Function at 0x401980
Capabilities:
Delete file
Enumerate files on windows
Move file

Disassembly:
test dword [0x4031ec], 1
jne fcn.0040197f
call fcn.00401231
push edi
jb 0x4019fd
je 0x4019fb
jae 0x4019c7
jne 0x401a0a
popal
je 0x401a03
jae 0x4019cf
jae 0x401a16
jb 0x401a0d
jo 0x401a19
and byte [ecx + 0x67], dh
jae 0x4019cc
jb 0x401a1e
insd dword es:[edi], dx
and byte [ebp + 0x50], cl
xor esp, dword [eax]
imul bp, word [ebp + 0x73], 0xa0d
or eax, 0x6173550a
cmp cl, byte gs:[bx + di]
push esp
popal
and byte [bx + 0x70], ch
je 0x401a36
imul ebp, dword [edi + 0x6e], 0x69662073
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
popal
insd dword es:[edi], dx
outsd dx, dword [esi]
outsb dx, byte [esi]
jae 0x4019f1
imul bp, word [ebp + 0x6e], 0x6d61
or eax, 0x4f0a0d0a
jo 0x401a54
imul ebp, dword [edi + 0x6e], 0x2d203a73
popal
and byte [eax], ah
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
and byte [esi + 0x69], ah
insb byte es:[edi], dx
jae 0x401a14
imul ebp, dword [esi + 0x20], 0x65726964
arpl word [edi + ebp*2 + 0x72], si
jns 0x401a0e
outsd dx, dword [esi]
jb 0x401a79
or eax, 0x2020200a
or ah, byte [eax]
and byte [eax], ah
and byte [eax], ah
and byte [eax], ah
and byte [eax], ah
sub eax, 0x55202066
and byte [0x55202066], ch
and byte [eax], ah
push ebp
and byte [ebp + 0x73], dl
and byte gs:[esi + 0x69], ah
jae 0x401a77
and byte [esi + 0x69], ah
imul ebp, dword [ebp + 0x6e], 0x20656d61
popal
jae 0x401a3f
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
popal
insd dword es:[edi], dx
and byte gs:[ecx + 0x73], ah
and byte [edx + esi*2 + 0x61], dh
je 0x401a93
popal
arpl word [ebx + 0x20], bp
outsb dx, byte [esi]
popal
insd dword es:[edi], dx
or eax, 0x2020200a
and byte [eax], ah
and byte [eax], ah
and byte [eax], ah
sub eax, 0x4e20206e
and byte [eax], ah
dec esi
outsd dx, dword [esi]
and byte [edx + esi*2 + 0x61], dh
arpl word [ebx + 0x20], bp
outsb dx, byte [esi]
imul esp, dword [eax], 0x6e
jne 0x401ab1
bound esp, qword [ebp + 0x72]
and byte [eax + 0x61], dh
jb 0x401abf
or eax, 0x2020200a
and byte [eax], ah
and byte [eax], ah
and byte [eax], ah
sub eax, 0x54202070
popal
and byte [bp + 0x72], ah
outsd dx, dword [esi]
insd dword es:[edi], dx
and byte [eax + 0x61], dh
je 0x401ad1
or eax, 0x2020200a
and byte [eax], ah
and byte [eax], ah
and byte [eax], ah
sub eax, 0x53202073
and byte [ebx + 0x74], dl
jb 0x401ae5
je 0x401aed
imul esi, dword [eax + 0x20], 0xd676174
or cl, byte [0x706e490a]
jne 0x401afe
jo 0x401a9e
je 0x401ae1
or eax, 0x490a0d0a
outsb dx, byte [esi]
jo 0x401afe
je 0x401aab
and byte [esi + 0x69], ah
insb byte es:[edi], dx
and byte gs:[ecx + 0x73], ch
imul bp, word [ebp + 0x20], 0x7369
and byte [edi + 0x76], ch
jb 0x401b0f
outsd dx, dword [esi]
jbe 0x401afb
jb 0x401b0f
jb 0x401b03
je 0x401b10
outsb dx, byte gs:[esi]
or eax, 0x490a0d0a
and byte [ecx + 0x6f], bh
jne fcn.00401ac9
outsd dx, dword fs:[esi]
outsb dx, byte [esi]
daa
je 0x401acf
insb byte es:[edi], dx
imul ebp, dword [ebx + 0x65], 0x2c746920
imul esp, dword [ebp + 0x20], 0x69
je 0x401ae3
and byte [edi + 0x72], dh
imul esi, dword [ebp + 0x20], 0x72756f79
outsd dx, dword [esi]
jne 0x401b34
and byte [edi + 0x77], ch
outsb dx, byte [esi]
or eax, 0xec05f78a
invalid
add eax, 0x4031ec
add dword [eax], eax
add byte [eax], al
xor eax, dword [eax]
mov byte [edx], dh
inc eax
add al, ch
xchg esp, eax
add eax, 0xf8830000
dec dword [edi]
test byte [ebp + 3], bh
jge 0x401b00
add byte [eax], al
add byte [ebx + 0x4038d6], ah
salc
cmp byte [eax], al
add bh, dh
add eax, 0x4031ec
add al, 0
add byte [eax], al
push 0xce685450
aaa
inc eax
add byte [eax], ch
add dword [eax], eax
add byte [eax - 0x48], ch
xor eax, 0x82e80040
add eax, 0xc65e0000
push es
add byte [ebx], dh
leave
adc edi, dword [edx + edi]