8500], 0
jne 0x4ae51f
mov dword [0x5b8500], 1
push 0x5b6404
lea eax, [ebp - 0x410]
push eax
push str._s_____Eliminado__s_n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x420], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x420]
jmp 0x4ae6b3
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp + 8]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
test eax, eax
jne 0x4ae5fe
push 0x5b6404
lea edx, [ebp - 0x410]
push edx
push str._s______s_Renombrado_a_.VIR_n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push str.WIN32STA.DLL
lea ecx, [ebp + 8]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ae5fc
push 0x5b7db4
push str._sWIN32STA.DLL
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
jmp 0x4ae664
push 0x5b6404
lea eax, [ebp - 0x410]
push eax
push str._s______s_Acceso_Denegado__Preparada_su_eliminac
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea ecx, [ebp - 0x410]
push ecx
push str.___s_n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x4d
push str.PendingFileRenameOperations
push str.SystemCurrentControlSetControlSession_Manager
push 0x80000002
call fcn.00402bb9
add esp, 0x14
call fcn.004ae964
mov dword [0x5b8500], 2
mov dword [ebp - 0x424], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x424]
jmp 0x4ae6b3
mov dword [ebp - 0x428], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret