Function at 0x10004de0
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Delete registry key
Delete registry value
Get common file path
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read file on windows
Set registry value
Write file on windows

Disassembly:
sub esp, 0x30
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [esp + 0x40]
push ebp
lea eax, [edi*4 + 4]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test edi, edi
lea eax, [esp + 0x4c]
je 0x10004e16
mov ecx, ebx
mov edx, dword [eax]
add eax, 4
mov dword [ecx], edx
add ecx, 4
dec edi
jne 0x10004e09
mov eax, dword [esp + 0x48]
cmp eax, 0x6a
ja case.0x10004e23.27
jmp dword [eax*4 + 0x100058f8]
push 0
mov eax, dword [ebx]
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call ebp
test eax, eax
jne 0x10004e4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov esi, eax
jne case.0x10004e23.27
xor esi, esi
jmp case.0x10004e23.27
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
push eax
mov edx, dword [ebx + 0xc]
push ecx
mov eax, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryA
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
push eax
mov edx, dword [ebx + 0xc]
push ecx
mov eax, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call sub.WINSPOOL.DRV_GetPrintProcessorDirectoryA
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
push ecx
call fcn.10001350
add esp, 8
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
push ecx
call fcn.10001260
add esp, 8
sub eax, 2
cmp eax, 1
sbb esi, esi
neg esi
jmp case.0x10004e23.27
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
push ecx
call fcn.10001cd0
add esp, 8
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
push ecx
call fcn.10001d30
add esp, 8
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx]
mov ebp, dword [sym.imp.KERNEL32.dll_FindClose]
push eax
call ebp
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx]
mov ebp, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push eax
call ebp
test eax, eax
jne 0x10004f2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x10004f2e
xor esi, esi
jmp case.0x10004e23.27
mov esi, 1
jmp case.0x10004e23.27
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
push ecx
call fcn.10001660
add esp, 8
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
push ecx
call fcn.10003d50
add esp, 8
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
push ecx
call fcn.100040a0
add esp, 8
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call fcn.10004220
add esp, 0xc
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call sub.WINSPOOL.DRV_AddPortA
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
push eax
mov edx, dword [ebx + 4]
push ecx
mov eax, dword [ebx]
push edx
push eax
call sub.WINSPOOL.DRV_AddPrintProcessorA
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx]
push eax
push 0
push 0
call sub.WINSPOOL.DRV_DeletePrinterDriverA
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx]
push eax
call sub.WINSPOOL.DRV_DeletePrinter
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx]
push eax
push 0
push 0
call sub.WINSPOOL.DRV_DeleteMonitorA
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
push 0
push ecx
call sub.WOW32.dll_WOWHandle32
push eax
mov ecx, dword [ebx]
push ecx
call sub.WINSPOOL.DRV_DeletePortA
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call sub.WINSPOOL.DRV_DeletePrintProcessorA
mov esi, eax
jmp case.0x10004e23.27
push str.msprint2.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je case.0x10004e23.27
push str.PrinterSetup32
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
test ebp, ebp
je 0x10005077
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0xc]
push eax
mov edx, dword [ebx + 8]
push ecx
mov eax, dword [ebx + 4]
push edx
mov ecx, dword [ebx]
push eax
push 0
push ecx
call sub.WOW32.dll_WOWHandle32
push eax
call ebp
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.0x10004e23.27
mov eax, dword [ebx]
mov ebp, dword [sym.imp.GDI32.dll_AddFontResourceA]
push eax
call ebp
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
push eax
mov edx, dword [ebx + 4]
push ecx
mov eax, dword [ebx]
push edx
push eax
call fcn.10003060
add esp, 0x10
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call fcn.10004180
add esp, 0xc
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
push eax
mov edx, dword [ebx + 4]
push ecx
mov eax, dword [ebx]
push edx
push eax
call fcn.10003620
add esp, 0x10
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
push eax
mov edx, dword [ebx + 4]
push ecx
mov eax, dword [ebx]
push edx
push eax
call fcn.100030f0
add esp, 0x10
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
push eax
mov edx, dword [ebx + 4]
push ecx
mov eax, dword [ebx]
push edx
push eax
call fcn.10003600
add esp, 0x10
mov esi, eax
jmp case.0x10004e23.27
push 0
mov eax, dword [ebx + 4]
push eax
mov ecx, dword [ebx]
push ecx
call sub.WINSPOOL.DRV_OpenPrinterA
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx]
push eax
call sub.WINSPOOL.DRV_ClosePrinter
mov esi, eax
jmp case.0x10004e23.27
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
push 0
push ecx
call sub.WOW32.dll_WOWHandle32
push eax
call sub.WINSPOOL.DRV_PrinterProperties
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0xc]
push eax
mov edx, dword [ebx + 8]
push ecx
mov eax, dword [ebx + 4]
push edx
mov ecx, dword [ebx]
push eax
push ecx
call sub.WINSPOOL.DRV_SetPrinterDataA
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
push eax
mov edx, dword [ebx + 4]
push ecx
mov eax, dword [ebx]
push edx
push eax
call fcn.10004340
add esp, 0x10
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
push eax
mov edx, dword [ebx + 0xc]
push ecx
mov eax, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call fcn.100014e0
add esp, 0x18
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
push ecx
call fcn.10001b80
add esp, 8
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx]
push eax
call fcn.100042b0
add esp, 4
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx]
push eax
call fcn.10001a20
add esp, 4
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call fcn.10002f90
add esp, 0xc
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call fcn.10003980
add esp, 0xc
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call fcn.10003c10
add esp, 0xc
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
push eax
mov edx, dword [ebx + 4]
push ecx
mov eax, dword [ebx]
push edx
push eax
call fcn.10003930
add esp, 0x10
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call fcn.10003b20
add esp, 0xc
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call fcn.10003470
add esp, 0xc
mov esi, eax
jmp case.0x10004e23.27
mov ecx, dword [ebx]
test ecx, ecx
jne 0x100052bb
mov ecx, 0x80000001
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 4]
push eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x2001f
push 0
push edx
push ecx
call edi
cmp eax, 5
mov esi, eax
jne case.0x10004e23.27
mov ecx, dword [ebx]
test ecx, ecx
jne 0x100052e9
mov ecx, 0x80000001
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 4]
push eax
push 0x20019
push 0
push edx
push ecx
call edi
mov esi, eax
jmp case.0x10004e23.27
mov ecx, dword [ebx]
test ecx, ecx
jne 0x1000530d
mov ecx, 0x80000001
lea eax, [esp + 0x18]
mov edx, dword [ebx + 8]
push eax
push edx
push 0
mov ebp, dword [ebx + 4]
push 0x20006
push 0
push 0
push 0
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebp
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
mov ecx, dword [ebx + 8]
push ecx
mov eax, dword [ebx + 4]
push edx
mov ecx, dword [ebx]
push 0
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ecx
call ebp
mov esi, eax
test esi, esi
jne case.0x10004e23.27
cmp dword [esp + 0x14], 1
jne case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [esp + 0x10]
mov byte [eax + ecx], 0
jmp case.0x10004e23.27
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
push eax
mov edx, dword [ebx + 4]
push ecx
mov eax, dword [ebx]
push 0
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0
push edx
push eax
call ebp
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push ecx
call ebp
mov esi, eax
jmp case.0x10004e23.27
mov esi, dword [ebx + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov ecx, dword [ebx]
push esi
mov eax, dword [ebx + 4]
push 1
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0
push eax
push ecx
call ebp
mov esi, eax
jmp case.0x10004e23.27
mov dword [esp + 0x14], 0
mov ecx, dword [ebx + 0x10]
lea eax, [ebx + 0x14]
test ecx, ecx
jne 0x10005404
xor eax, eax
push eax
push ecx
lea eax, [esp + 0x1c]
lea ecx, [ebx + 0xc]
push eax
mov edx, dword [ebx + 8]
push 0
mov eax, dword [ebx + 4]
push ecx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push edx
mov ecx, dword [ebx]
push eax
push ecx
call ebp
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x28]
push ecx
mov ebp, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esp + 0x14], eax
call ebp
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x10]
push ecx
mov eax, dword [ebx + 8]
push 0
mov ecx, dword [ebx + 4]
push 0
push 0
push edx
push eax
push ecx
mov edx, dword [ebx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x10004e23.27
mov eax, dword [ebx]
test eax, eax
jne 0x10005488
mov eax, 0x80000001
mov ecx, dword [ebx + 4]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0xc]
push eax
mov edx, dword [ebx + 8]
push ecx
mov eax, dword [ebx + 4]
push edx
mov ecx, dword [ebx]
push 0
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
push ecx
call ebp
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx]
push eax
call fcn.10001d90
add esp, 4
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0xc]
push eax
mov edx, dword [ebx + 8]
push ecx
mov eax, dword [ebx + 4]
push edx
mov ecx, dword [ebx]
push 0
push eax
push ecx
call sub.WINSPOOL.DRV_GetPrinterDataA
mov esi, eax
jmp case.0x10004e23.27
call fcn.100014b0
mov esi, eax
jmp case.0x10004e23.27
call fcn.100014d0
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call ebp
test eax, eax
jne 0x10005533
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x10005533
call esi
cmp eax, 3
je 0x10005533
xor esi, esi
jmp case.0x10004e23.27
mov esi, 1
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call fcn.100017e0
add esp, 0xc
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
or eax, 0x10000
mov edx, dword [ebx + 4]
push eax
push ecx
push edx
mov eax, dword [ebx]
push 0
push eax
call sub.WOW32.dll_WOWHandle32
push eax
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
call ebp
mov esi, eax
jmp case.0x10004e23.27
xor eax, eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
push ecx
mov dword [esp + 0x28], 0x10000
mov dword [esp + 0x24], eax
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
push edx
push eax
call sub.WINSPOOL.DRV_OpenPrinterA
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call fcn.100012c0
add esp, 0xc
mov esi, eax
jmp case.0x10004e23.27
call fcn.100010b0
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call fcn.100013d0
add esp, 0xc
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ecx
call ebp
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push ecx
call ebp
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call fcn.100020b0
add esp, 0xc
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
push eax
mov edx, dword [ebx + 0x14]
push ecx
mov eax, dword [ebx + 0x10]
push edx
mov ecx, dword [ebx + 0xc]
push eax
mov edx, dword [ebx + 8]
push ecx
mov eax, dword [ebx + 4]
push edx
mov ecx, dword [ebx]
push eax
push ecx
call sub.VERSION.dll_VerFindFileA
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
push eax
mov edx, dword [ebx + 0x14]
push ecx
mov eax, dword [ebx + 0x10]
push edx
mov ecx, dword [ebx + 0xc]
push eax
mov edx, dword [ebx + 8]
push ecx
mov eax, dword [ebx + 4]
push edx
mov ecx, dword [ebx]
push eax
push ecx
call sub.VERSION.dll_VerInstallFileA
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push 0xffffffffffffffff
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
jmp case.0x10004e23.27
push 0
mov eax, dword [ebx + 8]
push 0
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push 0xffffffffffffffff
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
push ecx
call fcn.10004a60
add esp, 8
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call fcn.10004390
add esp, 0xc
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx]
push eax
call fcn.10001b20
add esp, 4
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
push ecx
call fcn.10001bc0
add esp, 8
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call fcn.10002310
add esp, 0xc
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
push ecx
call fcn.100024a0
add esp, 8
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
push eax
mov edx, dword [ebx + 0x14]
push ecx
mov eax, dword [ebx + 0x10]
push edx
mov ecx, dword [ebx + 0xc]
push eax
mov edx, dword [ebx + 8]
push ecx
mov eax, dword [ebx + 4]
push edx
mov ecx, dword [ebx]
push eax
push ecx
call fcn.10004850
add esp, 0x20
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
push ecx
call fcn.10004990
add esp, 8
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
push ecx
call fcn.10004a20
add esp, 8
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call fcn.10001420
add esp, 0xc
mov esi, eax
jmp case.0x10004e23.27
mov esi, 1
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call fcn.10002b90
add esp, 0xc
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov esi, eax
test esi, esi
jne case.0x10004e23.27
cmp dword [ebx + 8], 0
jne case.0x10004e23.27
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileA]
push ecx
call ebp
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
mov edx, dword [ebx]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
push eax
mov edx, dword [ebx + 0x10]
push ecx
mov eax, dword [ebx + 0xc]
push edx
mov ecx, dword [ebx + 8]
push eax
mov edx, dword [ebx + 4]
push ecx
mov eax, dword [ebx]
push edx
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push eax
call ebp
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebp
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0xc]
push eax
mov edx, dword [ebx + 8]
push ecx
mov eax, dword [ebx + 4]
push edx
mov ecx, dword [ebx]
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push ecx
call ebp
mov esi, eax
jmp case.0x10004e23.27
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0xc]
push eax
mov edx, dword [ebx + 8]
push ecx
mov eax, dword [ebx + 4]
push edx
mov ecx, dword [ebx]
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push ecx
call ebp
mov esi, eax
jmp case.0x10004e23.27
mov edi, dword [ebx]
test edi, edi
je case.0x10004e23.27
movsx eax, byte [edi]
test eax, eax
je case.0x10004e23.27
mov ebp, dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
movsx eax, byte [edi]
test eax, eax
je 0x100058de
mov al, byte [edi]
push eax
call ebp
test eax, eax
je 0x100058d5
inc edi
inc esi
inc edi
inc esi
movsx eax, byte [edi]
test eax, eax
jne 0x100058ca
inc edi
inc esi
movsx eax, byte [edi]
test eax, eax
jne 0x100058c3
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x30
ret