Function at 0x4155bb
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.00414f03
xor edi, edi
inc edi
test al, al
je 0x415658
call fcn.0042aae1
test al, al
je 0x4155f7
lodsb al, byte [esi]
push cs
jmp 0x5ef4567c
call fcn.0042aa57
test al, al
je 0x415618
jns 0x41563f
lcall 0x8ea, 0x6005c4ca
mov al, 0x4f
adc dword [edi + 0x25c6b861], 0x10dfab7e
pop es
xor ebx, ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
call fcn.00414d6b
pop ecx
test al, al
je 0x415658
push dword [ebp + 0xc]
push edi
push dword [ebp - 8]
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, bl
cmove ebx, edi
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x4156a3
call fcn.0042ab6b
test al, al
je 0x415680
cwde
cwde
jbe 0x415663
stosb byte es:[edi], al
ljmp 0xb293
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edx, dword [ebp - 4]
test eax, eax
push 1
movzx ecx, dl
pop eax
cmovne ecx, eax
mov byte [ebp - 4], cl
call fcn.0042af76
test al, al
je 0x4156c7
sar dh, 0x48
mov dword [ebx + 0x7189e64a], 0xe2044a93
adc eax, 0x1c38259e
sbb byte [ebx + 0x2543f24a], ch
dec ebx
loop 0x41573d
mov edx, dword [ebp - 4]
mov al, dl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.005693c7
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x58]
call fcn.00402a71
mov esi, 0x5a3400
mov byte [ebp - 4], 1
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x58]
call fcn.00408c34
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x2a8]
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push ecx
inc ebp
test al, 0xf
inc ebx
inc ebp
test al, 0x51
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2ac], eax
call fcn.0042ae62
test al, al
je 0x4157a5
sub cl, bh
cmpsb byte [esi], byte es:[edi]
lodsb al, byte ss:[esi]
sar dword [esi - 0x44ad9589], cl
ret
call fcn.0042ab6b
test al, al
je 0x4157cd
mov edx, 0x5a7a9ad4
enter 0xffffffffffffd147, 0xffffffffffffff92
stosd dword es:[edi], eax
out 0xbd, eax
jmp 0x92479c56
call fcn.0042a988
test al, al
je 0x4157ec
shr dword [edi], cl
mov bl, 0x6f
jns 0x415777
sbb dword [edx - 0x62cc14c1], ebx
inc ebx
jne 0x41582c
iretd
mov eax, dword [ebp - 0x2ac]
cmp eax, 0xffffffff
je 0x415928
push 0x2e
pop esi
mov edi, 0x5a0a50
lea ecx, [ebp - 0x2a8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x415928
cmp word [ebp - 0x27c], si
je 0x41591d
cmp word [ebp - 0x27a], 0
inc dword [eax]
je 0x41591d
cmp word [ebp - 0x27a], si
jne 0x41584b
cmp word [ebp - 0x278], 0
je 0x41591d
xor eax, eax
mov dword [ebp - 0x2c], 7
xor ebx, ebx
mov word [ebp - 0x40], ax
mov dword [ebp - 0x30], ebx
cmp word [ebp - 0x27c], ax
je 0x415873
lea eax, [ebp - 0x27c]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x40]
call fcn.00403772
test byte [ebp - 0x2a8], 0x10
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
je 0x4158d5
call fcn.00402a71
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x28]
call fcn.00408b95
push edi
call fcn.00578706
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00408c34
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00402a71
call fcn.00415733
jmp 0x415900
call fcn.00402a71
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x28]
call fcn.00408b95
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00402a71
call fcn.004159ca
add esp, 0x18
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.00403628
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00403628
fcom dword [ebx + 0x6a]
add eax, ebp
sbb bl, ch
invalid
mov eax, dword [ebp - 0x2ac]
jmp 0x415803
invalid
call fcn.0042ab6b
test al, al
je 0x41594c
std
rcr dword [ebp + ebp + 0x6f1e1c07], cl
outsd dx, dword [esi]
and eax, 0xacc728b4
and ah, byte [ebx]
rol bl, cl
mov al, byte [0x466df034]
jno 0x415925
fld1
rcl dword [eax + 1], 0
call fcn.0042aa12
test al, al
je 0x415973
fmul dword [0xf6233a1c]
push 0x887e4c12
mov eax, 0x630f14ca
movsd dword es:[edi], dword [esi]
movd mm5, ebx
inc edx
pushfd
jmp 0x415905
mov eax, dword [ebp - 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4159ac
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 4
cmovae eax, dword [ebp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.00403628
push 0
push 1
lea ecx, [ebp + 8]
call fcn.00403628
call fcn.00569382
ret