Function at 0x402f50
Capabilities:
Delete file
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x478
mov dl, byte [0x40bd88]
push ebx
push ebp
push esi
push edi
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x3d]
mov byte [esp + 0x3c], dl
mov byte [esp + 0x140], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x141]
mov byte [esp + 0x244], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x245]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x48c]
lea ecx, [esp + 0x244]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [esp + 0x244]
mov edx, dword [esp + 0x494]
push edx
push eax
call ebx
xor ebp, ebp
push 0x10b
mov eax, dword [esp + 0x4a0]
mov dword [eax], ebp
mov dword [eax + 4], ebp
call fcn.00404a70
mov si, ax
add esi, 3
push esi
call fcn.00404a70
add esp, 8
lea ecx, [esp + 0x348]
lea edx, [esp + 0x244]
mov di, ax
push ecx
push edx
add edi, 2
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x4030d0
lea eax, [esp + 0x1c]
push 0x20
push eax
call fcn.004046f0
mov esi, dword [esp + 0x494]
add esp, 8
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x1c]
push ecx
push ebp
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea ecx, [esp + 0x3c]
push 0x2e
push ecx
call fcn.00404f80
mov edx, eax
add esp, 8
test edx, edx
jne 0x40307e
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + ecx + 0x3c]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 0x3c]
dec ecx
sub edx, eax
mov edi, esi
sub edx, ecx
or ecx, 0xffffffff
xor eax, eax
push edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x144]
lea ecx, [esp + ecx + 0x41]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
lea eax, [esp + 0x140]
mov ebp, dword [esp + 0x490]
push ebp
push eax
call ebx
mov edi, dword [esp + 0x49c]
jmp 0x40317f
and edi, 0xffff
and esi, 0xffff
mov dword [esp + 0x10], esi
jmp 0x4030e6
mov esi, dword [esp + 0x10]
inc ebp
mov ecx, ebp
and ecx, 0xffff
mov eax, ecx
cdq
idiv esi
mov eax, ecx
mov esi, edx
cdq
idiv edi
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
test esi, esi
sete cl
or edx, ecx
mov cl, byte [esp + 0x140]
xor eax, eax
test cl, cl
sete al
or edx, eax
je 0x403131
lea ecx, [esp + 0x374]
lea edx, [esp + 0x140]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
test esi, esi
je 0x40314c
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x348]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4030e2
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov edi, dword [esp + 0x49c]
mov eax, dword [esp + 0x35c]
mov ecx, dword [esp + 0x360]
mov ebp, dword [esp + 0x490]
mov esi, dword [esp + 0x48c]
mov dword [edi], eax
mov dword [edi + 4], ecx
lea edx, [esp + 0x140]
push 0x2e
push edx
call fcn.00404f80
lea ecx, [esp + 0x148]
add esp, 8
sub eax, ecx
lea edx, [esp + 0x140]
inc eax
push eax
lea eax, [esp + 0x144]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
lea ecx, [esp + 0x3c]
push esi
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea edx, [esp + 0x3c]
push 0x4092ec
push edx
call ebx
lea eax, [esp + 0x140]
lea ecx, [esp + 0x3c]
push eax
push ecx
call ebx
lea edx, [esp + 0x3c]
push ebp
push edx
call ebx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x3c]
push eax
push ecx
call fcn.00404b00
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
add esp, 8
lea edx, [eax + ecx]
test edx, edx
je 0x403238
mov edx, dword [edi + 4]
add edx, dword [edi]
jne 0x40320e
mov dword [edi], ecx
mov dword [edi + 4], eax
push 0x17
call fcn.00404a70
and eax, 0xffff
add esp, 4
add eax, 0x61
lea ecx, [esp + 0x140]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push ecx
call ebx
jmp 0x4031b2
mov eax, dword [esp + 0x498]
lea edx, [esp + 0x3c]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x478
ret 0x14