Function at 0x401170
Capabilities:
Create directory
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44c
mov eax, dword [0x405004]
xor eax, esp
mov dword [esp + 0x448], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [esp + 8], esi
push edi
test esi, esi
je 0x4013c8
test ebx, ebx
je 0x4013c8
push ebx
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
push 0x104
lea eax, [esp + 0x350]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x104
lea eax, [esp + 0x254]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x104
lea eax, [esp + 0x158]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea eax, [esp + 0x374]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea eax, [esp + 0x37c]
push str..
push 0x104
push eax
call esi
add esp, 0x40
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x34c]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__findfirst64i32]
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
je 0x4013ae
nop word [eax + eax]
push dword [esp + 0xc]
lea eax, [esp + 0x244]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
push 0x4031e8
lea eax, [esp + 0x250]
push 0x104
push eax
call esi
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x25c]
push 0x104
push eax
call esi
push ebx
lea eax, [esp + 0x160]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
push 0x4031e8
lea eax, [esp + 0x16c]
push 0x104
push eax
call esi
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x178]
push 0x104
push eax
call esi
add esp, 0x48
test byte [esp + 0x10], 0x10
jne 0x4012f6
lea eax, [esp + 0x138]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x248]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
add esp, 0xc
test eax, eax
je 0x401373
jmp 0x40136e
mov ecx, 0x4031ec
lea eax, [esp + 0x34]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401320
test dl, dl
je 0x40131c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401320
add eax, 2
add ecx, 2
test dl, dl
jne 0x401300
xor eax, eax
jmp 0x401325
sbb eax, eax
or eax, 1
test eax, eax
je 0x401373
mov eax, 0x4031f0
lea ecx, [esp + 0x34]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x401352
test dl, dl
je 0x40134e
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x401352
add ecx, 2
add eax, 2
test dl, dl
jne 0x401332
xor eax, eax
jmp 0x401357
sbb eax, eax
or eax, 1
test eax, eax
je 0x401373
lea edx, [esp + 0x138]
lea ecx, [esp + 0x240]
call fcn.00401170
cmp eax, 1
jne 0x4013cb
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__findnext64i32]
add esp, 8
test eax, eax
je 0x401240
push edi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__findclose]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x448]
xor ecx, esp
call fcn.00401f97
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x448]
xor ecx, esp
call fcn.00401f97
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov ecx, dword [esp + 0x454]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401f97
mov esp, ebp
pop ebp
ret