Function at 0x1400849b0
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Get common file path
Get file attributes
Hash data with md5
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa90]
sub rsp, 0xb90
mov r13, rcx
lea rax, [rbp - 8]
mov qword [rbp - 0x18], rax
xor r14d, r14d
mov dword [rbp - 0x10], r14d
mov dword [rbp - 0xc], 0x104
mov word [rbp - 8], r14w
lea rcx, [0x1401b6698]
mov qword [rbp - 0x20], rcx
lea rax, [rbp + 0x218]
mov qword [rbp + 0x208], rax
mov dword [rbp + 0x210], r14d
mov dword [rbp + 0x214], 0x104
mov word [rbp + 0x218], r14w
mov qword [rbp + 0x200], rcx
lea rdi, [rsp + 0x48]
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosd dword [rdi], eax
lea rdi, [rbp - 0x78]
mov ecx, 4
rep stosd dword [rdi], eax
mov byte [rbp - 0x68], al
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r14 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140084aa0
mov edx, dword [rbp - 0xc]
call fcn.14003c464
mov dword [rbp - 0x10], eax
jmp 0x140084aa4
mov dword [rbp - 0x10], r14d
mov rcx, qword [rbp + 0x208]
test rcx, rcx
je 0x140084b0a
mov esi, dword [0x1401f23b0]
mov eax, dword [rbp + 0x214]
cmp esi, eax
jb 0x140084ac3
lea esi, [rax - 1]
mov eax, esi
lea rdi, [rax + rax]
mov r8, rdi
mov rdx, qword [0x1401f23a8]
call fcn.14014cbf0
mov dword [rbp + 0x210], esi
mov rax, qword [rbp + 0x208]
mov word [rax + rdi], r14w
mov rcx, qword [rbp + 0x208]
test rcx, rcx
je 0x140084b0a
mov edx, dword [rbp + 0x210]
inc edx
call fcn.1400418c0
mov rcx, qword [rbp + 0x208]
mov byte [rbp - 0x68], 0
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
mov eax, dword [rbp + 0x210]
lea r8d, [rax + rax]
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.1400713a0
movzx r8d, byte [rbp - 0x68]
test r8b, r8b
jne 0x140084d8e
lea rdi, [rbp + 0xac0]
lea rsi, [rsp + 0x40]
mov ecx, 2
rep movsd dword [rdi], dword [rsi]
mov edx, dword [rsp + 0x40]
mov ecx, edx
shr ecx, 3
and ecx, 0x3f
mov eax, 0x78
sub eax, ecx
mov r15d, 0x38
sub r15d, ecx
cmp ecx, 0x38
cmovae r15d, eax
mov ebx, 0x40
cmp r15d, 1
jb 0x140084c8a
lea eax, [r15*8]
add edx, eax
mov dword [rsp + 0x40], edx
cmp edx, eax
mov edx, dword [rsp + 0x44]
jae 0x140084bb5
inc edx
mov eax, r15d
shr eax, 0x1d
add edx, eax
mov dword [rsp + 0x44], edx
mov r14d, ebx
sub r14d, ecx
lea r12, [0x1401f1e70]
cmp r15d, r14d
jb 0x140084c40
mov edx, r14d
mov eax, ecx
lea r8, [rsp + 0x48]
add r8, rax
mov ecx, r14d
shr rcx, 2
mov rsi, r12
mov rdi, r8
rep movsd dword [rdi], dword [rsi]
mov ecx, r14d
and ecx, 3
je 0x140084c05
and rdx, 0xfffffffffffffffc
lea rsi, [rdx + r12]
lea rdi, [rdx + r8]
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.140070710
lea eax, [r14 + 0x3f]
cmp eax, r15d
jae 0x140084c3c
nop dword [rax]
mov edx, r14d
add rdx, r12
lea rcx, [rsp + 0x30]
call fcn.140070710
add r14d, ebx
lea eax, [r14 + 0x3f]
cmp eax, r15d
jb 0x140084c20
xor ecx, ecx
jmp 0x140084c43
xor r14d, r14d
sub r15d, r14d
mov edx, r15d
mov r8d, r14d
add r8, r12
mov eax, ecx
lea r9, [rsp + 0x48]
add r9, rax
mov ecx, r15d
shr rcx, 2
mov rdi, r9
mov rsi, r8
rep movsd dword [rdi], dword [rsi]
mov ecx, r15d
and ecx, 3
je 0x140084c7e
and rdx, 0xfffffffffffffffc
lea rsi, [rdx + r8]
lea rdi, [rdx + r9]
rep movsb byte [rdi], byte [rsi]
xor r14d, r14d
mov edx, dword [rsp + 0x40]
movzx r8d, byte [rbp - 0x68]
test r8b, r8b
jne 0x140084d69
mov ecx, edx
shr ecx, 3
and ecx, 0x3f
add edx, ebx
mov dword [rsp + 0x40], edx
cmp edx, ebx
jae 0x140084ca9
inc dword [rsp + 0x44]
sub ebx, ecx
cmp ebx, 8
ja 0x140084d26
mov edx, ebx
mov eax, ecx
lea r8, [rsp + 0x48]
add r8, rax
mov ecx, ebx
shr rcx, 2
lea rsi, [rbp + 0xac0]
mov rdi, r8
rep movsd dword [rdi], dword [rsi]
mov ecx, ebx
and ecx, 3
je 0x140084ce9
and rdx, 0xfffffffffffffffc
lea rsi, [rbp + 0xac0]
add rsi, rdx
lea rdi, [rdx + r8]
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.140070710
lea eax, [rbx + 0x3f]
cmp eax, 8
jae 0x140084d21
mov eax, ebx
lea rdx, [rbp + 0xac0]
add rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140070710
add ebx, 0x40
lea eax, [rbx + 0x3f]
cmp eax, 8
jb 0x140084d00
mov ecx, r14d
jmp 0x140084d29
mov ebx, r14d
mov edx, 8
sub edx, ebx
mov eax, ebx
lea r8, [rbp + 0xac0]
add r8, rax
mov eax, ecx
lea r9, [rsp + 0x48]
add r9, rax
mov ecx, edx
shr rcx, 2
mov rdi, r9
mov rsi, r8
rep movsd dword [rdi], dword [rsi]
mov ecx, edx
and ecx, 3
je 0x140084d69
and rdx, 0xfffffffffffffffc
lea rsi, [rdx + r8]
lea rdi, [rdx + r9]
rep movsb byte [rdi], byte [rsi]
lea rdi, [rbp - 0x78]
lea rsi, [rsp + 0x30]
mov ecx, 4
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x48]
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosd dword [rdi], eax
mov r8b, 1
mov byte [rbp - 0x68], r8b
mov r12d, dword [rbp + 0x214]
mov r15, qword [rbp + 0x208]
mov rsi, 0xffffffffffffffff
test r15, r15
je 0x140084dfc
test r8b, r8b
je 0x140084df8
cmp r12d, 0x21
jb 0x140084df8
mov ebx, r14d
lea r14, [rbp - 0x78]
nop word [rax + rax]
lea ecx, [rbx + rbx]
movzx edi, byte [r14]
mov edx, r12d
sub edx, ecx
lea rcx, [r15 + rcx*2]
mov dword [rsp + 0x20], edi
lea r9, str._02X
mov r8, rsi
call fcn.140003a90
inc ebx
lea r14, [r14 + 1]
cmp ebx, 0x10
jb 0x140084dc0
xor r14d, r14d
mov word [r15 + 0x40], r14w
jmp 0x140084dfc
mov word [r15], r14w
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140084e3d
mov edx, dword [rbp - 0x10]
lea eax, [rdx + 0xc]
cmp eax, dword [rbp - 0xc]
jae 0x140084e3d
movups xmm0, xmmword [str.MetaQuotes_]
movups xmmword [rcx + rdx*2], xmm0
movsd xmm0, qword [0x1401c5e40]
movsd qword [rcx + rdx*2 + 0x10], xmm0
mov eax, dword [rbp - 0x10]
add eax, 0xc
mov dword [rbp - 0x10], eax
mov ecx, eax
mov rax, qword [rbp - 0x18]
mov word [rax + rcx*2], r14w
mov rcx, qword [r13 + 0xa8]
add rcx, 0xa64
lea rdx, str.terminal
call fcn.14003e590
mov rcx, qword [r13 + 0xa8]
test eax, eax
jne 0x140084ebc
lea rdx, [rcx + 0xa64]
mov rdi, qword [rbp - 0x18]
test rdi, rdi
je 0x140085010
test rdx, rdx
je 0x140085010
mov rbx, rsi
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x140084e82
test ebx, ebx
je 0x140085010
mov ecx, dword [rbp - 0x10]
lea eax, [rcx + rbx]
cmp eax, dword [rbp - 0xc]
jae 0x140085013
lea rcx, [rdi + rcx*2]
mov r8d, ebx
add r8, r8
call fcn.14014cbf0
mov eax, dword [rbp - 0x10]
add eax, ebx
jmp 0x140084ffe
mov eax, dword [rcx + 0x858]
cmp eax, 1
jne 0x140084f1b
mov rdi, qword [rbp - 0x18]
test rdi, rdi
je 0x140085010
mov ecx, dword [rbp - 0x10]
lea eax, [rcx + 0x1a]
cmp eax, dword [rbp - 0xc]
jae 0x140085013
lea rcx, [rdi + rcx*2]
movups xmm0, xmmword [str.MetaTrader_5_Administrator]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401c5e78]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x1401c5e88]
movups xmmword [rcx + 0x20], xmm0
mov eax, dword [0x1401c5e98]
mov dword [rcx + 0x30], eax
mov eax, dword [rbp - 0x10]
add eax, 0x1a
jmp 0x140084ffe
cmp eax, 9
jne 0x140084f74
mov rdi, qword [rbp - 0x18]
test rdi, rdi
je 0x140085010
mov ecx, dword [rbp - 0x10]
lea eax, [rcx + 0x1a]
cmp eax, dword [rbp - 0xc]
jae 0x140085013
lea rcx, [rdi + rcx*2]
movups xmm0, xmmword [str.MetaTrader_4_Administrator]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401c5eb0]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x1401c5ec0]
movups xmmword [rcx + 0x20], xmm0
mov eax, dword [0x1401c5ed0]
mov dword [rcx + 0x30], eax
mov eax, dword [rbp - 0x10]
add eax, 0x1a
jmp 0x140084ffe
cmp eax, 2
jne 0x140084fb6
mov rdi, qword [rbp - 0x18]
test rdi, rdi
je 0x140085010
mov ecx, dword [rbp - 0x10]
lea eax, [rcx + 0x14]
cmp eax, dword [rbp - 0xc]
jae 0x140085013
movups xmm0, xmmword [str.MetaTrader_5_Manager]
movups xmmword [rdi + rcx*2], xmm0
movups xmm1, xmmword [0x1401c5ee8]
movups xmmword [rdi + rcx*2 + 0x10], xmm1
movsd xmm0, qword [0x1401c5ef8]
jmp 0x140084ff2
cmp eax, 0xa
jne 0x140085350
mov rdi, qword [rbp - 0x18]
test rdi, rdi
je 0x140085010
mov ecx, dword [rbp - 0x10]
lea eax, [rcx + 0x14]
cmp eax, dword [rbp - 0xc]
jae 0x140085013
movups xmm0, xmmword [str.MetaTrader_4_Manager]
movups xmmword [rdi + rcx*2], xmm0
movups xmm1, xmmword [0x1401c5f18]
movups xmmword [rdi + rcx*2 + 0x10], xmm1
movsd xmm0, qword [0x1401c5f28]
movsd qword [rdi + rcx*2 + 0x20], xmm0
mov eax, dword [rbp - 0x10]
add eax, 0x14
mov dword [rbp - 0x10], eax
mov ecx, eax
mov rax, qword [rbp - 0x18]
mov word [rax + rcx*2], r14w
mov rdi, qword [rbp - 0x18]
mov ecx, dword [rbp - 0x10]
test rdi, rdi
je 0x14008509e
lea eax, [rcx + 1]
cmp eax, dword [rbp - 0xc]
jae 0x140085048
mov eax, dword [0x1401b667c]
mov word [rdi + rcx*2], ax
mov eax, dword [rbp - 0x10]
inc eax
mov dword [rbp - 0x10], eax
mov ecx, eax
mov rax, qword [rbp - 0x18]
mov word [rax + rcx*2], r14w
mov ecx, dword [rbp - 0x10]
mov rdi, qword [rbp - 0x18]
test rdi, rdi
je 0x14008509e
mov rdx, qword [rbp + 0x208]
test rdx, rdx
je 0x14008509e
nop dword [rax]
inc rsi
cmp word [rdx + rsi*2], 0
jne 0x140085060
test esi, esi
je 0x14008509e
lea eax, [rcx + rsi]
cmp eax, dword [rbp - 0xc]
jae 0x14008509e
mov eax, ecx
lea rcx, [rdi + rax*2]
mov r8d, esi
add r8, r8
call fcn.14014cbf0
mov eax, dword [rbp - 0x10]
add eax, esi
mov dword [rbp - 0x10], eax
mov ecx, eax
mov rax, qword [rbp - 0x18]
mov word [rax + rcx*2], r14w
mov rdi, qword [rbp - 0x18]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140085350
lea rax, [0x1401b6738]
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x50], r14d
mov dword [rbp - 0x4c], reloc.WS2_32.dll_recv
mov word [rbp - 0x48], r14w
mov edx, reloc.WS2_32.dll_recv
lea rcx, [0x1401c6090]
call fcn.14003c464
mov rsi, rax
mov eax, dword [rbp - 0x4c]
cmp esi, eax
jb 0x1400850f1
lea esi, [rax - 1]
mov eax, esi
lea rdi, [rax + rax]
mov r8, rdi
lea rdx, [0x1401c6090]
mov rcx, qword [rbp - 0x58]
call fcn.14014cbf0
mov dword [rbp - 0x50], esi
mov rax, qword [rbp - 0x58]
mov word [rdi + rax], r14w
lea rax, [0x1401c6088]
mov qword [rbp - 0x60], rax
lea rax, [rbp + 0x438]
mov qword [rbp + 0x428], rax
mov dword [rbp + 0x430], r14d
mov dword [rbp + 0x434], 0x200
mov word [rbp + 0x438], r14w
lea rax, [0x1401b7168]
mov qword [rbp + 0x420], rax
mov dil, 1
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0x10]
cmp eax, 1
jb 0x14008531b
test rcx, rcx
je 0x14008531b
cmp word [rcx], 0
je 0x14008531b
cmp eax, 3
jbe 0x14008531b
mov r9, qword [rbp - 0x58]
mov r8, rcx
lea rdx, [0x1401bff50]
lea rcx, [rbp + 0x420]
call fcn.140003670
lea rdx, [rbp + 0x840]
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140085315
test byte [rbp + 0x840], 0x10
je 0x140085288
movzx edx, word [rbp + 0x86c]
movzx ecx, word [rbp + 0x86e]
cmp dx, 0x2e
jne 0x140085202
test cx, cx
je 0x1400852f3
cmp dx, dx
jne 0x140085202
cmp cx, dx
jne 0x140085202
cmp word [rbp + 0x870], 0
je 0x1400852f3
lea r9, [rbp + 0x86c]
mov r8, qword [rbp - 0x18]
lea rdx, [0x1401bff50]
lea rcx, [rbp + 0x420]
call fcn.140003670
mov r8d, 1
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x420]
call fcn.14001e980
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400852f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1400852f0
lea edx, [rax + 0x7b]
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edx, r14d
test eax, eax
movzx ecx, dil
cmovne edx, ecx
movzx edi, dl
jmp 0x1400852f3
lea r9, [rbp + 0x86c]
mov r8, qword [rbp - 0x18]
lea rdx, [0x1401bff50]
lea rcx, [rbp + 0x420]
call fcn.140003670
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400852f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1400852f0
lea edx, [rax + 0x7b]
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, r14d
test eax, eax
movzx ecx, dil
cmovne edx, ecx
movzx edi, dl
jmp 0x1400852f3
xor dil, dil
lea rdx, [rbp + 0x840]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400851c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rcx, qword [rbp - 0x18]
jmp 0x14008531e
xor dil, dil
test dil, dil
je 0x140085350
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140085350
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140085350
lea edx, [rax + 0x7b]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop
lea rdi, [rbp - 0x78]
xor eax, eax
mov ecx, 4
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x30]
mov ecx, 4
rep stosd dword [rdi], eax
lea r11, [rsp + 0xb90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret