Function at 0x40ce80
Capabilities:
Contain obfuscated stackstrings
Create directory
Delete directory
Delete file
Write file on windows

Disassembly:
push ebp
mov eax, 0x41bc2c
mov ebp, esp
push edi
push esi
lea ecx, [ebp - 0x214]
lea edx, [ebp - 0x41c]
push ebx
lea edi, [ebp - 0x444]
sub esp, 0x464
mov dword [ebp - 0x423], 0x730d2065
mov dword [ebp - 0x43b], 0x73726966
mov dword [ebp - 0x437], 0x696c2074
mov dword [ebp - 0x433], 0xa0d656e
mov dword [ebp - 0x42f], 0x6f636573
mov dword [ebp - 0x42b], 0xa0a646e
mov dword [ebp - 0x427], 0xd0d740d
mov dword [ebp - 0x420], 0xa7473
call fcn.00407140
lea eax, [ebp - 0x214]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
sub esp, 8
mov ebx, eax
mov eax, 0x88a
call fcn.00406da0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 8], ebx
mov dword [esp], ebx
mov ebx, 0x3e8
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.Unexpected_retval__d__error__ld._n
call fcn.004077c0
lea eax, [ebp - 0x41c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov esi, eax
mov eax, 0x88e
call fcn.00406da0
xor eax, eax
cmp esi, 0xffffffff
mov dword [esp + 4], str.CreateFile_failed_n
setne al
mov dword [esp], eax
call fcn.004077c0
lea esi, [esi]
lea eax, [ebp - 0x43b]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x1e
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
sub ebx, 1
jne 0x40cfb0
mov dword [esp], esi
lea ebx, [ebp - 0x448]
lea esi, [ebp - 0x440]
call dword [sym.imp.kernel32.dll_CloseHandle]
lea eax, [ebp - 0x41c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.oleaut32.dll_SysAllocString]
mov edx, dword [0x448004]
mov dword [ebp - 0x440], eax
sub esp, 4
mov ecx, dword [edx]
mov dword [esp], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], eax
call dword [ecx + 0x7c]
sub esp, 0x18
mov ebx, eax
mov eax, 0x896
call fcn.00406da0
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.Unexpected_hr__lx._n
mov dword [esp], eax
call fcn.004077c0
mov eax, dword [ebp - 0x440]
mov ebx, dword [sym.imp.oleaut32.dll_SysFreeString]
mov dword [esp], eax
call ebx
mov eax, dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [ebp - 0x450], 0x3e8
sub esp, 4
mov dword [ebp - 0x454], eax
jmp 0x40d1da
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x40d4b0
mov eax, edi
call fcn.00406dc0
mov edi, dword [ebp - 0x440]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], str.ReadLine_returned__s_n
cmp word [edi], 0
sete al
mov dword [esp], eax
call fcn.004077c0
mov eax, dword [ebp - 0x440]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x448]
sub esp, 4
mov edx, dword [eax]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [edx + 0x30]
sub esp, 8
mov edi, eax
call fcn.00416600
mov dword [eax], 0x41b595
mov dword [eax + 4], 0x8ab
xor eax, eax
test edi, edi
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_hr__lx._n
call fcn.004077c0
call fcn.00416600
mov dword [eax], 0x41b595
mov edx, dword [ebp - 0x440]
mov dword [eax + 4], 0x8ac
test edx, edx
je 0x40d4f0
mov eax, edx
shr eax, 0x10
je 0x40d470
mov dword [esp], edx
mov dword [esp + 4], 0xffffffff
mov dword [ebp - 0x44c], edx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, dword [ebp - 0x44c]
sub esp, 8
test eax, eax
jne 0x40d490
mov eax, edx
call fcn.00406dc0
mov edx, dword [ebp - 0x440]
mov edi, eax
mov dword [esp], edx
mov dword [esp + 4], str._rt_r_re__rst
call dword [sym.imp.msvcrt.dll_wcscmp]
mov dword [esp + 8], edi
test eax, eax
mov dword [esp + 4], str.ReadLine_returned__s_n
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004077c0
mov eax, dword [ebp - 0x440]
mov dword [esp], eax
call ebx
sub esp, 4
sub dword [ebp - 0x450], 1
je 0x40d50a
mov eax, dword [ebp - 0x448]
mov edx, dword [eax]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [edx + 0x30]
sub esp, 8
mov edi, eax
call fcn.00416600
mov dword [eax], 0x41b595
mov dword [eax + 4], 0x89c
xor eax, eax
test edi, edi
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_hr__lx._n
call fcn.004077c0
call fcn.00416600
mov dword [eax], 0x41b595
mov edx, dword [ebp - 0x440]
mov dword [eax + 4], 0x89d
test edx, edx
je 0x40d500
mov eax, edx
shr eax, 0x10
je 0x40d450
mov dword [esp], edx
mov dword [esp + 4], 0xffffffff
mov dword [ebp - 0x44c], edx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, dword [ebp - 0x44c]
sub esp, 8
test eax, eax
jne 0x40d4c0
mov eax, edx
call fcn.00406dc0
mov edx, dword [ebp - 0x440]
mov edi, eax
mov dword [esp], edx
mov dword [esp + 4], str.first_line
call dword [sym.imp.msvcrt.dll_wcscmp]
mov dword [esp + 8], edi
test eax, eax
mov dword [esp + 4], str.ReadLine_returned__s_n
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004077c0
mov eax, dword [ebp - 0x440]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x448]
sub esp, 4
mov edx, dword [eax]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [edx + 0x30]
sub esp, 8
mov edi, eax
call fcn.00416600
mov dword [eax], 0x41b595
mov dword [eax + 4], 0x8a1
xor eax, eax
test edi, edi
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_hr__lx._n
call fcn.004077c0
call fcn.00416600
mov dword [eax], 0x41b595
mov edx, dword [ebp - 0x440]
mov dword [eax + 4], 0x8a2
test edx, edx
je 0x40d4d0
mov eax, edx
shr eax, 0x10
je 0x40d430
mov dword [esp], edx
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x44c], edx
call eax
mov edx, dword [ebp - 0x44c]
sub esp, 8
test eax, eax
jne 0x40d4a0
mov eax, edx
call fcn.00406dc0
mov edx, dword [ebp - 0x440]
mov edi, eax
mov dword [esp], edx
mov dword [esp + 4], 0x41bc7e
call dword [sym.imp.msvcrt.dll_wcscmp]
mov dword [esp + 8], edi
test eax, eax
mov dword [esp + 4], str.ReadLine_returned__s_n
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004077c0
mov eax, dword [ebp - 0x440]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x448]
sub esp, 4
mov edx, dword [eax]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [edx + 0x30]
sub esp, 8
mov edi, eax
call fcn.00416600
mov dword [eax], 0x41b595
mov dword [eax + 4], 0x8a6
xor eax, eax
test edi, edi
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_hr__lx._n
call fcn.004077c0
call fcn.00416600
mov dword [eax], 0x41b595
mov edi, dword [ebp - 0x440]
mov dword [eax + 4], 0x8a7
test edi, edi
je 0x40d4e0
mov eax, edi
shr eax, 0x10
jne 0x40d098
movzx edi, di
mov dword [esp], str._04x
mov dword [esp + 4], edi
call fcn.00406a40
mov edi, dword [ebp - 0x440]
jmp 0x40d0c1
movzx edx, dx
mov dword [esp], str._04x
mov dword [esp + 4], edx
call fcn.00406a40
mov edx, dword [ebp - 0x440]
mov edi, eax
jmp 0x40d363
movzx edx, dx
mov dword [esp], str._04x
mov dword [esp + 4], edx
call fcn.00406a40
mov edx, dword [ebp - 0x440]
mov edi, eax
jmp 0x40d280
movzx edx, dx
mov dword [esp], str._04x
mov dword [esp + 4], edx
call fcn.00406a40
mov edx, dword [ebp - 0x440]
mov edi, eax
jmp 0x40d192
mov edx, dword [ebp - 0x440]
mov edi, str._invalid_
jmp 0x40d192
mov edx, dword [ebp - 0x440]
mov edi, str._invalid_
jmp 0x40d363
mov edi, dword [ebp - 0x440]
mov eax, str._invalid_
jmp 0x40d0c1
mov edx, dword [ebp - 0x440]
mov edi, str._invalid_
jmp 0x40d280
mov edi, str._null_
jmp 0x40d363
mov eax, str._null_
jmp 0x40d0c1
mov edi, str._null_
jmp 0x40d192
mov edi, str._null_
jmp 0x40d280
mov dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x448]
mov edx, dword [eax]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [edx + 0x30]
sub esp, 8
mov esi, eax
mov eax, 0x8b2
call fcn.00406da0
xor eax, eax
cmp esi, 0x800a003e
mov dword [esp + 8], esi
sete al
mov dword [esp + 4], str.Unexpected_hr__lx._n
mov dword [esp], eax
call fcn.004077c0
mov eax, 0x8b3
call fcn.00406da0
mov esi, dword [ebp - 0x440]
test esi, esi
je 0x40d681
mov eax, esi
shr eax, 0x10
je 0x40d653
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x40d671
mov eax, esi
call fcn.00406dc0
mov esi, dword [ebp - 0x440]
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
sete al
mov dword [esp + 4], str.ReadLine_returned__s_n
mov dword [esp], eax
mov esi, dword fs:[0x18]
call fcn.004077c0
mov eax, dword [ebp - 0x440]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x448]
sub esp, 4
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
lea eax, [ebp - 0x41c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
sub esp, 4
mov ebx, eax
mov eax, 0x8b9
call fcn.00406da0
mov eax, dword [esi + 0x34]
mov dword [esp], ebx
mov dword [esp + 4], str.Unexpected_retval__ld._n
mov dword [esp + 8], eax
call fcn.004077c0
lea eax, [ebp - 0x214]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
sub esp, 4
mov ebx, eax
mov eax, 0x8bc
call fcn.00406da0
mov eax, dword [esi + 0x34]
mov dword [esp], ebx
mov dword [esp + 4], str.Unexpected_retval__ld._n
mov dword [esp + 8], eax
call fcn.004077c0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
movzx esi, si
mov dword [esp], str._04x
mov dword [esp + 4], esi
call fcn.00406a40
mov esi, dword [ebp - 0x440]
jmp 0x40d5a0
mov esi, dword [ebp - 0x440]
mov eax, str._invalid_
jmp 0x40d5a0
mov eax, str._null_
jmp 0x40d5a0