Function at 0x410540
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e18b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.004173e0
mov dword [esp + 0x54], 0
lea ecx, [esp + 0x30]
call fcn.004173e0
mov byte [esp + 0x54], 1
lea ecx, [esp + 0x28]
call fcn.004173e0
mov byte [esp + 0x54], 2
lea ecx, [esp + 0x20]
call fcn.004173e0
mov bl, 3
mov byte [esp + 0x54], bl
mov edx, dword [esp + 0x20]
mov eax, dword [edx - 8]
mov edi, dword [ebp + 0x1c]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, 0x1000
test edi, edi
je 0x4105d4
or eax, ecx
jge 0x4105ce
push 0x1000
lea ecx, [esp + 0x24]
call fcn.004019a0
mov edx, dword [esp + 0x20]
push 0
push 0x17
jmp 0x4105ee
or eax, ecx
jge 0x4105ea
push 0x1000
lea ecx, [esp + 0x24]
call fcn.004019a0
mov edx, dword [esp + 0x20]
push 0
push 2
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push edx
push 0
call esi
mov eax, dword [esp + 0x20]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.0047a8aa
add esp, 8
test eax, eax
jl 0x41102d
mov ecx, dword [esp + 0x20]
cmp eax, dword [ecx - 8]
jg 0x41102d
mov dword [ecx - 0xc], eax
mov edx, dword [esp + 0x20]
xor ecx, ecx
mov word [edx + eax*2], cx
mov edx, dword [esp + 0x30]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, 0x1000
test edi, edi
je 0x410660
or eax, ecx
jge 0x41065a
push 0x1000
lea ecx, [esp + 0x34]
call fcn.004019a0
mov edx, dword [esp + 0x30]
push 0
push 0x16
jmp 0x41067a
or eax, ecx
jge 0x410676
push 0x1000
lea ecx, [esp + 0x34]
call fcn.004019a0
mov edx, dword [esp + 0x30]
push 0
push 0xb
push edx
push 0
call esi
mov eax, dword [esp + 0x30]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.0047a8aa
add esp, 8
test eax, eax
jl 0x41102d
mov ecx, dword [esp + 0x30]
cmp eax, dword [ecx - 8]
jg 0x41102d
mov dword [ecx - 0xc], eax
mov edx, dword [esp + 0x30]
xor ecx, ecx
mov word [edx + eax*2], cx
mov edx, dword [esp + 0x28]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, 0x1000
test edi, edi
je 0x4106e6
or eax, ecx
jge 0x4106e0
push 0x1000
lea ecx, [esp + 0x2c]
call fcn.004019a0
mov edx, dword [esp + 0x28]
push 0
push 0x19
jmp 0x410700
or eax, ecx
jge 0x4106fc
push 0x1000
lea ecx, [esp + 0x2c]
call fcn.004019a0
mov edx, dword [esp + 0x28]
push 0
push 0x10
push edx
push 0
call esi
mov eax, dword [esp + 0x28]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.0047a8aa
add esp, 8
test eax, eax
jl 0x41102d
mov ecx, dword [esp + 0x28]
cmp eax, dword [ecx - 8]
jg 0x41102d
mov dword [ecx - 0xc], eax
mov edx, dword [esp + 0x28]
xor ecx, ecx
mov word [edx + eax*2], cx
mov ecx, 0x4e97fc
mov eax, 0x53032c
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x410768
test dx, dx
je 0x410764
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x410768
add eax, 4
add ecx, 4
test dx, dx
jne 0x410742
xor eax, eax
jmp 0x41076d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4107b3
mov ecx, 0x4e97f4
mov eax, 0x53032c
jmp 0x410780
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4107a6
test dx, dx
je 0x4107a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4107a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x410780
xor eax, eax
jmp 0x4107ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4107b3
xor edi, edi
jmp 0x4107b8
mov edi, 1
push str.Mail.Ru
lea ecx, [esp + 0x24]
call fcn.00418290
push 0x4e90cc
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.00404a80
mov byte [esp + 0x60], 4
push str.Mail.Ru_Agent.lnk
push eax
lea edx, [esp + 0x24]
push edx
call fcn.00404a80
add esp, 0x18
mov byte [esp + 0x54], 5
push eax
lea ecx, [esp + 0x1c]
call fcn.004027a0
mov byte [esp + 0x54], 4
lea ecx, [esp + 0x10]
call fcn.00417490
mov byte [esp + 0x54], bl
lea ecx, [esp + 0x40]
call fcn.00417490
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
push 0x4e90cc
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00404a80
mov byte [esp + 0x60], 6
push 0x4eb760
push eax
lea eax, [esp + 0x54]
push eax
call fcn.00404a80
add esp, 0x18
mov byte [esp + 0x54], 7
push eax
lea ecx, [esp + 0x1c]
call fcn.004027a0
mov byte [esp + 0x54], 6
lea ecx, [esp + 0x40]
call fcn.00417490
mov byte [esp + 0x54], bl
lea ecx, [esp + 0x10]
call fcn.00417490
mov ecx, dword [esp + 0x18]
push ecx
call esi
push 0x4eb74c
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00404a80
mov byte [esp + 0x60], 8
push 0x4eb760
push eax
lea ecx, [esp + 0x54]
push ecx
call fcn.00404a80
add esp, 0x18
mov byte [esp + 0x54], 9
push eax
lea ecx, [esp + 0x1c]
call fcn.004027a0
mov byte [esp + 0x54], 8
lea ecx, [esp + 0x40]
call fcn.00417490
mov byte [esp + 0x54], bl
lea ecx, [esp + 0x10]
call fcn.00417490
mov edx, dword [esp + 0x18]
push edx
call esi
push 0x4eb74c
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00404a80
mov byte [esp + 0x60], 0xa
push str.Mail.Ru_Agent.lnk
push eax
lea edx, [esp + 0x54]
push edx
call fcn.00404a80
add esp, 0x18
mov byte [esp + 0x54], 0xb
push eax
lea ecx, [esp + 0x1c]
call fcn.004027a0
mov byte [esp + 0x54], 0xa
lea ecx, [esp + 0x40]
call fcn.00417490
mov byte [esp + 0x54], bl
lea ecx, [esp + 0x10]
call fcn.00417490
mov eax, dword [esp + 0x18]
push eax
call esi
push str.Uninstall
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00404a80
mov byte [esp + 0x60], 0xc
push str.Mail.Ru_Agent.lnk
push eax
lea eax, [esp + 0x54]
push eax
call fcn.00404a80
add esp, 0x18
mov byte [esp + 0x54], 0xd
push eax
lea ecx, [esp + 0x1c]
call fcn.004027a0
mov byte [esp + 0x54], 0xc
lea ecx, [esp + 0x40]
call fcn.00417490
mov byte [esp + 0x54], bl
lea ecx, [esp + 0x10]
call fcn.00417490
mov ecx, dword [esp + 0x18]
push ecx
call esi
push 0x4eb70c
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.00404a80
add esp, 0xc
mov byte [esp + 0x54], 0xe
push eax
lea ecx, [esp + 0x1c]
call fcn.004027a0
mov byte [esp + 0x54], bl
lea ecx, [esp + 0x40]
call fcn.00417490
mov ecx, dword [esp + 0x18]
push ecx
call esi
push str.Mail.Ru_Portal.lnk
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.00404a80
add esp, 0xc
mov byte [esp + 0x54], 0xf
push eax
lea ecx, [esp + 0x1c]
call fcn.004027a0
mov byte [esp + 0x54], bl
lea ecx, [esp + 0x40]
call fcn.00417490
mov ecx, dword [esp + 0x18]
push ecx
call esi
push 0x4e90cc
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00404a80
mov byte [esp + 0x60], 0x10
push str.Mail.Ru_Agent.lnk
push eax
lea ecx, [esp + 0x54]
push ecx
call fcn.00404a80
add esp, 0x18
mov byte [esp + 0x54], 0x11
push eax
lea ecx, [esp + 0x1c]
call fcn.004027a0
mov byte [esp + 0x54], 0x10
lea ecx, [esp + 0x40]
call fcn.00417490
mov byte [esp + 0x54], bl
lea ecx, [esp + 0x10]
call fcn.00417490
mov edx, dword [esp + 0x18]
push edx
call esi
push 0x4e90cc
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00404a80
mov byte [esp + 0x60], 0x12
push 0x4eb760
push eax
lea edx, [esp + 0x54]
push edx
call fcn.00404a80
add esp, 0x18
mov byte [esp + 0x54], 0x13
push eax
lea ecx, [esp + 0x1c]
call fcn.004027a0
mov byte [esp + 0x54], 0x12
lea ecx, [esp + 0x40]
call fcn.00417490
mov byte [esp + 0x54], bl
lea ecx, [esp + 0x10]
call fcn.00417490
mov eax, dword [esp + 0x18]
push eax
call esi
lea ecx, [esp + 0x40]
push ecx
call fcn.0040ebc0
add esp, 4
mov byte [esp + 0x54], 0x14
push eax
lea ecx, [esp + 0x1c]
call fcn.004027a0
mov byte [esp + 0x54], bl
lea ecx, [esp + 0x40]
call fcn.00417490
push 0x4eb6bc
lea ecx, [esp + 0x1c]
call fcn.00418290
mov edx, dword [esp + 0x18]
push edx
call esi
lea eax, [esp + 0x40]
push eax
call fcn.0040ebc0
add esp, 4
mov byte [esp + 0x54], 0x15
push eax
lea ecx, [esp + 0x1c]
call fcn.004027a0
mov byte [esp + 0x54], bl
lea ecx, [esp + 0x40]
call fcn.00417490
push 0x4eb694
lea ecx, [esp + 0x1c]
call fcn.00418290
mov ecx, dword [esp + 0x18]
push ecx
call esi
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x1c]
call fcn.004027a0
push 0x4eb6bc
lea ecx, [esp + 0x1c]
call fcn.00418290
mov eax, dword [esp + 0x18]
push eax
call esi
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x1c]
call fcn.004027a0
push 0x4eb694
lea ecx, [esp + 0x1c]
call fcn.00418290
mov edx, dword [esp + 0x18]
push edx
call esi
sub esp, 8
mov ecx, esp
mov dword [esp + 0x18], esp
push str.PUBLIC
call fcn.00418470
mov byte [esp + 0x5c], 0x16
lea eax, [esp + 0x40]
push eax
mov byte [esp + 0x60], bl
call fcn.0040d720
add esp, 0xc
mov byte [esp + 0x54], 0x17
cmp dword [ebp + 0x1c], 0
je 0x410c42
lea ecx, [esp + 0x38]
call fcn.004173d0
test eax, eax
jle 0x410c42
push str.Desktop
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00404a80
add esp, 0xc
mov byte [esp + 0x54], 0x18
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
call fcn.004027a0
push 0x4eb6bc
lea ecx, [esp + 0x1c]
call fcn.00418290
mov ecx, dword [esp + 0x18]
push ecx
call esi
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x1c]
call fcn.004027a0
push 0x4eb694
lea ecx, [esp + 0x1c]
call fcn.00418290
mov eax, dword [esp + 0x18]
push eax
call esi
mov byte [esp + 0x54], 0x17
lea ecx, [esp + 0x10]
call fcn.00417490
cmp dword [ebp + 0x14], 0
je 0x410c53
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp dword [ebp + 0x10], 0
je 0x410fce
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x410c82
mov eax, dword [esp + 0x20]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x410e05
mov eax, 0x4eb6bc
test edi, edi
jne 0x410c90
mov eax, 0x4eb694
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x48]
push edx
call fcn.00404a80
add esp, 0xc
mov byte [esp + 0x54], 0x19
push eax
lea ecx, [esp + 0x1c]
call fcn.004027a0
mov byte [esp + 0x54], 0x17
lea ecx, [esp + 0x40]
call fcn.00417490
mov eax, 0x4e97bc
test edi, edi
jne 0x410cce
mov eax, str.Mail.Ru_Agent
mov ecx, dword [ebp + 8]
push 0
push eax
mov eax, dword [esp + 0x20]
push eax
push 0x4e88c0
push ecx
call fcn.0040cd10
add esp, 0x14
test eax, eax
jne 0x410e05
mov eax, 0x4eb638
test edi, edi
jne 0x410cfd
mov eax, str.Uninstall_Mail.Ru_Agent.lnk
push eax
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.00404a80
add esp, 0xc
mov byte [esp + 0x54], 0x1a
push eax
lea ecx, [esp + 0x1c]
call fcn.004027a0
mov byte [esp + 0x54], 0x17
lea ecx, [esp + 0x40]
call fcn.00417490
mov ecx, 0x4eb5d0
test edi, edi
jne 0x410d3b
mov ecx, str.Uninstall_Mail.Ru_Agent
cmp dword [ebp + 0x1c], 0
mov eax, str._uninstalllm
jne 0x410d4b
mov eax, str._uninstallcu
mov edx, dword [ebp + 0xc]
push 1
push ecx
mov ecx, dword [esp + 0x20]
push ecx
push eax
push edx
call fcn.0040cd10
add esp, 0x14
test eax, eax
jne 0x410e05
mov eax, 0x4eb70c
test edi, edi
jne 0x410d76
mov eax, str.Mail.Ru_Portal.lnk
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.00404a80
add esp, 0xc
mov byte [esp + 0x54], 0x1b
push eax
lea ecx, [esp + 0x1c]
call fcn.004027a0
mov byte [esp + 0x54], 0x17
lea ecx, [esp + 0x40]
call fcn.00417490
lea ecx, [esp + 0x10]
call fcn.004173e0
mov byte [esp + 0x54], 0x1c
push 0x53032c
lea edx, [esp + 0x14]
push str.http:__www.mail.ru_mra_lang_s
push edx
call fcn.00404b40
add esp, 0xc
mov eax, 0x4eb540
test edi, edi
jne 0x410dd9
mov eax, str.Mail.Ru_Portal
mov ecx, dword [esp + 0x10]
push 0xffffffffffffffff
push eax
mov eax, dword [esp + 0x20]
push eax
push 0x4e88c0
push ecx
call fcn.0040cd10
add esp, 0x14
test eax, eax
je 0x410e61
mov byte [esp + 0x54], 0x17
lea ecx, [esp + 0x10]
call fcn.00417490
mov byte [esp + 0x54], bl
lea ecx, [esp + 0x38]
call fcn.00417490
mov byte [esp + 0x54], 2
lea ecx, [esp + 0x20]
call fcn.00417490
mov byte [esp + 0x54], 1
lea ecx, [esp + 0x28]
call fcn.00417490
mov byte [esp + 0x54], 0
lea ecx, [esp + 0x30]
call fcn.00417490
mov dword [esp + 0x54], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00417490
xor eax, eax
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], 0
je 0x410edb
mov eax, 0x4eb6bc
test edi, edi
jne 0x410e75
mov eax, 0x4eb694
push eax
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.00404a80
add esp, 0xc
mov byte [esp + 0x54], 0x1d
push eax
lea ecx, [esp + 0x1c]
call fcn.004027a0
mov byte [esp + 0x54], 0x1c
lea ecx, [esp + 0x40]
call fcn.00417490
mov ecx, dword [esp + 0x18]
push ecx
call esi
mov eax, 0x4e97bc
test edi, edi
jne 0x410eba
mov eax, str.Mail.Ru_Agent
mov edx, dword [esp + 0x18]
push 0
push eax
mov eax, dword [ebp + 8]
push edx
push 0x4e88c0
push eax
call fcn.0040cd10
add esp, 0x14
test eax, eax
jne 0x410df7
cmp dword [ebp + 0x20], 0
je 0x410fc0
lea ecx, [esp + 0x40]
push ecx
call fcn.0040ebc0
add esp, 4
mov byte [esp + 0x54], 0x1e
push eax
lea ecx, [esp + 0x1c]
call fcn.004027a0
mov byte [esp + 0x54], 0x1c
lea ecx, [esp + 0x40]
call fcn.00417490
mov eax, 0x4eb6bc
test edi, edi
jne 0x410f1d
mov eax, 0x4eb694
push eax
lea ecx, [esp + 0x1c]
call fcn.00418290
mov edx, dword [esp + 0x18]
mov eax, dword [ebp + 8]
push 0
push 0x4e88c0
push edx
push 0x4e88c0
push eax
call fcn.0040cd10
add esp, 0x14
test eax, eax
jne 0x410df7
mov eax, 0x4eb6bc
test edi, edi
jne 0x410f5a
mov eax, 0x4eb694
push eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x48]
push edx
call fcn.00404a80
add esp, 0xc
mov byte [esp + 0x54], 0x1f
push eax
lea ecx, [esp + 0x1c]
call fcn.004027a0
mov byte [esp + 0x54], 0x1c
lea ecx, [esp + 0x40]
call fcn.00417490
mov eax, dword [esp + 0x18]
push eax
call esi
mov eax, 0x4e97bc
test edi, edi
jne 0x410f9f
mov eax, str.Mail.Ru_Agent
mov ecx, dword [esp + 0x18]
mov edx, dword [ebp + 8]
push 0
push eax
push ecx
push 0x4e88c0
push edx
call fcn.0040cd10
add esp, 0x14
test eax, eax
jne 0x410df7
mov byte [esp + 0x54], 0x17
lea ecx, [esp + 0x10]
call fcn.00417490
mov byte [esp + 0x54], bl
lea ecx, [esp + 0x38]
call fcn.00417490
mov byte [esp + 0x54], 2
lea ecx, [esp + 0x20]
call fcn.00417490
mov byte [esp + 0x54], 1
lea ecx, [esp + 0x28]
call fcn.00417490
mov byte [esp + 0x54], 0
lea ecx, [esp + 0x30]
call fcn.00417490
mov dword [esp + 0x54], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00417490
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.004010d0
int3