Function at 0x403541
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa64
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, 0x41467c
mov dword [ebp - 0xa58], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0xa54], eax
mov eax, dword [0x417fec]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xa60], eax
mov eax, esi
push edi
mov dx, word [eax]
xor ebx, ebx
cmp dx, word [ecx]
jne 0x4035a6
test dx, dx
je 0x4035a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4035a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x40357e
mov eax, ebx
jmp 0x4035ab
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4035c9
push 0x10
push 0x414a90
push 0x414a98
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push ebx
push eax
call fcn.00406660
xor eax, eax
push edi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.00406660
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x418]
add esp, 0x18
push esi
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x418]
push 0x414ad0
push eax
call edi
xor ecx, ecx
lea eax, [ebp - 0xa50]
push ecx
push ecx
push ecx
push eax
push ecx
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov dword [ebp - 0xa5c], eax
cmp eax, 0xffffffff
jne 0x40364f
xor al, al
jmp 0x40388b
test byte [ebp - 0xa50], 0x10
lea eax, [ebp - 0xa24]
push 0x414ad8
push eax
jne 0x403778
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40380d
push 0x414adc
lea eax, [ebp - 0xa24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40380d
lea eax, [ebp - 0xa24]
push eax
push 0x41467c
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x40380d
push 0x208
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00406660
add esp, 0xc
lea eax, [ebp - 0x210]
push esi
push eax
call ebx
push 0x4148a4
lea eax, [ebp - 0x210]
push eax
call edi
lea eax, [ebp - 0xa24]
push eax
lea eax, [ebp - 0x210]
push eax
call edi
cmp dword [ebp - 0xa58], 0
je 0x40374e
cmp dword [ebp - 0xa54], 0
je 0x40374e
xor eax, eax
push 0x3e6
push eax
mov word [ebp - 0x800], ax
lea eax, [ebp - 0x7fe]
push eax
call fcn.00406660
lea eax, [ebp - 0xa24]
push eax
lea eax, [ebp - 0x800]
push str.ck_W_Rd
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x800]
push eax
push dword [ebp - 0xa54]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 0xa58]
call fcn.00403245
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40380d
push 4
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x40380d
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40380d
push 0x414adc
lea eax, [ebp - 0xa24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40380d
lea eax, [ebp - 0xa24]
push eax
push 0x41467c
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x40380d
push 0x208
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00406660
add esp, 0xc
lea eax, [ebp - 0x210]
push esi
push eax
call ebx
push 0x4148a4
lea eax, [ebp - 0x210]
push eax
call edi
lea eax, [ebp - 0xa24]
push eax
lea eax, [ebp - 0x210]
push eax
call edi
push dword [ebp - 0xa54]
mov ecx, dword [ebp - 0xa60]
lea eax, [ebp - 0x210]
push dword [ebp - 0xa58]
push eax
call fcn.00403272
lea eax, [ebp - 0xa50]
push eax
push dword [ebp - 0xa5c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40364f
push dword [ebp - 0xa5c]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
lea eax, [ebp - 0x418]
push eax
call ebx
push 0x414af4
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.00403215
push eax
lea eax, [ebp - 0x418]
push eax
call edi
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40387d
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
dec eax
neg eax
sbb al, al
inc al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403fe4
mov esp, ebp
pop ebp
ret 0x10