Function at 0x484864
Capabilities:
Contain obfuscated stackstrings
Copy file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528508
mov eax, dword fs:[0]
push eax
sub esp, 0x404
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 0x3d8], 0
mov byte [ebp - 0x369], 0
push dword [ebp + 0xc]
call fcn.00481158
pop ecx
movzx eax, al
test eax, eax
jne 0x4848c2
push dword [ebp + 0xc]
call fcn.0048118b
pop ecx
movzx eax, al
test eax, eax
jne 0x4848c2
jmp 0x484f74
and dword [ebp - 0x370], 0
mov byte [ebp - 0x36a], 0
lea ecx, [ebp - 0x40]
call fcn.0040b2fe
and dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.0040b2fe
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.0040b2fe
mov byte [ebp - 4], 2
push 0x250
push 0
lea eax, [ebp - 0x368]
push eax
call fcn.004b0090
add esp, 0xc
push 0x53f810
lea ecx, [ebp - 0x88]
call fcn.00409053
mov byte [ebp - 4], 3
push 0x5c
lea eax, [ebp - 0x88]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x118]
push eax
call fcn.00481988
add esp, 0x10
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x38c], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x38c]
call fcn.0040a5f1
mov dword [ebp - 0x390], eax
lea eax, [ebp - 0x368]
push eax
push dword [ebp - 0x390]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x374], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x118]
call fcn.0040a62b
mov byte [ebp - 4], 6
mov byte [ebp - 4], 3
lea eax, [ebp - 0x118]
mov dword [ebp - 0x3e4], eax
mov byte [ebp - 4], 7
mov byte [ebp - 4], 8
mov byte [ebp - 4], 3
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x88]
call fcn.0040a62b
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 2
lea eax, [ebp - 0x88]
mov dword [ebp - 0x3e8], eax
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 2
cmp dword [ebp - 0x374], 0xffffffff
je 0x484e75
mov byte [ebp - 0x369], 1
push 0x53f818
lea eax, [ebp - 0x33c]
push eax
call fcn.004cf523
pop ecx
pop ecx
test eax, eax
je 0x484a19
push 0x53f81c
lea eax, [ebp - 0x33c]
push eax
call fcn.004cf523
pop ecx
pop ecx
test eax, eax
jne 0x484a1e
jmp 0x484e4c
lea eax, [ebp - 0x33c]
push eax
lea ecx, [ebp - 0xa0]
call fcn.00409053
mov byte [ebp - 4], 0xd
push 0x5c
lea eax, [ebp - 0xa0]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call fcn.00481988
add esp, 0x10
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x398], eax
mov byte [ebp - 4], 0xe
push dword [ebp - 0x398]
lea ecx, [ebp - 0x40]
call fcn.0041dc17
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x100]
call fcn.0040a62b
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x100]
mov dword [ebp - 0x3ec], eax
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xa0]
call fcn.0040a62b
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 2
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x3f0], eax
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0x16
mov byte [ebp - 4], 2
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0xe8]
push eax
call fcn.00485eaa
add esp, 0xc
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x3a0], eax
mov byte [ebp - 4], 0x17
push dword [ebp - 0x3a0]
lea ecx, [ebp - 0x58]
call fcn.0041dc17
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xe8]
call fcn.0040a62b
mov byte [ebp - 4], 0x19
mov byte [ebp - 4], 2
lea eax, [ebp - 0xe8]
mov dword [ebp - 0x3f4], eax
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], 2
lea eax, [ebp - 0x33c]
push eax
lea ecx, [ebp - 0x70]
call fcn.00409053
mov byte [ebp - 4], 0x1c
push 0x5c
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xd0]
push eax
call fcn.00481988
add esp, 0x10
mov dword [ebp - 0x3a4], eax
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x3d4], eax
mov byte [ebp - 4], 0x1d
push dword [ebp - 0x3d4]
lea ecx, [ebp - 0x28]
call fcn.0041dc17
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xd0]
call fcn.0040a62b
mov byte [ebp - 4], 0x1f
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0xd0]
mov dword [ebp - 0x3f8], eax
mov byte [ebp - 4], 0x20
mov byte [ebp - 4], 0x21
mov byte [ebp - 4], 0x1c
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x70]
call fcn.0040a62b
mov byte [ebp - 4], 0x23
mov byte [ebp - 4], 2
lea eax, [ebp - 0x70]
mov dword [ebp - 0x3fc], eax
mov byte [ebp - 4], 0x24
mov byte [ebp - 4], 0x25
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x368]
and eax, 0x10
je 0x484c20
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00484864
add esp, 0x18
movzx eax, al
test eax, eax
jne 0x484c1b
mov byte [ebp - 0x369], 0
jmp 0x484e67
jmp 0x484e4c
cmp dword [ebp + 0x18], 0
je 0x484d2f
mov byte [ebp - 0x36a], 0
lea eax, [ebp - 0x400]
push eax
mov ecx, dword [ebp + 0x18]
call fcn.00486873
mov eax, dword [eax]
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x404]
push eax
mov ecx, dword [ebp + 0x18]
call fcn.0048689b
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebp - 0x3d0]
mov ecx, dword [ebp - 0x370]
cmp ecx, dword [eax]
jne 0x484c79
mov dword [ebp - 0x378], 1
jmp 0x484c80
and dword [ebp - 0x378], 0
movzx eax, byte [ebp - 0x378]
test eax, eax
jne 0x484c97
mov dword [ebp - 0x37c], 1
jmp 0x484c9e
and dword [ebp - 0x37c], 0
movzx eax, byte [ebp - 0x37c]
test eax, eax
je 0x484d1f
mov eax, dword [ebp - 0x370]
add eax, 0x10
mov dword [ebp - 0x3cc], eax
mov ecx, dword [ebp - 0x3cc]
call fcn.0040a5f1
mov dword [ebp - 0x3c8], eax
lea ecx, [ebp - 0x58]
call fcn.0040a5f1
mov dword [ebp - 0x3c4], eax
push dword [ebp - 0x3c8]
push dword [ebp - 0x3c4]
call fcn.004d5f0c
pop ecx
pop ecx
test eax, eax
jne 0x484cf7
mov byte [ebp - 0x36a], 1
jmp 0x484d1f
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x3c0], eax
lea ecx, [ebp - 0x370]
call fcn.0048543b
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x408], eax
jmp 0x484c48
movzx eax, byte [ebp - 0x36a]
test eax, eax
je 0x484d2f
jmp 0x484e4c
lea eax, [ebp - 0x28]
push eax
call fcn.00481158
pop ecx
movzx eax, al
test eax, eax
je 0x484d6f
lea eax, [ebp - 0x28]
push eax
call fcn.00482b35
pop ecx
movzx eax, al
test eax, eax
jne 0x484d6f
cmp dword [ebp + 0x1c], 0
je 0x484d63
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 0x1c]
call fcn.0040b598
mov byte [ebp - 0x369], 0
jmp 0x484e67
mov byte [ebp - 0x36b], 0
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x484dd3
lea ecx, [ebp - 0x28]
call fcn.0040a5f1
mov dword [ebp - 0x3b8], eax
lea ecx, [ebp - 0x40]
call fcn.0040a5f1
mov dword [ebp - 0x3b4], eax
push 3
push dword [ebp - 0x3b8]
push dword [ebp - 0x3b4]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x484dbe
mov dword [ebp - 0x384], 1
jmp 0x484dc5
and dword [ebp - 0x384], 0
mov al, byte [ebp - 0x384]
mov byte [ebp - 0x36b], al
jmp 0x484e26
lea ecx, [ebp - 0x28]
call fcn.0040a5f1
mov dword [ebp - 0x3b0], eax
lea ecx, [ebp - 0x40]
call fcn.0040a5f1
mov dword [ebp - 0x3ac], eax
push 0
push dword [ebp - 0x3b0]
push dword [ebp - 0x3ac]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x484e13
mov dword [ebp - 0x380], 1
jmp 0x484e1a
and dword [ebp - 0x380], 0
mov al, byte [ebp - 0x380]
mov byte [ebp - 0x36b], al
movzx eax, byte [ebp - 0x36b]
test eax, eax
jne 0x484e4c
cmp dword [ebp + 0x1c], 0
je 0x484e43
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 0x1c]
call fcn.0040b598
mov byte [ebp - 0x369], 0
jmp 0x484e67
lea eax, [ebp - 0x368]
push eax
push dword [ebp - 0x374]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4849eb
push dword [ebp - 0x374]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x484ee5
cmp dword [ebp + 0x1c], 0
je 0x484ee5
push dword [ebp + 8]
push str.path_fail:
lea eax, [ebp - 0xb8]
push eax
call fcn.00425f4c
add esp, 0xc
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x3bc], eax
mov byte [ebp - 4], 0x26
push dword [ebp - 0x3bc]
mov ecx, dword [ebp + 0x1c]
call fcn.0041dc17
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xb8]
call fcn.0040a62b
mov byte [ebp - 4], 0x28
mov byte [ebp - 4], 2
lea eax, [ebp - 0xb8]
mov dword [ebp - 0x40c], eax
mov byte [ebp - 4], 0x29
mov byte [ebp - 4], 0x2a
mov byte [ebp - 4], 2
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x28]
call fcn.0040a62b
mov byte [ebp - 4], 0x2c
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
mov dword [ebp - 0x410], eax
mov byte [ebp - 4], 0x2d
mov byte [ebp - 4], 0x2e
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x58]
call fcn.0040a62b
mov byte [ebp - 4], 0x30
mov byte [ebp - 4], 0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x3dc], eax
mov byte [ebp - 4], 0x31
mov byte [ebp - 4], 0x32
mov byte [ebp - 4], 0
mov dword [ebp - 4], 0x33
lea ecx, [ebp - 0x40]
call fcn.0040a62b
mov dword [ebp - 4], 0x34
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x40]
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 4], 0x35
mov dword [ebp - 4], 0x36
or dword [ebp - 4], 0xffffffff
xor eax, eax
jne 0x48489d
mov al, byte [ebp - 0x369]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ad99f
leave
ret