Function at 0x101793a
Capabilities:
Check if file exists
Create directory
Delete directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6a0
mov eax, dword [0x1049010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x624], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x648], eax
mov eax, dword [ebp + 0x10]
push esi
push edi
mov dword [ebp - 0x620], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x66c], ebx
lea edi, [ebp - 0x668]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x30
stosd dword es:[edi], eax
lea eax, [ebp - 0x69c]
push ebx
push eax
mov dword [ebp - 0x644], 1
mov dword [ebp - 0x658], ebx
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x6a0], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
push dword [ebp - 0x620]
xor esi, esi
mov dword [ebp - 0x630], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1017a1b
test al, 0x10
jne 0x1017a1b
push dword [ebp - 0x620]
call fcn.01015316
test eax, eax
jne 0x1017a1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10179ef
and eax, 0xffff
or eax, 0x80070000
push 0x11dd
push 0x1002e90
mov esi, eax
push esi
push 0x1002e6c
push dword [ebp - 0x620]
push dword [ebp - 0x624]
push 1
call fcn.01015457
mov eax, esi
jmp 0x1018193
mov eax, dword [ebp + 0x14]
test byte [eax + 0x10], 0x10
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x1017a75
push ebx
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1017a75
call edi
cmp eax, 0xb7
je 0x1017a6f
call edi
cmp eax, 5
je 0x1017a6f
call edi
cmp eax, ebx
jle 0x1017a5b
and eax, 0xffff
or eax, 0x80070000
push 0x11eb
push 0x1002e90
mov esi, eax
push esi
push 0x1002e3c
jmp 0x1017a01
mov dword [ebp - 0x644], ebx
push ebx
push 0x4a200000
push 4
push ebx
push 7
push 0xc10d0000
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x63c], eax
cmp eax, 0xffffffff
jne 0x1017ad6
call edi
cmp eax, ebx
jle 0x1017aac
and eax, 0xffff
or eax, 0x80070000
push 0x11fd
push 0x1002e90
mov edi, eax
push edi
push 0x1002e18
push dword [ebp - 0x620]
push dword [ebp - 0x624]
push 1
call fcn.01015457
jmp 0x101812c
lea eax, [ebp - 0x6a0]
push eax
mov eax, dword [ebp - 0x648]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x1017b13
call edi
cmp eax, ebx
jle 0x1017aff
and eax, 0xffff
or eax, 0x80070000
push 0x1206
push 0x1002e90
mov edi, eax
push edi
push 0x1002dfc
jmp 0x1017abe
mov eax, dword [ebp - 0x67c]
add eax, 8
movzx eax, ax
mov dword [ebp - 0x62c], eax
movzx eax, ax
push eax
push 8
mov dword [ebp - 0x654], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x628], esi
cmp esi, ebx
jne 0x1017b71
call edi
cmp eax, ebx
jle 0x1017b5a
and eax, 0xffff
or eax, 0x80070000
push 0x1211
push 0x1002e90
mov edi, eax
push edi
push 0x100286c
jmp 0x1017abe
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x54]
mov dword [esi], ecx
mov cx, word [ebp - 0x67c]
mov word [esi + 4], cx
mov ax, word [eax + 0x58]
mov word [esi + 6], ax
mov eax, dword [esi]
cmp eax, 0xa0000003
jne 0x1017b9b
cmp cx, 0xa
jb 0x1017ba8
cmp eax, 0xa000000c
jne 0x1017bd7
cmp cx, 0x10
jae 0x1017bd7
push 0x1223
push 0x1002e90
mov eax, 0x8007000d
push eax
push 0x1002da8
push dword [ebp - 0x620]
mov edi, eax
push dword [ebp - 0x624]
push 1
call fcn.01015457
jmp 0x1018130
lea ecx, [ebp - 0x66c]
push ecx
movzx ecx, word [esi + 4]
push ecx
lea eax, [esi + 8]
push eax
mov eax, dword [ebp - 0x648]
push dword [eax]
call fcn.0101fbee
test eax, eax
jne 0x1017c1f
call edi
cmp eax, ebx
jle 0x1017c08
and eax, 0xffff
or eax, 0x80070000
push 0x122f
push 0x1002e90
mov edi, eax
push edi
push 0x1002d50
jmp 0x1017abe
push ebx
lea eax, [ebp - 0x64c]
push eax
push dword [ebp - 0x624]
call fcn.0101957a
push dword [ebp - 0x624]
call fcn.0101a025
push eax
call fcn.01019799
test al, al
jns 0x1018097
test dword [ebp - 0x64c], 0x100
jne 0x1018097
mov eax, dword [ebp + 0x14]
test dword [eax + 0x58], 0x10000
jne 0x1018097
mov eax, dword [esi]
cmp eax, 0xa0000003
je 0x1017c89
cmp eax, 0xa000000c
jne 0x1018097
test byte [esi + 0x10], 1
jne 0x1018097
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push edi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push edi
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
push dword [ebp - 0x624]
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x640], ebx
mov dword [ebp - 0x634], ebx
call fcn.010198d3
push dword [eax]
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x414]
push eax
call fcn.010177c8
lea eax, [ebp - 0x638]
push eax
push ebx
lea eax, [ebp - 0x414]
push eax
call fcn.01017859
mov eax, dword [ebp - 0x638]
push 0x5c
lea eax, [ebp + eax*2 - 0x416]
pop ecx
cmp cx, word [eax]
jne 0x1017d35
xor ecx, ecx
mov word [eax], cx
cmp dword [esi], 0xa0000003
lea edi, [esi + 0x10]
je 0x1017d43
lea edi, [esi + 0x14]
mov eax, dword [ebp - 0x628]
movzx esi, word [eax + 8]
movzx ecx, word [eax + 0xa]
movzx edx, word [eax + 0xc]
movzx eax, word [eax + 0xe]
shr ecx, 1
shr edx, 1
shr eax, 1
shr esi, 1
mov dword [ebp - 0x638], ecx
mov dword [ebp - 0x62c], edx
mov dword [ebp - 0x650], eax
cmp ecx, 5
jbe 0x1017e6b
cmp word [edi + esi*2], 0x5c
jne 0x1017e6b
cmp word [edi + esi*2 + 2], 0x3f
jne 0x1017e6b
cmp word [edi + esi*2 + 4], 0x3f
jne 0x1017e6b
cmp word [edi + esi*2 + 6], 0x5c
jne 0x1017e6b
cmp word [edi + esi*2 + 0xa], 0x3a
jne 0x1017e6b
push 0x1002d44
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.010177c8
test eax, eax
jl 0x1017eb2
lea eax, [ebp - 0x414]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.010177c8
test eax, eax
jl 0x1017eb2
cmp dword [ebp - 0x638], 7
jbe 0x1017e4b
mov eax, dword [ebp - 0x638]
inc eax
push eax
lea eax, [edi + esi*2 + 0xc]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01017809
test eax, eax
jge 0x1017e4b
push 0x12a6
push 0x1002e90
mov eax, 0x8007000d
push eax
push 0x1002d00
push dword [ebp - 0x620]
mov edi, eax
push dword [ebp - 0x624]
push 1
call fcn.01015457
mov esi, dword [ebp - 0x628]
xor ebx, ebx
jmp 0x1018130
lea eax, [ebp - 0x640]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01017859
mov edx, dword [ebp - 0x62c]
mov eax, dword [ebp - 0x650]
cmp eax, 1
jbe 0x1017f10
cmp word [edi + edx*2 + 2], 0x3a
jne 0x1017f10
lea eax, [ebp - 0x414]
push eax
push ebx
lea eax, [ebp - 0x61c]
push eax
call fcn.010177c8
test eax, eax
jge 0x1017ecc
push 0x12c3
push 0x1002e90
mov eax, 0x8007000d
push eax
push 0x1002cc0
jmp 0x1017e29
push 0x129c
push 0x1002e90
mov eax, 0x8007000d
push eax
push 0x1002c78
jmp 0x1017e29
mov eax, dword [ebp - 0x650]
cmp eax, 3
jbe 0x1017efc
inc eax
push eax
mov eax, dword [ebp - 0x62c]
lea eax, [edi + eax*2 + 4]
push eax
push ebx
lea eax, [ebp - 0x61c]
push eax
call fcn.01017809
test eax, eax
jge 0x1017efc
push 0x12cd
jmp 0x1017e9d
lea eax, [ebp - 0x634]
push eax
push ebx
lea eax, [ebp - 0x61c]
push eax
call fcn.01017859
cmp dword [ebp - 0x640], 0
jne 0x1017f26
cmp dword [ebp - 0x634], 0
je 0x101805e
mov eax, dword [ebp - 0x634]
mov ecx, dword [ebp - 0x640]
mov esi, dword [ebp - 0x628]
add ecx, eax
lea eax, [ecx + ecx + 4]
movzx eax, ax
sub edi, esi
add edi, eax
mov dword [ebp - 0x62c], eax
movzx eax, di
push eax
push 8
mov dword [ebp - 0x654], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0x630], ebx
test ebx, ebx
jne 0x1017fb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1017f84
and eax, 0xffff
or eax, 0x80070000
push 0x12eb
push 0x1002e90
mov edi, eax
push edi
push 0x1002c54
push dword [ebp - 0x620]
push dword [ebp - 0x624]
push 1
call fcn.01015457
mov esi, dword [ebp - 0x628]
xor ebx, ebx
jmp 0x101812c
mov eax, dword [esi]
mov dword [ebx], eax
mov ax, word [esi + 4]
mov edx, dword [ebx]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov esi, dword [ebp - 0x628]
mov word [ebx + 6], ax
lea eax, [ebx + 8]
add esi, 8
mov edi, eax
movsd dword es:[edi], dword [esi]
mov ecx, 0xa0000003
movsd dword es:[edi], dword [esi]
cmp edx, ecx
jne 0x1017fe9
movsw word es:[edi], word [esi]
jmp 0x1017feb
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebx + 0x10]
cmp edx, ecx
je 0x1017ff5
lea esi, [ebx + 0x14]
mov edi, dword [ebp - 0x640]
xor ecx, ecx
mov word [eax], cx
lea eax, [edi + edi]
mov word [ebx + 0xa], ax
add eax, 2
mov word [ebx + 0xc], ax
mov eax, dword [ebp - 0x634]
add eax, eax
mov word [ebx + 0xe], ax
lea eax, [edi + 1]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push eax
push esi
call fcn.0101127a
test eax, eax
jl 0x101807d
mov eax, dword [ebp - 0x634]
inc eax
push eax
lea ecx, [ebp - 0x61c]
push ecx
push eax
lea eax, [esi + edi*2 + 2]
push eax
call fcn.0101127a
test eax, eax
jl 0x101807d
mov eax, dword [ebp - 0x62c]
sub esi, ebx
lea eax, [esi + eax - 8]
mov word [ebx + 4], ax
push dword [ebp - 0x628]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
jmp 0x10180ba
push 0x1309
push 0x1002e90
mov eax, 0x8007000d
push eax
push 0x1002c28
jmp 0x1017e29
test dword [esi], 0x80000000
mov dword [ebp - 0x630], esi
jne 0x10180ba
mov eax, dword [ebp - 0x62c]
push 0x18
pop ecx
cmp cx, ax
ja 0x10180ba
add eax, 0xffffffe8
mov word [esi + 4], ax
push ebx
lea eax, [ebp - 0x658]
push eax
push ebx
push ebx
push dword [ebp - 0x654]
xor esi, esi
push dword [ebp - 0x630]
push 0x900a4
push dword [ebp - 0x63c]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x101810e
call edi
cmp eax, ebx
jle 0x10180f7
and eax, 0xffff
or eax, 0x80070000
push 0x132a
push 0x1002e90
mov edi, eax
push edi
push 0x1002bd8
jmp 0x1017abe
mov edi, dword [ebp - 0x648]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x63c]
mov dword [edi], eax
xor edi, edi
mov dword [ebp - 0x644], ebx
cmp edi, ebx
jge 0x1018145
cmp dword [ebp - 0x63c], 0xffffffff
je 0x1018145
push dword [ebp - 0x63c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x14]
test byte [eax + 0x10], 0x10
je 0x1018162
cmp dword [ebp - 0x644], ebx
je 0x1018162
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp esi, ebx
je 0x1018175
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x630], ebx
je 0x1018191
push dword [ebp - 0x630]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010106b6
leave
ret 0x10