Function at 0x52c952
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Delete directory
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push 0x718
mov eax, 0x5b5480
call fcn.00553bf3
mov eax, edx
mov dword [ebp - 0x6e4], eax
mov esi, ecx
mov dword [ebp - 0x6e8], esi
xor ebx, ebx
lea ecx, [ebp - 0x274]
mov dword [ebp - 0x18], ebx
xor edi, edi
push ecx
mov dword [ebp - 0x6d4], 0x36675248
mov dword [ebp - 0x6d0], 0x4b55534f
mov dword [ebp - 0x6cc], 0x55596946
mov dword [ebp - 0x6c8], 0x4b455466
mov dword [ebp - 0x6c4], 0x33736a4d
mov dword [ebp - 0x6c0], 0x7a55774d
mov dword [ebp - 0x6bc], 0x7263575a
mov dword [ebp - 0x6b8], 0x35454341
mov dword [ebp - 0x6b4], 0x714d7741
mov dword [ebp - 0x6b0], 0x76637946
mov dword [ebp - 0x6ac], 0x414d6d42
mov dword [ebp - 0x6a8], 0x77415766
mov dword [ebp - 0x6a4], 0x62495166
mov dword [ebp - 0x6a0], 0x46415143
mov dword [ebp - 0x69c], 0x4441414c
mov dword [ebp - 0x698], 0x6e6f4348
mov dword [ebp - 0x694], 0x35495749
mov dword [ebp - 0x690], 0x43595166
mov dword [ebp - 0x68c], 0x4a73774a
mov dword [ebp - 0x688], 0x6634514c
mov dword [ebp - 0x684], 0x424d5344
mov dword [ebp - 0x680], 0x304a4148
mov dword [ebp - 0x67c], 0x43386966
mov dword [ebp - 0x678], 0x554d584b
mov dword [ebp - 0x674], 0x7a4d5364
mov dword [ebp - 0x670], 0x6a417a46
mov dword [ebp - 0x66c], 0x794d794a
mov dword [ebp - 0x668], 0x75457764
mov dword [ebp - 0x664], 0x37305450
mov dword [ebp - 0x660], 0x61457a4f
mov dword [ebp - 0x65c], 0x6c554441
mov dword [ebp - 0x658], 0x7730784b
mov dword [ebp - 0x654], 0x49634344
mov dword [ebp - 0x650], 0x364e7766
mov dword [ebp - 0x64c], 0x7763544b
mov dword [ebp - 0x648], 0x32774348
mov dword [ebp - 0x644], 0x5438444f
mov dword [ebp - 0x640], 0x74635442
mov dword [ebp - 0x63c], 0x69557849
mov dword [ebp - 0x638], 0x32514263
mov dword [ebp - 0x634], 0x42305264
mov dword [ebp - 0x630], 0x30317765
mov dword [ebp - 0x62c], 0x31685341
mov dword [ebp - 0x628], 0x42454450
mov dword [ebp - 0x624], 0x644d6948
mov dword [ebp - 0x620], 0x39636e64
mov dword [ebp - 0x61c], 0x68774449
mov dword [ebp - 0x618], 0x6934534f
mov dword [ebp - 0x614], 0x55305850
mov dword [ebp - 0x610], 0x306b525a
mov dword [ebp - 0x60c], 0x6b6b7a4e
mov dword [ebp - 0x608], 0x6d6b6a4e
mov dword [ebp - 0x604], 0x774a4241
mov dword [ebp - 0x600], 0x6c554844
mov dword [ebp - 0x5fc], 0x6f4d6d64
mov dword [ebp - 0x5f8], 0x75385364
mov dword [ebp - 0x5f4], 0x35785442
mov dword [ebp - 0x5f0], 0x61344466
mov dword [ebp - 0x5ec], 0x4a597a49
mov dword [ebp - 0x5e8], 0x546f5266
mov dword [ebp - 0x5e4], 0x6c496d46
mov dword [ebp - 0x5e0], 0x7746324a
mov dword [ebp - 0x5dc], 0x52497a49
mov dword [ebp - 0x5d8], 0x6a41514b
mov dword [ebp - 0x5d4], 0x62496d4c
mov dword [ebp - 0x5d0], 0x55636850
mov dword [ebp - 0x5cc], 0x73635149
mov dword [ebp - 0x5c8], 0x68737941
mov dword [ebp - 0x5c4], 0x70346742
mov dword [ebp - 0x5c0], 0x6677794c
mov dword [ebp - 0x5bc], 0x67556942
mov dword [ebp - 0x5b8], 0x54596741
mov dword [ebp - 0x5b4], 0x644d444a
mov dword [ebp - 0x5b0], 0x41385365
mov dword [ebp - 0x5ac], 0x63444141
push eax
push edi
sub esp, 0xc
lea eax, [ebp - 0x5a8]
mov ecx, esp
lea edx, [ebp - 0x6d4]
push ecx
push eax
push edx
call fcn.00450208
lea ecx, [ebp - 0x700]
call fcn.0052fed7
add esp, 0xc
and dword [ebp - 4], edi
mov ecx, eax
call fcn.004ab6d2
push eax
mov edx, esi
lea ecx, [ebp - 0x6dc]
call fcn.004c30f0
pop ecx
xor ecx, ecx
mov edx, eax
inc ecx
mov byte [ebp - 4], cl
lea ecx, [ebp - 0x6f4]
call fcn.004c30f0
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x6f4]
mov dword [ebp - 0x6d8], eax
lea ecx, [ecx - 0x10]
call fcn.00450c0a
mov ecx, dword [ebp - 0x6dc]
lea ecx, [ecx - 0x10]
call fcn.00450c0a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x700]
call fcn.004ab565
cmp dword [ebp - 0x6d8], 0xffffffff
je 0x52d791
test byte [ebp - 0x274], 0x10
je 0x52d3a3
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004c3491
mov dword [ebp - 4], 2
lea eax, [ebp - 0x27c]
push 0
sub esp, 0xc
mov dword [ebp - 0x35c], 0x41733262
mov ecx, esp
mov dword [ebp - 0x358], 0x6a384843
lea edx, [ebp - 0x35c]
mov dword [ebp - 0x354], 0x784d5845
mov dword [ebp - 0x350], 0x33496a48
push ecx
push eax
push edx
mov dword [ebp - 0x34c], 0x68464163
mov dword [ebp - 0x348], 0x30305350
mov dword [ebp - 0x344], 0x45345749
mov dword [ebp - 0x340], 0x66555366
mov dword [ebp - 0x33c], 0x4b346945
mov dword [ebp - 0x338], 0x674d4249
mov dword [ebp - 0x334], 0x6434424a
mov dword [ebp - 0x330], 0x506f5349
mov dword [ebp - 0x32c], 0x794d6750
mov dword [ebp - 0x328], 0x4e595441
mov dword [ebp - 0x324], 0x71427a4b
mov dword [ebp - 0x320], 0x4930774e
mov dword [ebp - 0x31c], 0x2f345745
mov dword [ebp - 0x318], 0x3841414b
mov dword [ebp - 0x314], 0x2f345848
mov dword [ebp - 0x310], 0x6a6c7a4b
mov dword [ebp - 0x30c], 0x72596742
mov dword [ebp - 0x308], 0x4b417744
mov dword [ebp - 0x304], 0x705a5843
mov dword [ebp - 0x300], 0x776b4350
mov dword [ebp - 0x2fc], 0x6d51534b
mov dword [ebp - 0x2f8], 0x334a6964
mov dword [ebp - 0x2f4], 0x3531414c
mov dword [ebp - 0x2f0], 0x36527a42
mov dword [ebp - 0x2ec], 0x4467444e
mov dword [ebp - 0x2e8], 0x6b38774a
mov dword [ebp - 0x2e4], 0x2b496d48
mov dword [ebp - 0x2e0], 0x46517a44
mov dword [ebp - 0x2dc], 0x53496a64
mov dword [ebp - 0x2d8], 0x7a345145
mov dword [ebp - 0x2d4], 0x32677842
mov dword [ebp - 0x2d0], 0x6e344150
mov dword [ebp - 0x2cc], 0x424d6749
mov dword [ebp - 0x2c8], 0x4b777744
mov dword [ebp - 0x2c4], 0x4a387a47
mov dword [ebp - 0x2c0], 0x61385748
mov dword [ebp - 0x2bc], 0x42596763
mov dword [ebp - 0x2b8], 0x4645424e
mov dword [ebp - 0x2b4], 0x3138434f
mov dword [ebp - 0x2b0], 0x784d524c
mov dword [ebp - 0x2ac], 0x2f513249
mov dword [ebp - 0x2a8], 0x68417745
mov dword [ebp - 0x2a4], 0x4e674145
mov dword [ebp - 0x2a0], 0x52736e48
mov dword [ebp - 0x29c], 0x636b6747
mov dword [ebp - 0x298], 0x30517a42
mov dword [ebp - 0x294], 0x32527a42
mov dword [ebp - 0x290], 0x69516742
mov dword [ebp - 0x28c], 0x6f41694f
mov dword [ebp - 0x288], 0x7a676746
mov dword [ebp - 0x284], 0x4149534c
mov dword [ebp - 0x280], 0x6a434141
call fcn.00450208
lea ecx, [ebp - 0x724]
call fcn.0052fed7
add esp, 0xc
xor ecx, ecx
mov byte [ebp - 4], 3
inc ecx
or ebx, ecx
mov dword [ebp - 0x18], ebx
mov ecx, eax
call fcn.004ab6d2
push eax
lea ecx, [ebp - 0x1c]
call fcn.004bdd16
test eax, eax
je 0x52d2bd
push 0
sub esp, 0xc
mov dword [ebp - 0x474], 0x42773362
mov ecx, esp
mov dword [ebp - 0x470], 0x32495350
lea eax, [ebp - 0x35e]
mov dword [ebp - 0x46c], 0x6f4d414c
lea edx, [ebp - 0x474]
mov dword [ebp - 0x468], 0x56415448
push ecx
push eax
push edx
mov dword [ebp - 0x464], 0x6141524a
mov dword [ebp - 0x460], 0x306b3247
mov dword [ebp - 0x45c], 0x6f634342
mov dword [ebp - 0x458], 0x4c383343
mov dword [ebp - 0x454], 0x6a55434e
mov dword [ebp - 0x450], 0x6c6c774f
mov dword [ebp - 0x44c], 0x45595363
mov dword [ebp - 0x448], 0x5a736764
mov dword [ebp - 0x444], 0x56556942
mov dword [ebp - 0x440], 0x59516964
mov dword [ebp - 0x43c], 0x6963574d
mov dword [ebp - 0x438], 0x7941484d
mov dword [ebp - 0x434], 0x6e6b7a48
mov dword [ebp - 0x430], 0x65636749
mov dword [ebp - 0x42c], 0x38686a5a
mov dword [ebp - 0x428], 0x736b6766
mov dword [ebp - 0x424], 0x46596a4d
mov dword [ebp - 0x420], 0x70453249
mov dword [ebp - 0x41c], 0x64596e41
mov dword [ebp - 0x418], 0x526f4442
mov dword [ebp - 0x414], 0x63596d45
mov dword [ebp - 0x410], 0x41304845
mov dword [ebp - 0x40c], 0x2b595448
mov dword [ebp - 0x408], 0x374d4143
mov dword [ebp - 0x404], 0x766b6e5a
mov dword [ebp - 0x400], 0x7a514149
mov dword [ebp - 0x3fc], 0x62737943
mov dword [ebp - 0x3f8], 0x71737749
mov dword [ebp - 0x3f4], 0x7874444a
mov dword [ebp - 0x3f0], 0x506f3341
mov dword [ebp - 0x3ec], 0x4945324e
mov dword [ebp - 0x3e8], 0x5763794d
mov dword [ebp - 0x3e4], 0x50596850
mov dword [ebp - 0x3e0], 0x3738684f
mov dword [ebp - 0x3dc], 0x34354148
mov dword [ebp - 0x3d8], 0x2f774147
mov dword [ebp - 0x3d4], 0x57514462
mov dword [ebp - 0x3d0], 0x35384248
mov dword [ebp - 0x3cc], 0x30677942
mov dword [ebp - 0x3c8], 0x42494466
mov dword [ebp - 0x3c4], 0x43455746
mov dword [ebp - 0x3c0], 0x4330784d
mov dword [ebp - 0x3bc], 0x614d435a
mov dword [ebp - 0x3b8], 0x6e34334c
mov dword [ebp - 0x3b4], 0x4d34444e
mov dword [ebp - 0x3b0], 0x43344350
mov dword [ebp - 0x3ac], 0x44557963
mov dword [ebp - 0x3a8], 0x72677a4e
mov dword [ebp - 0x3a4], 0x33523341
mov dword [ebp - 0x3a0], 0x46306947
mov dword [ebp - 0x39c], 0x4941444e
mov dword [ebp - 0x398], 0x55416e4a
mov dword [ebp - 0x394], 0x39564362
mov dword [ebp - 0x390], 0x35646941
mov dword [ebp - 0x38c], 0x596b4847
mov dword [ebp - 0x388], 0x67457765
mov dword [ebp - 0x384], 0x36464144
mov dword [ebp - 0x380], 0x4345514a
mov dword [ebp - 0x37c], 0x41454849
mov dword [ebp - 0x378], 0x6f557944
mov dword [ebp - 0x374], 0x41633264
mov dword [ebp - 0x370], 0x7667774d
mov dword [ebp - 0x36c], 0x7a344448
mov dword [ebp - 0x368], 0x656b7759
mov dword [ebp - 0x364], 0x41414141
mov word [ebp - 0x360], 0x6779
call fcn.00450208
lea ecx, [ebp - 0x70c]
call fcn.0052fed7
add esp, 0xc
mov dword [ebp - 4], 4
or ebx, 2
mov ecx, eax
mov dword [ebp - 0x18], ebx
call fcn.004ab6d2
push eax
lea ecx, [ebp - 0x1c]
call fcn.004bdd16
test eax, eax
je 0x52d2bd
xor eax, eax
inc eax
mov byte [ebp - 0x275], al
jmp 0x52d2c4
mov byte [ebp - 0x275], 0
test bl, 2
je 0x52d2d7
lea ecx, [ebp - 0x70c]
and ebx, 0xfffffffd
call fcn.004ab565
mov dword [ebp - 4], 2
test bl, 1
je 0x52d2f1
lea ecx, [ebp - 0x724]
and ebx, 0xfffffffe
call fcn.004ab565
cmp byte [ebp - 0x275], 0
je 0x52d397
and dword [ebp - 0x18], 0
call fcn.0045082c
push eax
lea ecx, [ebp - 0x18]
call fcn.004c3be8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x18]
mov esi, dword [esi]
push 0x104
call fcn.004c3a23
lea ecx, [ebp - 0x248]
push ecx
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.004c318a
push dword [ebp + 8]
mov edx, dword [ebp - 0x6e4]
lea ecx, [ebp - 0x18]
call fcn.0052c952
pop ecx
push 1
test eax, eax
pop eax
push dword [ebp - 0x18]
cmovne edi, eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x52d386
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x52d386
cmp dword [ebp + 8], eax
je 0x52d381
push 4
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
lea edi, [eax + 1]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00450c0a
mov esi, dword [ebp - 0x6e8]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
jmp 0x52d751
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 0x5a4], 0x66415248
lea edx, [ebp - 0x5a4]
mov dword [ebp - 0x5a0], 0x7430674f
mov dword [ebp - 0x59c], 0x754d5842
mov dword [ebp - 0x598], 0x61736741
mov dword [ebp - 0x594], 0x774d534c
mov dword [ebp - 0x590], 0x46674349
mov dword [ebp - 0x58c], 0x59454745
mov dword [ebp - 0x588], 0x4e737a64
mov dword [ebp - 0x584], 0x6d705350
mov dword [ebp - 0x580], 0x6d51774a
mov dword [ebp - 0x57c], 0x4967534d
mov dword [ebp - 0x578], 0x4e677942
mov dword [ebp - 0x574], 0x5551784c
mov dword [ebp - 0x570], 0x6b777766
mov dword [ebp - 0x56c], 0x4349774b
mov dword [ebp - 0x568], 0x49417864
mov dword [ebp - 0x564], 0x3445514a
mov dword [ebp - 0x560], 0x4e6f6e41
mov dword [ebp - 0x55c], 0x2b314148
mov dword [ebp - 0x558], 0x6e494144
mov dword [ebp - 0x554], 0x304d4749
mov dword [ebp - 0x550], 0x65594444
mov dword [ebp - 0x54c], 0x6551544c
mov dword [ebp - 0x548], 0x76686842
mov dword [ebp - 0x544], 0x58346844
mov dword [ebp - 0x540], 0x52304348
mov dword [ebp - 0x53c], 0x5a554247
mov dword [ebp - 0x538], 0x79554466
mov dword [ebp - 0x534], 0x6f6f674b
mov dword [ebp - 0x530], 0x6e557742
mov dword [ebp - 0x52c], 0x69417864
mov dword [ebp - 0x528], 0x4b636a66
mov dword [ebp - 0x524], 0x67454866
mov dword [ebp - 0x520], 0x5659784c
mov dword [ebp - 0x51c], 0x715a3242
mov dword [ebp - 0x518], 0x7a645849
mov dword [ebp - 0x514], 0x434d5250
mov dword [ebp - 0x510], 0x6d63774e
mov dword [ebp - 0x50c], 0x54515450
mov dword [ebp - 0x508], 0x764d6743
mov dword [ebp - 0x504], 0x2b4d5747
mov dword [ebp - 0x500], 0x57417866
mov dword [ebp - 0x4fc], 0x766f7747
mov dword [ebp - 0x4f8], 0x7241674f
mov dword [ebp - 0x4f4], 0x4549474f
mov dword [ebp - 0x4f0], 0x4a777864
mov dword [ebp - 0x4ec], 0x746f5447
mov dword [ebp - 0x4e8], 0x68454141
mov dword [ebp - 0x4e4], 0x36746749
mov dword [ebp - 0x4e0], 0x47554450
mov dword [ebp - 0x4dc], 0x7077684b
mov dword [ebp - 0x4d8], 0x77464166
mov dword [ebp - 0x4d4], 0x79674450
mov dword [ebp - 0x4d0], 0x50597942
mov dword [ebp - 0x4cc], 0x396f7842
mov dword [ebp - 0x4c8], 0x46456941
mov dword [ebp - 0x4c4], 0x38595247
mov dword [ebp - 0x4c0], 0x4e34434c
mov dword [ebp - 0x4bc], 0x78385450
mov dword [ebp - 0x4b8], 0x734e7765
mov dword [ebp - 0x4b4], 0x62777843
mov dword [ebp - 0x4b0], 0x51516a49
mov dword [ebp - 0x4ac], 0x38676a64
mov dword [ebp - 0x4a8], 0x58515448
mov dword [ebp - 0x4a4], 0x7238524c
mov dword [ebp - 0x4a0], 0x73347742
mov dword [ebp - 0x49c], 0x5641444c
mov dword [ebp - 0x498], 0x5051334b
mov dword [ebp - 0x494], 0x3751794b
mov dword [ebp - 0x490], 0x686f4463
mov dword [ebp - 0x48c], 0x4b556941
mov dword [ebp - 0x488], 0x37345247
mov dword [ebp - 0x484], 0x6d49434a
mov dword [ebp - 0x480], 0x49736a65
mov dword [ebp - 0x47c], 0x41494147
mov dword [ebp - 0x478], 0x66444141
push 0
sub esp, 0xc
lea eax, [ebp - 0x474]
mov ecx, esp
push ecx
push eax
push edx
call fcn.00450208
lea ecx, [ebp - 0x718]
call fcn.0052fed7
add esp, 0xc
mov ecx, eax
mov dword [ebp - 4], 6
call fcn.004ab6d2
push eax
mov edx, esi
lea ecx, [ebp - 0x6e0]
call fcn.004c30f0
pop ecx
mov edx, eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x6ec]
call fcn.004c30f0
pop ecx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x20]
push dword [eax]
call fcn.004c3491
mov ecx, dword [ebp - 0x6ec]
lea ecx, [ecx - 0x10]
call fcn.00450c0a
mov ecx, dword [ebp - 0x6e0]
lea ecx, [ecx - 0x10]
call fcn.00450c0a
lea ecx, [ebp - 0x718]
mov byte [ebp - 4], 0xc
call fcn.004ab565
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x20]
call fcn.0052c927
test eax, eax
push 1
pop eax
cmove edi, eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00450c0a
lea eax, [ebp - 0x274]
push eax
push dword [ebp - 0x6d8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x52cd09
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
pop ebx
push dword [ebp - 0x6d8]
cmp eax, 0x12
cmovne edi, ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x52d794
xor ebx, ebx
inc ebx
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x52d7be
push dword [esi]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x52d7be
cmp dword [ebp + 8], eax
je 0x52d7bc
push 4
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, ebx
mov eax, edi
call fcn.00553ba2
ret