Function at 0x405eb0
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
mov eax, 0x16a4
call fcn.0041ec80
mov eax, dword [0x42827c]
xor eax, esp
mov dword [esp + 0x169c], eax
push ebx
push ebp
push esi
push edi
xor edi, edi
push 0x208
lea eax, [esp + 0x54]
push edi
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], edi
call fcn.004130d0
add esp, 0xc
xor eax, eax
push 0x104
lea ecx, [esp + 0xc84]
push ecx
push edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0xc80]
call fcn.00401670
cmp dword [0x42fde0], edi
mov esi, eax
mov dword [esp + 0x18], esi
je 0x405f46
mov dword [esp + 0x14], edi
jmp 0x406886
call fcn.00401380
cmp dword [0x42fde0], edi
movzx eax, ax
je 0x405f73
mov edx, dword [esi]
push edx
call fcn.0040d9d5
add esp, 4
push esi
call fcn.0040da51
add esp, 4
mov dword [esp + 0x14], edi
jmp 0x406886
xor ebx, ebx
cmp ax, 0xffff
je 0x406031
nop
cmp ax, 0x200
jne 0x405f9c
add ebx, 1
call fcn.004014d0
cmp dword [0x42fde0], edi
jne 0x4061db
jmp 0x406011
cmp ax, 2
je 0x406000
cmp ax, 3
je 0x406000
cmp ax, 4
je 0x406000
cmp ax, 5
je 0x406000
cmp ax, 0x10
je 0x406000
cmp ax, 0x110
je 0x406000
cmp ax, 0x300
je 0x406000
cmp ax, 0x210
je 0x406000
cmp ax, 0x220
je 0x406000
cmp ax, 0x101
je 0x406000
cmp ax, 0x102
je 0x406000
cmp ax, 0x103
je 0x406000
cmp ax, 0x104
je 0x406000
cmp ax, 0x105
je 0x406000
cmp ax, 0x106
je 0x406000
cmp ax, 6
jne 0x4060be
call fcn.004014d0
cmp dword [0x42fde0], edi
jne 0x405f56
mov eax, esi
call fcn.00401380
cmp dword [0x42fde0], edi
movzx eax, ax
jne 0x4061db
cmp ax, 0xffff
jne 0x405f80
mov ecx, dword [esi]
push ecx
call fcn.0040d9d5
add esp, 4
push esi
call fcn.0040da51
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add esp, 4
lea edx, [ebx*4 + 4]
push edx
push 8
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call ebp
xor esi, esi
cmp eax, esi
mov dword [0x4302d4], eax
jne 0x406121
push 0x104
push str....._src_sfslfdec_sfmkcore.c
push 0x430070
mov dword [0x42fde0], 0xc9
mov word [0x42fe68], si
mov dword [0x42fde4], esi
mov word [0x43006e], si
call fcn.0040d045
add esp, 0xc
mov word [0x430276], si
mov dword [0x430278], 0x36e
mov dword [esp + 0x14], esi
jmp 0x406886
push 0x104
push str....._src_sfslfdec_sfmkcore.c
push 0x430070
mov dword [0x42fde0], 8
mov word [0x42fe68], di
mov dword [0x42fde4], edi
mov word [0x43006e], di
call fcn.0040d045
mov word [0x430276], di
mov ecx, dword [esi]
add esp, 0xc
push ecx
mov dword [0x430278], 0x356
call fcn.0040d9d5
add esp, 4
push esi
call fcn.0040da51
add esp, 4
mov dword [esp + 0x14], edi
jmp 0x406886
xor esi, esi
test ebx, ebx
jle 0x40614f
push 0x828
push 8
call edi
push eax
call ebp
mov ecx, dword [0x4302d4]
mov dword [ecx + esi*4], eax
mov edx, dword [0x4302d4]
cmp dword [edx + esi*4], 0
je 0x406174
add esi, 1
cmp esi, ebx
jl 0x406127
lea ecx, [esp + 0xc80]
call fcn.00401670
xor edi, edi
cmp dword [0x42fde0], edi
mov esi, eax
mov dword [esp + 0x18], esi
je 0x4061c9
mov dword [esp + 0x14], edi
jmp 0x406886
push 0x104
xor esi, esi
push str....._src_sfslfdec_sfmkcore.c
push 0x430070
mov dword [0x42fde0], 0xc9
mov word [0x42fe68], si
mov dword [0x42fde4], 0x828
mov word [0x43006e], si
call fcn.0040d045
add esp, 0xc
mov word [0x430276], si
mov dword [0x430278], 0x37a
mov dword [esp + 0x14], esi
jmp 0x406886
mov eax, esi
call fcn.00401380
cmp dword [0x42fde0], edi
movzx eax, ax
je 0x4061f8
mov eax, dword [esi]
push eax
call fcn.0040d9d5
add esp, 4
push esi
call fcn.0040da51
add esp, 4
mov dword [esp + 0x14], edi
jmp 0x406886
cmp ax, 0xffff
je 0x406886
xor ebp, ebp
xor edi, edi
mov dword [esp + 0x1c], edi
lea ebx, [ebx]
movsx eax, ax
cmp eax, 0x200
jg 0x4065f3
je 0x4062a7
cmp eax, 0x106
jg 0x406261
cmp eax, 0x101
jge 0x406680
cmp eax, 2
jl 0x40682f
cmp eax, 6
jle 0x406680
cmp eax, 0x10
jne 0x40682f
mov ebx, dword [esp + 0x18]
mov ecx, ebx
call fcn.00402050
jmp 0x40668b
cmp eax, 0x110
jne 0x40682f
mov ebx, dword [esp + 0x18]
push 0x431d00
mov esi, ebx
call fcn.00401250
add esp, 4
mov ecx, 0x206
lea edi, [esp + 0x50]
call fcn.00401ce0
call fcn.00401330
cmp dword [0x42fde0], ebp
jne 0x40687b
mov edi, dword [esp + 0x1c]
jmp 0x406697
mov ebx, dword [esp + 0x18]
push 0x431d00
mov esi, ebx
call fcn.00401250
add esp, 4
mov ecx, 0x206
lea edi, [esp + 0xa78]
call fcn.00401ce0
call fcn.00401330
test byte [0x431670], 4
jne 0x40636c
cmp dword [0x42fde0], ebp
jne 0x40687b
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [esp + 0x50]
push ecx
call esi
test eax, eax
jne 0x406324
mov edx, edi
push edx
push 0x42f9b8
lea eax, [esp + 0x670]
push str._s_s
push eax
mov word [esp + 0x12a8], bp
call fcn.0040dcca
add esp, 0x10
jmp 0x4065d5
lea ecx, [esp + 0x50]
push ecx
push 0x42f9b8
lea edx, [esp + 0x12a0]
push str._s_s
push edx
call fcn.0040dcca
lea eax, [esp + 0xa88]
push eax
lea ecx, [esp + 0x64]
push ecx
push 0x42f9b8
lea edx, [esp + 0x684]
push str._s_s_s
push edx
call fcn.0040dcca
add esp, 0x24
jmp 0x4065d5
push 0x208
push ebp
push 0x431680
call fcn.004130d0
add esp, 0xc
push 0x410
lea eax, [esp + 0xe8c]
push ebp
push eax
call fcn.004130d0
add esp, 0xc
lea ecx, [esp + 0x258]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x406458
push 0x208
call fcn.0040db2e
mov ebx, eax
add esp, 4
cmp ebx, ebp
mov dword [esp + 0x20], ebx
je 0x4066be
push 0x208
push ebp
push ebx
call fcn.004130d0
add esp, 0xc
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, ebp
je 0x406709
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
push ebx
lea esi, [ebx + eax*2 - 2]
call fcn.00410ae5
add esp, 8
cmp eax, esi
je 0x406424
mov edi, ebx
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
cmp ax, bp
jne 0x406410
mov edx, dword [0x424dcc]
mov dword [edi], edx
push 0x410
lea eax, [esp + 0x25c]
push ebp
push eax
call fcn.004130d0
lea edx, [esp + 0x264]
add esp, 0xc
mov eax, ebx
sub edx, ebx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bp
jne 0x406445
mov ebx, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov esi, 0x64
lea ecx, [esp + 0xe88]
push ecx
push ebp
push 0x42513c
lea edx, [esp + 0x264]
push edx
call edi
cmp eax, ebp
jne 0x406506
sub esi, 1
jne 0x406463
push 0x40
push str.GetTempFileName
push 0x42fde8
mov dword [0x42fde0], 0xcb
call fcn.0040d045
add esp, 0xc
mov word [0x42fe68], bp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
lea edx, [esp + 0x25c]
push edx
push 0x42fe68
mov dword [0x42fde4], eax
call fcn.0040d045
add esp, 0xc
push 0x104
push str....._src_sfslfdec_sfmkcore.c
push 0x430070
mov word [0x43006e], bp
call fcn.0040d045
add esp, 0xc
mov word [0x430276], bp
mov dword [0x430278], 0x429
jmp 0x406882
lea eax, [esp + 0xe88]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebp
lea ecx, [esp + 0xe8c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
mov dword [esp + 0x14], eax
jne 0x40679c
push 0x410
lea edx, [esp + 0x25c]
push ebp
push edx
call fcn.004130d0
add esp, 0xc
xor eax, eax
jmp 0x406550
movzx ecx, word [esp + eax + 0xe88]
mov word [esp + eax + 0x258], cx
add eax, 2
cmp cx, bp
jne 0x406550
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [esp + eax + 0x258]
mov word [eax + 0x432000], cx
add eax, 2
cmp cx, bp
jne 0x406570
lea eax, [esp + 0x668]
push eax
push ebp
push 0x425164
lea ecx, [esp + 0x264]
push ecx
call edi
cmp eax, ebp
je 0x4067b7
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x668]
mov word [eax + 0x431680], cx
add eax, 2
cmp cx, bp
jne 0x4065b0
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [esp + 0x1298], bp
lea edx, [esp + 0x668]
push edx
call esi
cmp eax, 0xff
jg 0x406802
mov edi, dword [esp + 0x1c]
jmp 0x406697
sub eax, 0x210
je 0x406680
sub eax, 0x10
je 0x406680
sub eax, 0xe0
jne 0x40682f
mov ebx, dword [esp + 0x18]
mov esi, ebx
call fcn.004014d0
cmp dword [0x42fde0], ebp
jne 0x40687b
mov eax, dword [0x4302d4]
mov ecx, dword [edi + eax]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ecx], ebp
mov edx, dword [0x4302d4]
mov eax, dword [edi + edx]
mov ecx, dword [ebx + 0x18]
mov dword [eax + 4], ecx
mov eax, dword [0x4302d4]
mov ecx, dword [edi + eax]
lea edx, [esp + 0x1298]
push edx
add ecx, 8
push ecx
call esi
mov eax, dword [0x4302d4]
mov ecx, dword [edi + eax]
lea edx, [esp + 0x668]
push edx
add ecx, 0x418
push ecx
call esi
add edi, 4
mov dword [esp + 0x1c], edi
jmp 0x406697
mov ebx, dword [esp + 0x18]
mov esi, ebx
call fcn.004014d0
cmp dword [0x42fde0], ebp
jne 0x40687b
mov eax, ebx
call fcn.00401380
cmp dword [0x42fde0], ebp
movzx eax, ax
jne 0x40687b
cmp ax, 0xffff
je 0x406886
xor ebp, ebp
jmp 0x406210
push 0x104
push str....._src_sfslfdec_sfmkcore.c
push 0x430070
mov dword [0x42fde0], 0xc9
mov word [0x42fe68], bp
mov dword [0x42fde4], ebp
mov word [0x43006e], bp
call fcn.0040d045
add esp, 0xc
mov word [0x430276], bp
mov dword [0x430278], 0x402
jmp 0x406882
mov eax, dword [0x42fdd0]
push 0x10
lea edx, [esp + 0x28]
push edx
push 0x443
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x40
push str.GetWindowsDirectory
push 0x42fde8
mov dword [0x42fde0], 0xcb
call fcn.0040d045
add esp, 0xc
mov word [0x42fe68], bp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
lea ecx, [esp + 0x28]
push ecx
push 0x42fe68
mov dword [0x42fde4], eax
call fcn.0040d045
add esp, 0xc
push 0x104
push str....._src_sfslfdec_sfmkcore.c
push 0x430070
mov word [0x43006e], bp
call fcn.0040d045
add esp, 0xc
mov word [0x430276], bp
mov dword [0x430278], 0x410
jmp 0x406882
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea esi, [esp + 0x25c]
call fcn.004037f0
add esp, 4
jmp 0x406886
push 0x104
push str....._src_sfslfdec_sfmkcore.c
push 0x430070
mov dword [0x42fde0], 0xffffef2e
mov word [0x42fe68], bp
mov dword [0x42fde4], ebp
mov word [0x43006e], bp
call fcn.0040d045
add esp, 0xc
mov word [0x430276], bp
mov dword [0x430278], 0x43f
jmp 0x406882
lea eax, [esp + 0x668]
push eax
call esi
sub eax, 0xff
push eax
lea ecx, [esp + 0x48]
push 0x42516c
push ecx
call fcn.0040dcca
add esp, 0xc
lea esi, [esp + 0x44]
call fcn.004038f0
jmp 0x406882
push 0x104
push str....._src_sfslfdec_sfmkcore.c
push 0x430070
mov dword [0x42fde0], 8
mov word [0x42fe68], bp
mov dword [0x42fde4], ebp
mov word [0x43006e], bp
call fcn.0040d045
mov esi, dword [esp + 0x24]
add esp, 0xc
mov word [0x430276], bp
mov dword [0x430278], 0x466
jmp 0x40687d
mov esi, ebx
call fcn.00401b50
mov dword [esp + 0x14], ebp
mov esi, dword [esp + 0x18]
test esi, esi
je 0x4068a2
mov edx, dword [esi]
push edx
call fcn.0040d9d5
add esp, 4
push esi
call fcn.0040da51
add esp, 4
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4068b3
push eax
call fcn.0040da51
add esp, 4
mov ecx, dword [esp + 0x16ac]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040d036
add esp, 0x16a4
ret