Function at 0x530f80
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65cb58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2a0
push ebx
push esi
push edi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
call fcn.004011f0
add eax, 0x10
add esp, 4
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 3
push 2
push 0x674ca8
lea ecx, [ebp - 0x20]
call fcn.00401710
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x2ac]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x5310b3
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x531010
xor edx, edx
mov edi, 7
lea eax, [ebp - 0x280]
mov word [ebp - 0x54], dx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x44], 0
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x531030
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp - 0x54]
call fcn.00407940
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00413310
mov byte [ebp - 4], 4
cmp dword [ebp - 0x40], 8
jb 0x531075
mov edx, dword [ebp - 0x54]
push edx
call fcn.0060faf6
add esp, 4
lea ecx, [ebp - 0x2ac]
push ecx
xor eax, eax
push esi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x44], 0
mov word [ebp - 0x54], ax
call ebx
test eax, eax
jne 0x531010
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x531010
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
mov ecx, ebx
sub ecx, edi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x531442
mov dword [ebp - 0x1c], edi
cmp edi, ebx
je 0x531442
mov esi, dword [ebp + 8]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi - 4], 0
lea ecx, [esi - 4]
jl 0x531104
cmp eax, dword [esi - 0x10]
jne 0x531104
lea edi, [esi - 0x10]
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x53113c
mov ecx, dword [esi - 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x5314f9
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.0060fbd3
add esp, 0x10
add edi, 0x10
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 7
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi - 4], 0
lea ecx, [esi - 4]
jl 0x53116f
cmp eax, dword [esi - 0x10]
jne 0x53116f
lea edi, [esi - 0x10]
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x5311a7
mov ecx, dword [esi - 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x5314f9
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.0060fbd3
add esp, 0x10
lea ebx, [edi + 0x10]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 9
mov esi, dword [ebp - 0x1c]
cmp dword [esi + 0x14], 8
jb 0x5311bc
mov esi, dword [esi]
mov edx, dword [0x700724]
mov eax, dword [edx + 0xc]
mov ecx, 0x700724
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 0xa
test esi, esi
je 0x531200
test esi, 0xffff0000
jne 0x531204
movzx esi, si
push 0
push esi
call fcn.00403bf0
add esp, 8
test eax, eax
je 0x53122c
push esi
push eax
lea ecx, [ebp - 0x14]
call fcn.00405a10
jmp 0x531229
xor eax, eax
jmp 0x53121f
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x531210
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.00401670
mov edi, dword [ebp - 0x14]
mov byte [ebp - 4], 0xb
mov ecx, 0x674ca0
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x53125d
test dx, dx
je 0x531259
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x53125d
add eax, 4
add ecx, 4
test dx, dx
jne 0x531237
xor eax, eax
jmp 0x531262
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x5313c7
mov ecx, 0x671930
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x53129c
test dx, dx
je 0x531298
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x53129c
add eax, 4
add ecx, 4
test dx, dx
jne 0x531276
xor eax, eax
jmp 0x5312a1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x5313c7
push 1
push 0x66ea40
lea ecx, [ebp - 0x10]
call fcn.00401710
mov eax, dword [edi - 0xc]
push eax
push edi
lea ecx, [ebp - 0x10]
call fcn.00401710
push 1
push 0x66ea40
lea ecx, [ebp - 0x18]
call fcn.00401710
mov eax, dword [edi - 0xc]
push eax
push edi
lea ecx, [ebp - 0x18]
call fcn.00401710
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x53136c
push 1
push 0x66ea40
lea ecx, [ebp - 0x10]
call fcn.00401710
push 1
push 0x66ea40
lea ecx, [ebp - 0x18]
call fcn.00401710
mov ebx, dword [ebp - 0x18]
push ecx
lea eax, [ebx - 0x10]
mov esi, esp
mov dword [ebp - 0x58], esp
push eax
mov dword [ebp - 0x38], esi
call fcn.004011f0
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 0x10
mov esi, dword [ebp - 0x10]
lea eax, [esi - 0x10]
mov edi, esp
mov dword [ebp - 0x38], esp
push eax
mov dword [ebp - 0x5c], edi
call fcn.004011f0
add eax, 0x10
add esp, 4
mov dword [edi], eax
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x34]
call fcn.00530f80
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, dword [ebp - 0x14]
mov byte [ebp - 4], 9
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x53138c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 7
add ebx, 0xfffffff0
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5313ac
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
mov byte [ebp - 4], 4
add esi, 0xfffffff0
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x53142a
mov ecx, dword [esi]
push esi
jmp 0x531423
mov byte [ebp - 4], 9
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5313e7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 7
lea eax, [ebx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x531407
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x53142a
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x1c]
add eax, 0x1c
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x2c]
jne 0x5310db
mov edi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 3
xor eax, eax
cmp edi, eax
je 0x531471
mov esi, edi
cmp edi, ebx
je 0x531466
lea ecx, [ebp - 0x24]
push esi
push ecx
call fcn.0040bba0
add esi, 0x1c
add esp, 8
cmp esi, ebx
jne 0x531452
push edi
call fcn.0060faf6
add esp, 4
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x53149d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5314c0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5314e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00404070
int3