Function at 0x402150
Capabilities:
Create directory
Create process on windows
Delete file
Get common file path
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x40de81
mov eax, dword fs:[0]
push eax
mov eax, 0x2bd8
mov dword fs:[0], esp
call fcn.00405510
mov eax, dword [0x412240]
xor eax, esp
push ebx
mov dword [esp + 0x2bd8], eax
mov eax, dword [esp + 0x2bf0]
push ebp
mov ebp, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
push esi
mov esi, dword [esp + 0x2bf4]
je 0x4021a9
push eax
call fcn.00404c89
add esp, 4
mov dword [ebp + 8], ebx
lea ecx, [esp + 0x6cc]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
call fcn.004057d6
push eax
lea edx, [esp + 0x6d4]
push edx
lea eax, [esp + 0x4d0]
push str._sTM_ld.txt
push eax
call fcn.00405314
add esp, 0x14
push 0x104
lea ecx, [esp + 0x2c0]
push ecx
push 0xffffffffffffffff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push 0xfde9
call esi
lea edx, [esp + 0x2bc]
push 0x40e378
push edx
call fcn.00404d94
add esp, 8
cmp eax, ebx
mov dword [ebp], eax
jne 0x402221
xor al, al
jmp 0x40297c
push edi
push eax
push 1
lea eax, [esp + 0x20]
push 4
push eax
mov dword [esp + 0x28], ebx
call fcn.0040546c
add esp, 0x10
test eax, eax
je 0x4027c1
mov edi, 0xf
mov ecx, dword [ebp]
mov edx, dword [esp + 0x18]
push ecx
push edx
lea eax, [esp + 0x8e0]
push 1
push eax
call fcn.0040546c
add esp, 0x10
test eax, eax
je 0x402810
mov eax, dword [esp + 0x24]
mov dword [esp + 0x98], edi
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402284
mov ecx, dword [esp + 0x24]
sub eax, edx
push eax
push ecx
lea ecx, [esp + 0x88]
call fcn.004016d0
cmp dword [esp + 0x98], 0x10
mov eax, dword [esp + 0x84]
mov dword [esp + 0x2bf0], ebx
jae 0x4022be
lea eax, [esp + 0x84]
mov edx, dword [esp + 0x94]
cmp byte [eax + edx - 1], 0x5c
je 0x4022df
push 1
push 0x40e374
lea ecx, [esp + 0x88]
call fcn.00402000
lea eax, [esp + 0x8d8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4022f0
sub eax, edx
push eax
lea eax, [esp + 0x8dc]
push eax
lea ecx, [esp + 0x88]
call fcn.00402000
push 1
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x8c]
mov byte [esp + 0x1c], 0x5c
call fcn.00401e70
mov dword [esp + 0xb4], edi
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
cmp eax, 0xffffffff
mov byte [esp + 0x2bf0], 1
je 0x402405
push eax
push ebx
lea edx, [esp + 0x6c]
push edx
lea ecx, [esp + 0x8c]
call fcn.00402110
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xa8]
mov byte [esp + 0x2bfc], 2
call fcn.004015e0
cmp dword [esp + 0x7c], 0x10
mov byte [esp + 0x2bf0], 1
jb 0x402395
mov eax, dword [esp + 0x68]
push eax
call fcn.00404dfc
add esp, 4
mov eax, dword [esp + 0xb0]
cmp eax, ebx
mov dword [esp + 0x7c], edi
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
jbe 0x402405
cmp eax, 2
je 0x402405
cmp dword [esp + 0xb4], 0x10
mov eax, dword [esp + 0xa0]
jae 0x4023c9
lea eax, [esp + 0xa0]
push 0x104
lea ecx, [esp + 0xbc]
push ecx
push 0xffffffffffffffff
push eax
push ebx
push 0xfde9
call esi
push ebx
lea edx, [esp + 0xbc]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
cmp eax, ebx
je 0x402405
cmp eax, 0x50
je 0x402405
cmp eax, 0xb7
jne 0x402824
mov eax, dword [ebp]
push eax
push 1
lea ecx, [esp + 0x28]
push 4
push ecx
mov dword [esp + 0x30], ebx
call fcn.0040546c
add esp, 0x10
test eax, eax
je 0x40282d
mov edx, dword [ebp]
push edx
push 1
lea eax, [esp + 0x30]
push 2
push eax
mov dword [esp + 0x38], ebx
call fcn.0040546c
add esp, 0x10
test eax, eax
je 0x40284d
cmp dword [esp + 0x98], 0x10
mov eax, dword [esp + 0x84]
jae 0x40245f
lea eax, [esp + 0x84]
push 0x104
lea ecx, [esp + 0xbc]
push ecx
push 0xffffffffffffffff
push eax
push ebx
push 0xfde9
call esi
lea edx, [esp + 0xb8]
push 0x40e36c
push edx
call fcn.00404d94
add esp, 8
cmp eax, ebx
mov dword [ebp + 4], eax
jne 0x40255a
mov eax, dword [ebp + 8]
cmp eax, ebx
jne 0x4024cf
lea eax, [esp + 0x4c8]
push 0x40e18c
push eax
call fcn.00404d94
add esp, 8
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x4024c8
push str.The_following_files_failed_to_copy_to_the_destination:_n_n
push eax
call fcn.00405778
add esp, 8
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x4024e5
lea ecx, [esp + 0xb8]
push ecx
push 0x40e2ec
push eax
call fcn.00405778
add esp, 0xc
mov edx, dword [esp + 0x20]
mov eax, dword [ebp]
push 1
push edx
push eax
call fcn.0040572f
mov eax, dword [esp + 0xc0]
add esp, 0xc
cmp eax, 0x10
jb 0x402514
mov ecx, dword [esp + 0xa0]
push ecx
call fcn.00404dfc
add esp, 4
cmp dword [esp + 0x98], 0x10
mov dword [esp + 0xb4], edi
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
mov dword [esp + 0x2bf0], 0xffffffff
jb 0x40254e
mov edx, dword [esp + 0x84]
push edx
call fcn.00404dfc
add esp, 4
mov dword [esp + 0x98], edi
jmp 0x402792
push 0x38
lea eax, [esp + 0x30]
push str.1.1.4
push eax
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
call fcn.00402b06
lea ecx, [esp + 0x1bf0]
lea edx, [esp + 0xbf0]
add esp, 0xc
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], 0x1000
mov dword [esp + 0x1c], ebx
mov esi, ebx
cmp dword [esp + 0x30], ebx
jne 0x4025f4
lea eax, [esp + 0x1be4]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x20]
cmp esi, eax
jae 0x40266a
mov ecx, dword [ebp]
sub eax, esi
cmp eax, 0x1000
lea edx, [esp + 0x1be4]
push ecx
jbe 0x4025da
push 0x1000
jmp 0x4025db
push eax
push 1
push edx
call fcn.0040546c
add esi, eax
add esp, 0x10
cmp eax, ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], esi
je 0x40266a
lea eax, [esp + 0x2c]
push ebx
push eax
call fcn.00402b1d
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x44]
mov edi, 0x1000
add esp, 8
sub edi, eax
je 0x402660
xor esi, esi
cmp edi, ebx
jle 0x402649
lea esp, [esp]
mov ecx, dword [ebp + 4]
push ecx
mov edx, edi
sub edx, esi
push edx
lea eax, [esp + esi + 0xbec]
push 1
push eax
call fcn.00405654
add esp, 0x10
cmp eax, ebx
je 0x40286d
add esi, eax
cmp esi, edi
jl 0x402620
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0xbe4]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], 0x1000
cmp dword [esp + 0x14], ebx
je 0x4025a2
lea edx, [esp + 0x2c]
push 4
push edx
call fcn.00402b1d
mov edi, eax
mov eax, dword [esp + 0x44]
mov esi, 0x1000
add esp, 8
sub esi, eax
mov dword [esp + 0x14], edi
je 0x4026fc
lea esp, [esp]
xor edi, edi
cmp esi, ebx
jle 0x4026bf
mov eax, dword [ebp + 4]
push eax
mov ecx, esi
sub ecx, edi
push ecx
lea edx, [esp + edi + 0xbec]
push 1
push edx
call fcn.00405654
add esp, 0x10
cmp eax, ebx
je 0x4028e3
add edi, eax
cmp edi, esi
jl 0x402696
lea eax, [esp + 0xbe4]
mov dword [esp + 0x38], eax
cmp dword [esp + 0x14], ebx
mov dword [esp + 0x3c], 0x1000
jne 0x4026f8
lea ecx, [esp + 0x2c]
push 4
push ecx
call fcn.00402b1d
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x44]
mov esi, 0x1000
add esp, 8
sub esi, eax
jne 0x402690
mov edi, dword [esp + 0x14]
lea edx, [esp + 0x2c]
push edx
call fcn.004029e3
mov eax, dword [ebp + 4]
push eax
call fcn.00404c89
add esp, 8
cmp edi, ebx
mov dword [ebp + 4], ebx
je 0x402722
cmp edi, 1
jne 0x402952
mov eax, dword [esp + 0xb4]
mov edi, 0x10
cmp eax, edi
jb 0x402742
mov ecx, dword [esp + 0xa0]
push ecx
call fcn.00404dfc
add esp, 4
cmp dword [esp + 0x98], edi
mov esi, 0xf
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
mov dword [esp + 0x2bf0], 0xffffffff
jb 0x402780
mov edx, dword [esp + 0x84]
push edx
call fcn.00404dfc
add esp, 4
mov dword [esp + 0x98], esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, 0xf
mov eax, dword [ebp]
push eax
push 1
lea ecx, [esp + 0x20]
push 4
push ecx
mov dword [esp + 0xa4], ebx
mov byte [esp + 0x94], bl
mov dword [esp + 0x28], ebx
call fcn.0040546c
add esp, 0x10
test eax, eax
jne 0x402245
mov edx, dword [ebp]
push edx
call fcn.00404c89
add esp, 4
lea eax, [esp + 0x2c0]
push eax
mov dword [ebp], ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x402809
push eax
call fcn.00404c89
add esp, 4
push 1
push ebx
push ebx
lea ecx, [esp + 0x4d4]
push ecx
push str.Open
push ebx
mov dword [ebp + 8], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, 1
jmp 0x40297b
mov edx, dword [ebp]
push edx
call fcn.00404c89
add esp, 4
mov dword [ebp], ebx
jmp 0x402979
mov eax, dword [ebp]
push eax
jmp 0x402956
mov ecx, dword [ebp]
push ecx
call fcn.00404c89
mov edx, dword [ebp + 4]
push edx
mov dword [ebp], ebx
call fcn.00404c89
add esp, 8
mov dword [ebp + 4], ebx
jmp 0x402961
mov eax, dword [ebp]
push eax
call fcn.00404c89
mov ecx, dword [ebp + 4]
push ecx
mov dword [ebp], ebx
call fcn.00404c89
add esp, 8
mov dword [ebp + 4], ebx
jmp 0x402961
mov edx, dword [ebp]
push edx
call fcn.00404c89
mov eax, dword [ebp + 4]
push eax
mov dword [ebp], ebx
call fcn.00404c89
mov eax, dword [esp + 0xbc]
mov esi, 0x10
add esp, 8
cmp eax, esi
mov dword [ebp + 4], ebx
jb 0x4028a8
mov ecx, dword [esp + 0xa0]
push ecx
call fcn.00404dfc
add esp, 4
cmp dword [esp + 0x98], esi
mov dword [esp + 0xb4], 0xf
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
jb 0x402979
mov edx, dword [esp + 0x84]
push edx
call fcn.00404dfc
add esp, 4
jmp 0x402979
mov eax, dword [ebp]
push eax
call fcn.00404c89
mov ecx, dword [ebp + 4]
push ecx
mov dword [ebp], ebx
call fcn.00404c89
mov eax, dword [esp + 0xbc]
mov esi, 0x10
add esp, 8
cmp eax, esi
mov dword [ebp + 4], ebx
jb 0x40291e
mov edx, dword [esp + 0xa0]
push edx
call fcn.00404dfc
add esp, 4
cmp dword [esp + 0x98], esi
mov dword [esp + 0xb4], 0xf
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
jb 0x402979
mov eax, dword [esp + 0x84]
push eax
call fcn.00404dfc
add esp, 4
jmp 0x402979
mov ecx, dword [ebp]
push ecx
call fcn.00404c89
mov dword [ebp], ebx
add esp, 4
lea ecx, [esp + 0x9c]
call fcn.004015b0
lea ecx, [esp + 0x80]
call fcn.004015b0
xor al, al
pop edi
mov ecx, dword [esp + 0x2be4]
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x2bd8]
pop ebx
xor ecx, esp
call fcn.00404dee
add esp, 0x2be4
ret 8