Function at 0x402b29
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x5018]
mov eax, 0x5094
call fcn.00406ce0
mov eax, dword [0x4181b0]
xor eax, ebp
mov dword [ebp + 0x5014], eax
mov eax, dword [ebp + 0x5024]
push ebx
push esi
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x5028]
push edi
mov dword [ebp - 0x50], eax
mov esi, 0x800
push esi
lea eax, [ebp + 0x2010]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push str.WinRAR.exe
lea eax, [ebp + 0x2010]
push eax
call fcn.00403d7f
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
call fcn.00403bda
cmp eax, 0x600
sbb al, al
inc al
mov byte [ebp - 0x42], al
lea eax, [ebp + 0x4014]
mov byte [ebp - 0x41], bl
mov edi, str.WinRAR.lnk
push eax
je 0x402c21
call fcn.004022a3
test al, al
je 0x4031f5
push esi
lea eax, [ebp + 0x4014]
push eax
call fcn.00403c74
push esi
push edi
lea eax, [ebp + 0x4014]
push eax
call fcn.004054cd
lea eax, [ebp + 0x4014]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
lea eax, [ebp - 0x5c]
push eax
setne byte [ebp - 0x41]
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea eax, [ebp - 0x48]
push eax
push 0x19
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp + 0x4014]
push eax
push dword [ebp - 0x48]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [ebp - 0x5c]
push dword [ebp - 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
jmp 0x402c2e
call fcn.004022a3
test al, al
je 0x4031f5
push esi
lea eax, [ebp + 0x4014]
push eax
call fcn.00403c74
push esi
push edi
lea eax, [ebp + 0x4014]
push eax
call fcn.004054cd
mov eax, dword [ebp + 0x5020]
cmp byte [eax + 0x14], bl
je 0x402d32
cmp byte [ebp + 0x502c], bl
je 0x402c79
lea eax, [ebp + 0x4014]
push eax
call fcn.00401a58
test al, al
jne 0x402c79
cmp byte [ebp - 0x41], bl
je 0x402d3e
push ebx
push dword [ebp - 0x50]
push 0x13fb
call fcn.004052d5
push eax
push ebx
lea eax, [ebp + 0x4014]
push eax
lea eax, [ebp + 0x2010]
push eax
push 1
call fcn.00406a3f
test al, al
jne 0x402d3e
cmp byte [ebp - 0x42], bl
je 0x402d3e
cmp byte [ebp + 0x502c], bl
je 0x402d3e
lea eax, [ebp + 0x4014]
push eax
call fcn.00401a58
test al, al
je 0x402cdc
lea eax, [ebp + 0x4014]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x402d3e
lea eax, [ebp + 0x4014]
push eax
call fcn.004022a3
test al, al
je 0x4031f5
push esi
lea eax, [ebp + 0x4014]
push eax
call fcn.00403c74
push esi
push edi
lea eax, [ebp + 0x4014]
push eax
call fcn.004054cd
push ebx
push dword [ebp - 0x50]
push 0x13fb
call fcn.004052d5
push eax
push ebx
lea eax, [ebp + 0x4014]
push eax
lea eax, [ebp + 0x2010]
push eax
push 1
call fcn.00406a3f
jmp 0x402d3e
lea eax, [ebp + 0x4014]
push eax
call fcn.004019e0
lea eax, [ebp - 0x4c]
push eax
xor eax, eax
cmp byte [ebp - 0x42], bl
sete al
dec eax
and eax, 0xb
add eax, 0xb
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp + 0x4014]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [ebp - 0x58]
push dword [ebp - 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
push esi
lea eax, [ebp + 0x4014]
push eax
call fcn.00403c74
push esi
push edi
lea eax, [ebp + 0x4014]
push eax
call fcn.004054cd
mov eax, dword [ebp + 0x5020]
cmp byte [eax + 0x15], bl
je 0x402dda
cmp byte [ebp + 0x502c], bl
je 0x402db3
lea eax, [ebp + 0x4014]
push eax
call fcn.00401a58
test al, al
je 0x402de6
push ebx
push dword [ebp - 0x50]
push 0x13fb
call fcn.004052d5
push eax
push ebx
lea eax, [ebp + 0x4014]
push eax
lea eax, [ebp + 0x2010]
push eax
push 1
call fcn.00406a3f
jmp 0x402de6
lea eax, [ebp + 0x4014]
push eax
call fcn.004019e0
push str.WinRAR.exe
call fcn.0040863d
mov dword [ebp - 0x7c], eax
mov dword [esp], str.WinRAR.chm
call fcn.0040863d
mov dword [ebp - 0x78], eax
mov dword [esp], 0x413e54
call fcn.0040863d
mov dword [ebp - 0x74], eax
mov dword [esp], 0x13f1
call fcn.004052d5
push eax
call fcn.0040863d
mov edi, 0x413698
push edi
mov dword [ebp - 0x70], eax
call fcn.0040863d
pop ecx
pop ecx
push 0x13ee
mov dword [ebp - 0x6c], eax
call fcn.004052d5
push eax
call fcn.0040863d
mov dword [ebp - 0x68], eax
mov dword [esp], 0x13ef
call fcn.004052d5
push eax
call fcn.0040863d
mov dword [ebp - 0x64], eax
mov dword [esp], 0x13f0
call fcn.004052d5
push eax
call fcn.0040863d
pop ecx
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x4c]
push eax
push 2
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp + 0x4014]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [ebp - 0x58]
push dword [ebp - 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
push esi
lea eax, [ebp + 0x4014]
push eax
call fcn.00403c74
push esi
push edi
lea eax, [ebp + 0x4014]
push eax
call fcn.004054cd
cmp byte [ebp + 0x502c], bl
je 0x402ed4
lea eax, [ebp + 0x4014]
push eax
call fcn.00401a58
test al, al
je 0x403021
mov eax, dword [ebp + 0x5020]
cmp byte [eax + 0x16], bl
je 0x403015
cmp dword [ebp - 0x54], ebx
je 0x402ef9
lea eax, [ebp + 0x4014]
push eax
push dword [ebp - 0x54]
call fcn.00406d39
pop ecx
pop ecx
lea eax, [ebp + 0x4014]
push eax
call fcn.00401a58
test al, al
je 0x402f75
push 0x802
lea eax, [ebp + 0x3010]
push eax
push 0x413e50
lea eax, [ebp + 0x4014]
push eax
call fcn.00403ca4
lea ecx, [ebp + 0x1008]
call fcn.00401b03
lea eax, [ebp + 0x3010]
push eax
lea ecx, [ebp + 0x1008]
call fcn.00401b2c
lea ecx, [ebp - 0x40]
call fcn.004018c6
jmp 0x402f56
lea eax, [ebp - 0x40]
push eax
call fcn.004019e0
push ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp + 0x1008]
call fcn.00401ce4
test al, al
jne 0x402f4d
lea ecx, [ebp + 0x1008]
call fcn.00401b19
push ebx
lea eax, [ebp + 0x4014]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x48], ebx
push esi
lea eax, [ebp + 0x3014]
push eax
mov eax, dword [ebp - 0x48]
push dword [ebp + eax*4 - 0x6c]
lea eax, [ebp + 0x4014]
push eax
call fcn.00403ca4
push esi
push str..lnk
lea eax, [ebp + 0x3014]
push eax
call fcn.004054cd
mov eax, dword [ebp - 0x48]
push esi
push dword [ebp + eax*4 - 0x7c]
lea eax, [ebp + 0x2010]
push eax
call fcn.00403d7f
lea eax, [ebp + 0x2010]
push eax
call fcn.00401a58
test al, al
je 0x403006
mov eax, dword [ebp - 0x48]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x50]
push ebx
push eax
push 0x13fb
call fcn.004052d5
push eax
push ebx
lea eax, [ebp + 0x3014]
push eax
lea eax, [ebp + 0x2010]
push eax
push 1
call fcn.00406a3f
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 4
jb 0x402f86
jmp 0x403021
lea eax, [ebp + 0x4014]
push eax
call fcn.004022fd
lea eax, [ebp - 0x4c]
push eax
push 0x17
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4031d0
lea eax, [ebp + 0x4014]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [ebp - 0x58]
push dword [ebp - 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
push esi
lea eax, [ebp + 0x4014]
push eax
call fcn.00403c74
push esi
push edi
lea eax, [ebp + 0x4014]
push eax
call fcn.004054cd
cmp byte [ebp + 0x502c], bl
je 0x403089
lea eax, [ebp + 0x4014]
push eax
call fcn.00401a58
test al, al
je 0x4031d0
mov eax, dword [ebp + 0x5020]
cmp byte [eax + 0x16], bl
lea eax, [ebp + 0x4014]
push eax
je 0x4031cb
call fcn.00401a58
test al, al
je 0x403114
push 0x802
lea eax, [ebp + 0x3010]
push eax
push 0x413e50
lea eax, [ebp + 0x4014]
push eax
call fcn.00403ca4
lea ecx, [ebp + 0x1008]
call fcn.00401b03
lea eax, [ebp + 0x3010]
push eax
lea ecx, [ebp + 0x1008]
call fcn.00401b2c
lea ecx, [ebp - 0x40]
call fcn.004018c6
jmp 0x4030f5
lea eax, [ebp - 0x40]
push eax
call fcn.004019e0
push ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp + 0x1008]
call fcn.00401ce4
test al, al
jne 0x4030ec
lea ecx, [ebp + 0x1008]
call fcn.00401b19
push ebx
lea eax, [ebp + 0x4014]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [ebp - 0x54], ebx
je 0x403148
lea eax, [ebp + 0x4014]
push eax
call fcn.00401a58
test al, al
je 0x403148
lea eax, [ebp + 0x4014]
push eax
push dword [ebp - 0x54]
call fcn.00406d39
pop ecx
pop ecx
xor edi, edi
push esi
lea eax, [ebp + 0x3014]
push eax
push dword [ebp + edi*4 - 0x6c]
lea eax, [ebp + 0x4014]
push eax
call fcn.00403ca4
push esi
push str..lnk
lea eax, [ebp + 0x3014]
push eax
call fcn.004054cd
push esi
push dword [ebp + edi*4 - 0x7c]
lea eax, [ebp + 0x2010]
push eax
call fcn.00403d7f
lea eax, [ebp + 0x2010]
push eax
call fcn.00401a58
test al, al
je 0x4031c3
mov eax, edi
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x50]
push ebx
push eax
push 0x13fb
call fcn.004052d5
push eax
push ebx
lea eax, [ebp + 0x3014]
push eax
lea eax, [ebp + 0x2010]
push eax
push 1
call fcn.00406a3f
inc edi
cmp edi, 4
jb 0x40314a
jmp 0x4031d0
call fcn.004022fd
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp + ebx - 0x7c]
call fcn.00406dc4
push dword [ebp + ebx - 0x6c]
call fcn.00406dc4
add ebx, 4
pop ecx
pop ecx
cmp ebx, 0x10
jb 0x4031d9
mov ecx, dword [ebp + 0x5014]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406ccd
add ebp, 0x5018
leave
ret 0x10