Function at 0x40e150
Capabilities:
Check if file exists
Copy file
Create directory
Encode data using xor
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505aeb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c8
push ebx
push esi
push edi
mov bh, cl
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x64], 0xf
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x78], al
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], al
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], al
mov byte [ebp - 4], 4
xor bl, bl
mov dword [ebp - 0x14], 0xddd8dfa8
xor ecx, ecx
mov word [ebp - 0x10], 0x100
lea esp, [esp]
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x14], al
inc ecx
cmp ecx, 4
jb 0x40e1e0
lea ecx, [ebp - 0x14]
mov byte [ebp - 0xf], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e1f7
sub ecx, edx
mov eax, closesocket
mov edx, dword [ebp + 0x18]
sub eax, edx
cmp eax, ecx
jb 0x40e78f
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
jb 0x40e21e
mov eax, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x48]
call fcn.004720e0
mov ecx, dword [ebp - 0x4c]
cmp ecx, 0x10
jb 0x40e265
mov edx, dword [ebp - 0x60]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40e25b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e79a
push ecx
push edx
call fcn.004df511
add esp, 8
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x60]
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x4c], eax
cmp eax, 0x10
jb 0x40e293
mov ecx, edx
lea eax, [ebp - 0x1d4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov dword [ebp - 0x18], esi
cmp esi, 0xffffffff
je 0x40e623
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40e2c0
cmp byte [ebp - 0x1a8], 0x2e
je 0x40e5fc
cmp dword [ebp - 0x64], 0x10
lea eax, [ebp - 0x78]
jb 0x40e2d9
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x68], 0
mov byte [eax], 0
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 0x10
jb 0x40e2ef
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], 0
mov byte [eax], 0
mov eax, closesocket
mov ecx, dword [ebp + 0x18]
sub eax, ecx
cmp eax, 1
jb 0x40e78f
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
jb 0x40e318
mov eax, dword [ebp + 8]
push 1
push 0x5224ac
push ecx
push eax
push ecx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x94]
call fcn.004720e0
lea eax, [ebp - 0x1a8]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x94]
call fcn.0046a480
mov edx, eax
mov ecx, dword [edx]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x48], ecx
mov ecx, dword [edx + 4]
mov dword [ebp - 0x44], ecx
mov ecx, dword [edx + 8]
mov dword [ebp - 0x40], ecx
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x78]
push eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
call fcn.0046a5f0
mov ecx, dword [ebp - 0x34]
cmp ecx, 0x10
jb 0x40e3bc
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40e3b2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e79a
push ecx
push edx
call fcn.004df511
add esp, 8
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x80]
cmp ecx, 0x10
jb 0x40e3f7
mov edx, dword [ebp - 0x94]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40e3ed
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e79a
push ecx
push edx
call fcn.004df511
add esp, 8
mov ecx, dword [ebp + 0x30]
mov eax, closesocket
sub eax, ecx
cmp eax, 1
jb 0x40e78f
cmp dword [ebp + 0x34], 0x10
lea eax, [ebp + 0x20]
jb 0x40e416
mov eax, dword [ebp + 0x20]
push 1
push 0x5224ac
push ecx
push eax
push ecx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x94]
call fcn.004720e0
lea eax, [ebp - 0x1a8]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x94]
call fcn.0046a480
mov edx, eax
mov ecx, dword [edx]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x48], ecx
mov ecx, dword [edx + 4]
mov dword [ebp - 0x44], ecx
mov ecx, dword [edx + 8]
mov dword [ebp - 0x40], ecx
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x30]
push eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
call fcn.0046a5f0
mov ecx, dword [ebp - 0x34]
cmp ecx, 0x10
jb 0x40e4ba
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40e4b0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e79a
push ecx
push edx
call fcn.004df511
add esp, 8
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x80]
cmp ecx, 0x10
jb 0x40e4f5
mov edx, dword [ebp - 0x94]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40e4eb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e79a
push ecx
push edx
call fcn.004df511
add esp, 8
test byte [ebp - 0x1d4], 0x10
je 0x40e5d4
cmp dword [ebp - 0x1c], 0x10
lea esi, [ebp - 0x30]
jb 0x40e50e
mov esi, dword [ebp - 0x30]
push 0x5374a0
call fcn.004de812
add esp, 4
test eax, eax
jne 0x40e794
test esi, esi
je 0x40e56c
mov ecx, esi
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e530
sub ecx, edx
je 0x40e56c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40e55d
call edi
cmp eax, 0x44
je 0x40e55d
cmp eax, 0x20
je 0x40e55d
cmp eax, 0x45
je 0x40e55d
cmp eax, 0x24
jne 0x40e56c
push 0x5374a0
call fcn.004de823
add esp, 4
jmp 0x40e596
push 0x5374a0
call fcn.004de823
add esp, 4
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 0x10
jb 0x40e585
mov eax, dword [ebp - 0x30]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40e630
sub esp, 0x18
lea eax, [ebp - 0x30]
mov ecx, esp
mov dword [ebp - 0x7c], esp
mov bl, 1
push eax
call fcn.0046a770
sub esp, 0x18
mov byte [ebp - 4], 7
lea eax, [ebp - 0x78]
mov ecx, esp
push eax
call fcn.0046a770
mov cl, bl
mov byte [ebp - 4], 4
call fcn.0040e150
mov esi, eax
add esp, 0x30
test esi, esi
jne 0x40e638
mov esi, dword [ebp - 0x18]
jmp 0x40e5fa
cmp dword [ebp - 0x1c], 0x10
lea ecx, [ebp - 0x30]
jb 0x40e5e0
mov ecx, dword [ebp - 0x30]
cmp dword [ebp - 0x64], 0x10
lea eax, [ebp - 0x78]
jb 0x40e5ec
mov eax, dword [ebp - 0x78]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x40e630
mov bl, 1
lea eax, [ebp - 0x1d4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
je 0x40e2c0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
call edi
mov esi, eax
cmp esi, 0x12
jne 0x40e638
test bh, bh
jne 0x40e636
test bl, bl
jne 0x40e636
or esi, 0xffffffff
jmp 0x40e638
call edi
mov esi, eax
jmp 0x40e638
xor esi, esi
mov ecx, dword [ebp - 0x4c]
cmp ecx, 0x10
jb 0x40e66c
mov edx, dword [ebp - 0x60]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40e662
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e79a
push ecx
push edx
call fcn.004df511
add esp, 8
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
cmp ecx, 0x10
jb 0x40e6b2
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40e6a8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e79a
push ecx
push edx
call fcn.004df511
add esp, 8
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
cmp ecx, 0x10
jb 0x40e6f8
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40e6ee
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e79a
push ecx
push edx
call fcn.004df511
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0xf
mov byte [ebp - 0x78], 0
cmp ecx, 0x10
jb 0x40e73a
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40e730
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e79a
push ecx
push edx
call fcn.004df511
add esp, 8
mov ecx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp ecx, 0x10
jb 0x40e77c
mov edx, dword [ebp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40e772
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e79a
push ecx
push edx
call fcn.004df511
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00402270
push eax
call fcn.004de4bb
call fcn.004e47b0
int3