Function at 0x40aee0
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x463d50
push 0x42c930
mov eax, dword fs:[0]
push eax
sub esp, 0x674
mov eax, dword [0x46718c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
push 0x208
push 0
lea eax, [ebp - 0x42c]
push eax
call fcn.0042d3d0
push 0x208
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.0042d3d0
push 0x250
push 0
lea eax, [ebp - 0x67c]
push eax
call fcn.0042d3d0
add esp, 0x24
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40af60
sub ecx, edx
sar ecx, 1
lfence
lea eax, [ebp - 0x224]
cmp ecx, 0x104
jae 0x40af91
push esi
push 0x104
push eax
call fcn.0043affa
add esp, 0xc
jmp 0x40afab
push 0x103
push esi
push 0x104
push eax
call fcn.0043ae12
add esp, 0x10
xor eax, eax
mov word [ebp - 0x1e], ax
lea esi, [ebp - 0x224]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40afb4
sub esi, ecx
sar esi, 1
mov edi, esi
jne 0x40afcf
lea edi, [ebp - 0x224]
jmp 0x40b006
dec esi
mov eax, 0x5c
cmp ax, word [ebp + esi*2 - 0x224]
je 0x40affd
push 0x45f40c
push 0x104
lea eax, [ebp - 0x224]
push eax
call fcn.0043af8b
add esp, 0xc
test eax, eax
cmove esi, edi
lea edi, [ebp - 0x224]
lea edi, [edi + esi*2]
mov dword [ebp - 0x680], edi
lea ecx, [ebp - 0x224]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b015
sub ecx, edx
sar ecx, 1
lfence
lea eax, [ebp - 0x224]
cmp ecx, 0x104
jae 0x40b04c
push eax
push 0x104
lea eax, [ebp - 0x42c]
push eax
call fcn.0043affa
add esp, 0xc
jmp 0x40b06f
push 0x103
push eax
push 0x104
lea eax, [ebp - 0x42c]
push eax
call fcn.0043ae12
add esp, 0x10
xor eax, eax
mov word [ebp - 0x226], ax
push 0x45f694
mov edx, 0x104
lea ecx, [ebp - 0x42c]
call fcn.0040b520
add esp, 4
lea eax, [ebp - 0x67c]
push eax
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x684], esi
cmp esi, 0xffffffff
je 0x40b219
test dword [ebp - 0x67c], 0x10
jne 0x40b137
lea eax, [ebp - 0x650]
push eax
mov edx, 0x104
lea ecx, [ebp - 0x224]
call fcn.0040b520
add esp, 4
test bl, bl
je 0x40b0ef
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
je 0x40b1ee
mov dword [ebp - 4], 0
push 4
push 0
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 4], 0xfffffffe
jmp 0x40b1ee
cmp byte [ebp + 8], 0
je 0x40b1f4
mov ecx, 0x45f69c
lea eax, [ebp - 0x650]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40b176
test dx, dx
je 0x40b172
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40b176
add eax, 4
add ecx, 4
test dx, dx
jne 0x40b150
xor eax, eax
jmp 0x40b17b
sbb eax, eax
or eax, 1
test eax, eax
je 0x40b1f4
mov ecx, 0x45f6a0
lea eax, [ebp - 0x650]
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40b1b6
test dx, dx
je 0x40b1b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40b1b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x40b190
xor eax, eax
jmp 0x40b1bb
sbb eax, eax
or eax, 1
test eax, eax
je 0x40b1f4
lea eax, [ebp - 0x650]
push eax
mov edx, 0x104
lea ecx, [ebp - 0x224]
call fcn.0040b520
push 0x45f694
push ebx
push 1
mov dl, 1
lea ecx, [ebp - 0x224]
call fcn.0040aee0
add esp, 0x10
xor eax, eax
mov word [edi + 2], ax
lea eax, [ebp - 0x67c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40b0a6
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
or esi, 0xffffffff
jmp 0x40b0a0
xor eax, eax
mov word [edi], ax
test bl, bl
je 0x40b234
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp eax, 1
je 0x40b25e
mov dword [ebp - 4], 1
push 4
push 0
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x40b257
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0042ac9b
mov esp, ebp
pop ebp
ret