Function at 0x44da60
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Get disk information
Get disk size
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x22d8
call fcn.005d4d10
sub esp, eax
mov edi, dword [sym.imp.USER32.dll_LoadCursorW]
mov eax, dword [esp + eax]
mov dword [esp + 4], 0x7f02
mov dword [esp], 0
mov dword [ebp - 0x22c4], edi
mov esi, eax
mov dword [ebp - 0x22b8], eax
call edi
mov edi, dword [sym.imp.USER32.dll_SetCursor]
sub esp, 8
mov dword [esp], eax
mov dword [ebp - 0x22c8], edi
call edi
mov eax, dword [sym.imp.USER32.dll_GetDlgItem]
sub esp, 4
mov dword [esp], esi
mov dword [esp + 4], 0x27e4
mov dword [ebp - 0x22c0], eax
call eax
sub esp, 8
mov edi, eax
mov dword [ebp - 0x22a0], eax
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x147
mov esi, eax
mov dword [ebp - 0x22b4], eax
call eax
sub esp, 0x10
mov dword [ebp - 0x22bc], eax
mov dword [esp], edi
mov dword [esp + 0xc], 0
lea edi, [ebp - 0x2018]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x14b
call esi
mov eax, dword [0x731ca4]
mov ecx, 0x800
mov edx, dword [0x731ca8]
sub esp, 0x10
mov dword [ebp - 0x2274], eax
xor eax, eax
mov dword [ebp - 0x2270], edx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x2018]
mov dword [esp + 8], 0x1000
mov dword [esp], 0x731c3a
mov dword [esp + 4], edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub esp, 0xc
mov dword [esp + 4], 0x731c52
mov dword [esp], edi
call fcn.005e72d8
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
test eax, eax
je 0x44dfd0
mov ebx, eax
lea esi, [ebp - 0x2274]
jmp 0x44dbb0
add word [ebp - 0x2274], 1
shr ebx, 1
je 0x44dfd0
test bl, 1
je 0x44dba0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
sub esp, 4
mov dword [ebp - 0x229c], eax
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.005e72c8
test eax, eax
je 0x44dba0
mov ecx, dword [ebp - 0x229c]
cmp ecx, 5
je 0x44dba0
mov eax, dword [0x8532c4]
cmp byte [eax + 0x19f], 0
jne 0x44dbf5
cmp ecx, 3
je 0x44dba0
lea eax, [ebp - 0x2222]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x105
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
lea eax, [ebp - 0x2280]
sub esp, 0x20
mov dword [esp], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x2288]
mov dword [esp + 8], eax
lea eax, [ebp - 0x2290]
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea eax, [ebp - 0x2264]
sub esp, 0x10
mov dword [ebp - 0x226c], eax
lea eax, [ebp - 0x2222]
mov dword [esp], eax
call fcn.005e72a0
lea edx, [eax + eax]
mov ecx, edx
sar ecx, 1
cmp ecx, 7
mov dword [ebp - 0x223c], ecx
ja 0x44e180
cmp ecx, 1
mov eax, dword [ebp - 0x226c]
je 0x44e1e4
test ecx, ecx
jne 0x44e1bd
xor edx, edx
mov dword [ebp - 0x2268], ecx
mov word [eax + ecx*2], dx
mov dword [esp], 0x731c56
call fcn.005e72a0
mov edx, 0x3fffffff
sub edx, dword [ebp - 0x2268]
cmp eax, edx
ja 0x44e297
lea ecx, [ebp - 0x226c]
mov dword [esp + 4], eax
mov dword [esp], 0x731c56
call fcn.006c1ce0
sub esp, 8
mov dword [esp], esi
call fcn.005e72a0
mov edx, 0x3fffffff
sub edx, dword [ebp - 0x2268]
cmp eax, edx
ja 0x44e287
lea ecx, [ebp - 0x226c]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.006c1ce0
sub esp, 8
mov dword [esp], 0x731c72
call fcn.005e72a0
mov edx, 0x3fffffff
sub edx, dword [ebp - 0x2268]
cmp eax, edx
ja 0x44e27b
lea ecx, [ebp - 0x226c]
mov dword [esp + 4], eax
mov dword [esp], 0x731c72
call fcn.006c1ce0
sub esp, 8
mov dword [esp], 0x731c76
call fcn.005e72a0
mov edx, 0x3fffffff
sub edx, dword [ebp - 0x2268]
cmp eax, edx
ja 0x44e26f
lea ecx, [ebp - 0x226c]
mov dword [esp + 4], eax
mov dword [esp], 0x731c76
call fcn.006c1ce0
mov eax, dword [ebp - 0x2284]
sub esp, 8
mov dword [ebp - 0x22a4], 0
mov edx, dword [ebp - 0x22a4]
lea ecx, [ebp - 0x2254]
mov dword [esp + 0xc], 0x731c7c
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0x44d450
sar eax, 0x1f
mov dword [esp], ecx
and eax, 0xfffff
mov dword [ebp - 0x22a8], eax
mov eax, dword [ebp - 0x22a8]
add eax, dword [ebp - 0x2288]
adc edx, dword [ebp - 0x2284]
shrd eax, edx, 0x14
sar edx, 0x14
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
call fcn.0044d990
mov eax, dword [ebp - 0x2250]
lea ecx, [ebp - 0x226c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2254]
mov dword [esp], eax
call fcn.006c1ce0
mov eax, dword [ebp - 0x2254]
lea edx, [ebp - 0x224c]
sub esp, 8
cmp eax, edx
je 0x44de34
mov dword [esp], eax
call fcn.006eb330
mov dword [esp], 0x731c86
call fcn.005e72a0
mov edx, 0x3fffffff
sub edx, dword [ebp - 0x2268]
cmp eax, edx
ja 0x44e24f
lea ecx, [ebp - 0x226c]
mov dword [esp + 4], eax
mov dword [esp], 0x731c86
call fcn.006c1ce0
mov eax, dword [ebp - 0x228c]
sub esp, 8
mov dword [ebp - 0x22ac], 0
mov edx, dword [ebp - 0x22ac]
lea ecx, [ebp - 0x223c]
mov dword [esp + 0xc], 0x731c7c
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0x44d450
sar eax, 0x1f
mov dword [esp], ecx
and eax, 0xfffff
mov dword [ebp - 0x22b0], eax
mov eax, dword [ebp - 0x22b0]
add eax, dword [ebp - 0x2290]
adc edx, dword [ebp - 0x228c]
shrd eax, edx, 0x14
sar edx, 0x14
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
call fcn.0044d990
mov eax, dword [ebp - 0x2238]
lea ecx, [ebp - 0x226c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x223c]
mov dword [esp], eax
call fcn.006c1ce0
mov eax, dword [ebp - 0x223c]
lea edx, [ebp - 0x2234]
sub esp, 8
cmp eax, edx
je 0x44df10
mov dword [esp], eax
call fcn.006eb330
mov dword [esp], 0x731c92
call fcn.005e72a0
mov edx, 0x3fffffff
sub edx, dword [ebp - 0x2268]
cmp eax, edx
ja 0x44e209
lea ecx, [ebp - 0x226c]
mov dword [esp + 4], eax
mov dword [esp], 0x731c92
call fcn.006c1ce0
mov eax, dword [ebp - 0x226c]
sub esp, 8
mov dword [esp + 8], 0
mov dword [esp + 4], 0x143
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x22a0]
mov dword [esp], eax
call dword [ebp - 0x22b4]
sub esp, 0x10
movzx edx, word [ebp - 0x2274]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x22a0]
mov dword [esp + 4], 0x151
mov dword [esp + 0xc], edx
mov dword [esp], eax
call dword [ebp - 0x22b4]
mov eax, dword [ebp - 0x226c]
lea edx, [ebp - 0x2264]
sub esp, 0x10
cmp eax, edx
je 0x44dba0
mov dword [esp], eax
call fcn.006eb330
add word [ebp - 0x2274], 1
shr ebx, 1
jne 0x44dbb0
lea esi, [esi]
mov eax, dword [ebp - 0x22a0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x146
mov dword [esp], eax
call dword [ebp - 0x22b4]
mov edi, dword [ebp - 0x22bc]
sub esp, 0x10
test eax, eax
setg bl
cmp edi, 0xffffffff
jne 0x44e01a
test bl, bl
mov eax, 0
cmove eax, edi
mov dword [ebp - 0x22bc], eax
mov edi, dword [ebp - 0x22a0]
mov eax, dword [ebp - 0x22bc]
movzx ebx, bl
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x14e
mov dword [esp], edi
mov edi, dword [ebp - 0x22b4]
mov dword [esp + 8], eax
mov eax, edi
call eax
mov eax, dword [ebp - 0x22bc]
sub esp, 0x10
mov esi, dword [0x8532c4]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x150
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x22a0]
mov dword [esp], eax
call edi
mov dword [esi + 0x170], eax
mov eax, dword [ebp - 0x22b8]
sub esp, 0x10
mov dword [esp + 4], 0x27e6
mov dword [esp], eax
call dword [ebp - 0x22c0]
sub esp, 8
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 4], ebx
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x22b8]
sub esp, 8
mov dword [esp + 4], 0x27ea
mov dword [esp], eax
call dword [ebp - 0x22c0]
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], eax
call esi
sub esp, 8
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call dword [ebp - 0x22c4]
sub esp, 8
mov dword [esp], eax
call dword [ebp - 0x22c8]
mov eax, dword [ebp - 0x22b8]
sub esp, 4
mov dword [esp + 4], 0x27e4
mov dword [esp], eax
call dword [ebp - 0x22c0]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x146
mov dword [esp], eax
call edi
sub esp, 0x10
test eax, eax
mov eax, dword [ebp - 0x22b8]
mov dword [esp], eax
je 0x44e1f3
call dword [sym.imp.USER32.dll_GetParent]
sub esp, 4
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 4], 0x470
mov dword [esp], eax
call dword [sym.imp.USER32.dll_PostMessageW]
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x223c]
lea ecx, [ebp - 0x226c]
mov dword [esp + 4], 0
mov dword [ebp - 0x229c], edx
mov dword [esp], eax
call int.006c1e40
mov ecx, dword [ebp - 0x223c]
mov edx, dword [ebp - 0x229c]
sub esp, 8
mov dword [ebp - 0x226c], eax
mov dword [ebp - 0x2264], ecx
mov dword [esp + 8], edx
lea edx, [ebp - 0x2222]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.005e73f8
mov ecx, dword [ebp - 0x223c]
mov eax, dword [ebp - 0x226c]
jmp 0x44dcac
movzx edx, word [ebp - 0x2222]
mov word [eax], dx
jmp 0x44dcac
call dword [sym.imp.USER32.dll_GetParent]
sub esp, 4
mov dword [esp + 0xc], 1
jmp 0x44e153
mov dword [esp], 0x731c5c
call fcn.006e0080
mov ebx, eax
mov eax, dword [ebp - 0x223c]
lea edx, [ebp - 0x2234]
cmp eax, edx
je 0x44e22f
mov dword [esp], eax
call fcn.006eb330
mov eax, dword [ebp - 0x226c]
lea edi, [ebp - 0x2264]
cmp eax, edi
je 0x44e247
mov dword [esp], eax
call fcn.006eb330
mov dword [esp], ebx
call fcn.005d7530
mov dword [esp], 0x731c5c
call fcn.006e0080
mov ebx, eax
mov eax, dword [ebp - 0x2254]
lea edx, [ebp - 0x224c]
cmp eax, edx
jne 0x44e227
jmp 0x44e22f
mov dword [esp], 0x731c5c
call fcn.006e0080
mov dword [esp], 0x731c5c
call fcn.006e0080
mov dword [esp], 0x731c5c
call fcn.006e0080
mov ebx, eax
jmp 0x44e22f
mov dword [esp], 0x731c5c
call fcn.006e0080
nop
lea esi, [esi]
lea edi, [edi]