Function at 0x1014c24
Capabilities:
Create directory
Delete directory
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa58
mov eax, dword [0x102a0ec]
push esi
xor esi, esi
push edi
push esi
push esi
push esi
push 5
mov dword [ebp - 4], eax
mov dword [ebp - 0xa30], esi
mov dword [ebp - 0xa50], esi
mov dword [ebp - 0xa3c], esi
mov dword [ebp - 0xa48], esi
call fcn.01018dae
push esi
push 0xa28
push esi
push 5
call fcn.01018dae
mov dword [ebp - 0xa54], eax
call fcn.01015dc8
mov dword [ebp - 0xa58], eax
xor eax, eax
cmp dword [ebp + 0xc], 4
mov dword [ebp - 0xa28], esi
sete al
push eax
call fcn.010144c1
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push 1
call fcn.010140c8
cmp dword [ebp - 0xa54], esi
mov edi, 0x104
je 0x1014d00
push edi
lea eax, [ebp - 0xa24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push 0x9b
push 0x1005b68
lea eax, [ebp - 0x40c]
push 0xff
push eax
call fcn.0100d4d1
add esp, 0x10
test eax, eax
jl 0x1014d1d
push 0x82
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0xa48], eax
je 0x1014d1d
push 0x10058f4
push 0x40
push eax
call fcn.0100c535
jmp 0x1014d1d
push 0x100
lea eax, [ebp - 0x40c]
push eax
push 0xa0
push dword [0x102aec0]
call dword [sym.imp.USER32.dll_LoadStringW]
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010190e9
test eax, eax
je 0x1015626
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01016cfc
push 0x1002570
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
lea eax, [ebp - 0x20c]
push eax
call fcn.01016f8a
test eax, eax
mov ebx, 0x208
je 0x1014e2d
push ebx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0xa3c], eax
je 0x1014daa
lea eax, [ebp - 0xa28]
push eax
push dword [ebp - 0xa3c]
mov dword [ebp - 0xa28], ebx
call fcn.01016047
test eax, eax
jne 0x1014daa
push dword [ebp - 0xa3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [ebp - 0xa3c], esi
push ebx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0xa30], eax
je 0x1014dea
lea eax, [ebp - 0xa28]
push eax
push dword [ebp - 0xa30]
mov dword [ebp - 0xa28], ebx
push esi
call fcn.01015cd2
test eax, eax
jne 0x1014dea
push dword [ebp - 0xa30]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [ebp - 0xa30], esi
push ebx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0xa50], eax
je 0x1014e5d
lea eax, [ebp - 0xa28]
push eax
push dword [ebp - 0xa50]
mov dword [ebp - 0xa28], ebx
push 1
call fcn.01015cd2
test eax, eax
jne 0x1014e5d
push dword [ebp - 0xa50]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [ebp - 0xa50], esi
jmp 0x1014e5d
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010190e9
test eax, eax
je 0x1014e5d
lea eax, [ebp - 0x20c]
push eax
call fcn.01016cfc
push 0x1002668
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
push ebx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0xa40], eax
je 0x1014eac
lea eax, [ebp - 0xa28]
push eax
push dword [ebp - 0xa40]
mov dword [ebp - 0xa28], edi
push esi
call fcn.01015d58
test eax, eax
je 0x1014e9a
push dword [ebp - 0xa40]
call fcn.01018429
test eax, eax
jne 0x1014eac
push dword [ebp - 0xa40]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [ebp - 0xa40], esi
push ebx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0xa4c], eax
je 0x1014efc
lea eax, [ebp - 0xa28]
push eax
push dword [ebp - 0xa4c]
mov dword [ebp - 0xa28], edi
push 1
call fcn.01015d58
test eax, eax
je 0x1014eea
push dword [ebp - 0xa4c]
call fcn.01018429
test eax, eax
jne 0x1014efc
push dword [ebp - 0xa4c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [ebp - 0xa4c], esi
push ebx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0xa2c], eax
je 0x1014f4d
push dword [ebp + 0xc]
lea eax, [ebp - 0xa28]
push eax
push dword [ebp - 0xa2c]
mov dword [ebp - 0xa28], edi
call fcn.01016266
test eax, eax
je 0x1014f3b
push dword [ebp - 0xa2c]
call fcn.01018429
test eax, eax
jne 0x1014f4d
push dword [ebp - 0xa2c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [ebp - 0xa2c], esi
push ebx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0xa38], eax
je 0x1014f9c
push esi
lea eax, [ebp - 0xa28]
push eax
push dword [ebp - 0xa38]
mov dword [ebp - 0xa28], edi
call fcn.010162f2
test eax, eax
je 0x1014f8a
push dword [ebp - 0xa38]
call fcn.01018429
test eax, eax
jne 0x1014f9c
push dword [ebp - 0xa38]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [ebp - 0xa38], esi
push ebx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0xa34], eax
je 0x1014ffc
push esi
lea eax, [ebp - 0xa28]
push eax
push dword [ebp - 0xa34]
mov dword [ebp - 0xa28], edi
call fcn.0101645c
test eax, eax
je 0x1014fea
push dword [ebp - 0xa34]
call fcn.01018429
test eax, eax
jne 0x1014ffc
push esi
push dword [ebp - 0xa34]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1014ffc
push dword [ebp - 0xa34]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [ebp - 0xa34], esi
push ebx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0xa44], eax
je 0x101504c
push 1
lea eax, [ebp - 0xa28]
push eax
push dword [ebp - 0xa44]
mov dword [ebp - 0xa28], edi
call fcn.010162f2
test eax, eax
je 0x101503a
push dword [ebp - 0xa44]
call fcn.01018429
test eax, eax
jne 0x101504c
push dword [ebp - 0xa44]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [ebp - 0xa44], esi
push ebx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
cmp ebx, esi
pop ecx
je 0x1015085
push 1
lea eax, [ebp - 0xa28]
push eax
push ebx
mov dword [ebp - 0xa28], edi
call fcn.0101645c
test eax, eax
je 0x101507c
push ebx
call fcn.01018429
test eax, eax
jne 0x1015085
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
xor ebx, ebx
push dword [ebp - 0xa38]
call fcn.010131b3
push dword [ebp - 0xa34]
call fcn.010131b3
push dword [ebp - 0xa30]
call fcn.010131b3
push dword [ebp - 0xa2c]
call fcn.010131b3
push dword [ebp - 0xa4c]
call fcn.010131b3
push dword [ebp - 0xa44]
call fcn.010131b3
push ebx
call fcn.010131b3
push dword [ebp - 0xa50]
call fcn.010131b3
call fcn.010134b7
push dword [ebp - 0xa30]
call fcn.01016cfc
push dword [ebp - 0xa38]
call fcn.01016cfc
push dword [ebp - 0xa34]
call fcn.01016cfc
push dword [ebp - 0xa40]
call fcn.01016cfc
push dword [ebp - 0xa2c]
call fcn.01016cfc
cmp dword [ebp - 0xa44], esi
mov edi, dword [sym.imp.SHELL32.dll_SHChangeNotify]
je 0x1015149
push dword [ebp - 0xa44]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
push esi
je 0x101513f
push dword [ebp - 0xa44]
push 5
push 0x10
jmp 0x1015147
push ebx
push 5
push 0x1000
call edi
cmp ebx, esi
je 0x1015186
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
push esi
push ebx
push 5
je 0x101517f
push 0x10
call edi
push ebx
call fcn.01016cfc
push 0x1005a70
push 0x104
push ebx
call fcn.0100d4ff
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1015186
push 0x1000
call edi
cmp dword [ebp - 0xa44], esi
je 0x101519a
push dword [ebp - 0xa44]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp ebx, esi
je 0x10151a5
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp - 0xa4c], esi
je 0x10151b9
push dword [ebp - 0xa4c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp - 0xa50], esi
je 0x10151cd
push dword [ebp - 0xa50]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
call fcn.0101b3ae
test eax, eax
jne 0x101544f
push 0x104
lea eax, [ebp - 0x614]
push eax
call fcn.010139a9
lea eax, [ebp - 0x20c]
push eax
call fcn.010138a8
cmp dword [ebp - 0xa34], esi
je 0x101522d
push esi
push esi
push esi
push esi
push dword [ebp - 0xa48]
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x614]
push eax
push dword [ebp - 0xa34]
lea eax, [ebp - 0x20c]
push eax
call fcn.01013a9b
test eax, eax
jge 0x101525f
cmp dword [ebp - 0xa38], esi
je 0x101525f
push esi
push esi
push esi
push esi
push dword [ebp - 0xa48]
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x614]
push eax
push dword [ebp - 0xa38]
lea eax, [ebp - 0x20c]
push eax
call fcn.01013a9b
call fcn.01019582
fcomp qword [0x1005c88]
fnstsw ax
test ah, 5
jp 0x10152c5
cmp dword [ebp + 0xc], 3
jbe 0x10152c5
cmp dword [ebp - 0xa2c], esi
je 0x10153e5
push 1
push 0x1005c64
call fcn.010175cf
test eax, eax
je 0x10153e5
cmp dword [ebp + 0xc], 5
jae 0x10153e5
push 4
push esi
push esi
push esi
push dword [ebp - 0xa48]
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x614]
push eax
push dword [ebp - 0xa2c]
jmp 0x10153d9
cmp dword [ebp - 0xa40], esi
je 0x1015326
push esi
mov ebx, 0x1005c44
push ebx
call fcn.010175cf
test eax, eax
je 0x101530f
call fcn.01014af7
push 4
push esi
push esi
push esi
push dword [ebp - 0xa48]
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x614]
push eax
push dword [ebp - 0xa40]
lea eax, [ebp - 0x20c]
push eax
call fcn.01013a9b
jmp 0x1015326
push 1
push ebx
call fcn.010175cf
test eax, eax
jne 0x1015326
push dword [ebp - 0xa40]
call fcn.010131b3
cmp dword [ebp - 0xa3c], esi
je 0x1015398
push esi
mov ebx, 0x1005c1c
push ebx
call fcn.010175cf
test eax, eax
je 0x1015381
push dword [ebp - 0xa3c]
call fcn.010131b3
push dword [ebp - 0xa3c]
call fcn.01016cfc
push 4
push esi
push esi
push esi
push dword [ebp - 0xa48]
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x614]
push eax
push dword [ebp - 0xa3c]
lea eax, [ebp - 0x20c]
push eax
call fcn.01013a9b
jmp 0x1015398
push 1
push ebx
call fcn.010175cf
test eax, eax
jne 0x1015398
push dword [ebp - 0xa3c]
call fcn.010131b3
cmp dword [ebp - 0xa30], esi
je 0x10153e5
xor eax, eax
cmp dword [ebp - 0xa58], esi
sete al
push eax
push 0x1005bec
call fcn.010175cf
test eax, eax
je 0x10153e5
push 4
push esi
push esi
push esi
push dword [ebp - 0xa48]
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x614]
push eax
push dword [ebp - 0xa30]
lea eax, [ebp - 0x20c]
push eax
call fcn.01013a9b
cmp dword [ebp + 0xc], 4
jbe 0x101544f
cmp dword [ebp - 0xa2c], esi
je 0x10153ff
push dword [ebp - 0xa2c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push 0x208
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0xa2c], eax
je 0x101544f
push 4
lea eax, [ebp - 0xa28]
push eax
push dword [ebp - 0xa2c]
mov dword [ebp - 0xa28], 0x104
call fcn.01016266
test eax, eax
push dword [ebp - 0xa2c]
je 0x1015443
call fcn.010131b3
jmp 0x101544f
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [ebp - 0xa2c], esi
cmp dword [ebp - 0xa54], esi
je 0x10154f5
cmp dword [ebp - 0xa30], esi
je 0x10154f5
push dword [ebp - 0xa30]
lea eax, [ebp - 0x81c]
push 0x103
push eax
call fcn.0100c535
test eax, eax
jl 0x10154f5
lea eax, [ebp - 0x81c]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
je 0x10154f5
mov word [eax + 2], si
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
push 4
push dword [0x102aec0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x10154f5
lea eax, [ebp - 0x20c]
push eax
push ebx
lea eax, [ebp - 0x81c]
push eax
call fcn.0100d4ff
test eax, eax
jl 0x10154f5
push 0x1005ab8
push ebx
lea eax, [ebp - 0x81c]
push eax
call fcn.0100d4ff
test eax, eax
jl 0x10154f5
lea eax, [ebp - 0x81c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0xa40], esi
mov ebx, 0x1000
je 0x101550e
push esi
push dword [ebp - 0xa40]
push 5
push ebx
call edi
cmp dword [ebp - 0xa38], esi
je 0x101552f
push dword [ebp - 0xa38]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push esi
push dword [ebp - 0xa38]
push 5
push 0x10
call edi
cmp dword [ebp - 0xa34], esi
je 0x1015550
push dword [ebp - 0xa34]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push esi
push dword [ebp - 0xa34]
push 5
push 0x10
call edi
cmp dword [ebp - 0xa2c], esi
je 0x1015571
push dword [ebp - 0xa2c]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push esi
push dword [ebp - 0xa2c]
push 5
push 0x10
call edi
cmp dword [ebp - 0xa3c], esi
je 0x1015585
push esi
push dword [ebp - 0xa3c]
push 5
push ebx
call edi
cmp dword [ebp - 0xa30], esi
je 0x1015599
push esi
push dword [ebp - 0xa30]
push 5
push ebx
call edi
cmp dword [ebp - 0xa3c], esi
pop ebx
je 0x10155ae
push dword [ebp - 0xa3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp - 0xa30], esi
je 0x10155c2
push dword [ebp - 0xa30]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp - 0xa2c], esi
je 0x10155d6
push dword [ebp - 0xa2c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp - 0xa40], esi
je 0x10155ea
push dword [ebp - 0xa40]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp - 0xa38], esi
je 0x10155fe
push dword [ebp - 0xa38]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp - 0xa34], esi
je 0x1015612
push dword [ebp - 0xa34]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp - 0xa48], esi
je 0x1015626
push dword [ebp - 0xa48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0101672d
leave
ret 8