Function at 0x4b3480
Capabilities:
Create directory
Delete directory

Disassembly:
sub esp, 0x28
push ebx
push ebp
mov ebx, edx
mov dword [esp + 0x20], 0
push esi
mov esi, ebx
mov dword [esp + 0x1c], ebx
mov ebp, ecx
push edi
mov dword [esp + 0x14], ebp
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4b34a0
push 4
sub esi, edx
push 0x531eac
push ebx
sar esi, 1
call fcn.004d0d63
xor ecx, ecx
add esp, 0xc
test eax, eax
sete cl
mov dword [esp + 0x1c], ecx
test eax, eax
je 0x4b3517
cmp esi, 3
jl 0x4b34fe
movzx eax, word [ebx]
cmp eax, 0x61
jb 0x4b34e0
cmp eax, 0x7a
jbe 0x4b34e9
add eax, 0xffffffbf
cmp ax, 0x19
ja 0x4b34fe
cmp word [ebx + 2], 0x3a
jne 0x4b34fe
movzx eax, word [ebx + 4]
cmp eax, 0x5c
je 0x4b3517
cmp eax, 0x2f
je 0x4b3517
mov dword [ebp + 0x48], 0xfffff019
mov dword [ebp + 0xf0], 0x32
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
lea eax, [esi*4 + 0x20]
push eax
call dword [0x53d638]
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
je 0x4b379c
push 4
lea esi, [eax + 0x10]
push 0x531e7c
push esi
call fcn.004cf12a
mov eax, dword [esp + 0x28]
mov ecx, 4
add esp, 0xc
xor edi, edi
lea edx, [eax*4]
movzx eax, word [ebx + edx*2]
mov dword [esp + 0x1c], edx
lea ebp, [ebx + edx*2]
mov dword [esp + 0x30], ebp
mov ebx, eax
mov dword [esp + 0x2c], ebx
lea ebx, [ecx + 0x58]
test ax, ax
je 0x4b35e3
mov dword [esp + 0x18], edx
mov ebx, ebp
mov ebp, dword [esp + 0x20]
movzx edx, ax
movzx eax, dx
mov dword [esp + 0x2c], eax
movzx eax, dx
cmp eax, 0x5c
je 0x4b35b8
cmp eax, 0x2f
je 0x4b35b8
mov eax, dword [esp + 0x2c]
movzx eax, ax
test edi, edi
je 0x4b35b1
mov eax, 0x5c
mov word [esi + ecx*2], ax
inc ecx
movzx eax, word [ebx]
xor edi, edi
mov word [esi + ecx*2], ax
inc ecx
jmp 0x4b35bd
mov edi, 1
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
lea ebx, [eax*2]
movzx eax, word [ebx + ebp]
add ebx, ebp
mov edx, eax
test ax, ax
jne 0x4b3583
mov ebp, dword [esp + 0x30]
mov ebx, 0x5c
mov word [esi + ecx*2], bx
xor eax, eax
mov ebx, dword [esp + 0x24]
inc ecx
xor edi, edi
mov word [ebx + 8], ax
lea eax, [ecx + ecx]
mov word [ebx + 0xa], ax
xor eax, eax
mov word [esi + ecx*2], ax
inc ecx
movzx eax, word [ebp]
mov dword [esp + 0x30], ecx
mov edx, eax
test ax, ax
je 0x4b3662
movzx eax, dx
movzx ebx, dx
cmp eax, 0x5c
je 0x4b363e
cmp eax, 0x2f
je 0x4b363e
mov eax, ebx
test edi, edi
je 0x4b3637
mov eax, 0x5c
mov word [esi + ecx*2], ax
inc ecx
movzx eax, word [ebp]
xor edi, edi
mov word [esi + ecx*2], ax
inc ecx
jmp 0x4b3643
mov edi, 1
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
inc edx
mov dword [esp + 0x1c], edx
lea ebp, [eax + edx*2]
movzx eax, word [ebp]
mov edx, eax
test ax, ax
jne 0x4b3611
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
mov edx, ecx
sub edx, eax
cmp edx, 2
jne 0x4b367e
mov edx, 0x5c
mov word [esi + ecx*2], dx
inc ecx
mov edx, 3
mov edi, dword [esp + 0x3c]
add eax, eax
mov word [ebx + 0xc], ax
lea eax, [edx + edx]
mov word [ebx + 0xe], ax
xor eax, eax
mov word [esi + ecx*2], ax
lea esi, [ecx*2 + 0x12]
lea eax, [esi - 8]
mov dword [ebx], 0xa0000003
mov word [ebx + 4], ax
xor eax, eax
push eax
push edi
mov word [ebx + 6], ax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4b36cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, edx
call fcn.004b8970
or ebp, 0xffffffff
jmp 0x4b3723
push 0
push 0x2200000
push 3
push 0
push 0
push 0x40000000
push edi
mov dword [esp + 0x44], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4b3714
push 0
lea eax, [esp + 0x38]
push eax
push 0
push 0
push esi
push ebx
push 0x900a4
push ebp
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x4b376a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, edx
call fcn.004b8970
mov ecx, dword [esp + 0x14]
mov dword [ecx + 0x48], eax
mov dword [ecx + 0xf0], edx
call fcn.004ceb5c
push ebx
mov esi, dword [eax]
call dword [0x53d644]
add esp, 4
call fcn.004ceb5c
mov dword [eax], esi
cmp ebp, 0xffffffff
je 0x4b3754
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x28], 0
je 0x4b3794
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004ceb5c
push ebx
mov esi, dword [eax]
call dword [0x53d644]
add esp, 4
call fcn.004ceb5c
mov ecx, dword [esp + 0x14]
mov dword [eax], esi
mov dword [ecx + 0x48], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
mov edx, str.uv__malloc
mov ecx, 0xe
call fcn.004b88e0
int3