Function at 0x416f70
Capabilities:
Delete file
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x61ed62
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x69e3d4]
xor eax, esp
mov dword [esp + 0x290], eax
push ebx
push esi
push edi
mov eax, dword [0x69e3d4]
xor eax, esp
push eax
lea eax, [esp + 0x2a8]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x20], ebx
call fcn.004aef10
mov dword [esp + 0x1c], eax
call fcn.004af870
mov edi, ebx
call fcn.0041bd50
call fcn.004e12d0
cmp dword [ebx + 0x294], 0
mov edi, eax
mov dword [esp + 0x24], edi
je 0x417279
mov esi, ebx
call fcn.004173e0
cmp edi, 1
jg 0x417279
lea eax, [esp + 0x194]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
lea ecx, [esp + 0x194]
push ecx
lea ecx, [esp + 0x14]
call fcn.00404eb0
push 1
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x2b8], 0
call fcn.00413d20
mov eax, dword [eax]
push 0x645b40
push eax
call fcn.005a58c6
add esp, 8
test eax, eax
mov eax, dword [esp + 0x18]
setne bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417067
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x417079
push 0x645b40
lea ecx, [esp + 0x14]
call fcn.00407260
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
push eax
call fcn.00401de0
add eax, 0x10
add esp, 4
mov dword [esp + 0x18], eax
push 0x10
push str.HS6ClipImage_.
lea ecx, [esp + 0x18]
mov byte [esp + 0x2b8], 1
call fcn.00407400
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x54]
push ecx
push edx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x417222
mov bl, 2
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x18]
call fcn.00404eb0
mov byte [esp + 0x2b0], bl
mov ecx, dword [esp + 0x14]
push 0x5f
push ecx
call fcn.005a879d
add esp, 8
test eax, eax
jne 0x4170f5
or eax, 0xffffffff
jmp 0x4170f9
sub eax, dword [esp + 0x14]
add eax, 1
push eax
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x1c]
call fcn.00410380
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2b4], 3
call fcn.004074e0
mov byte [esp + 0x2b0], bl
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417144
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
call fcn.005a671d
add esp, 4
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x18]
push 0x646c64
push edx
mov edi, eax
call fcn.005a7081
mov eax, edi
sub eax, dword [esp + 0x50]
add esp, 0xc
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x5460
jle 0x4171db
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.00401c10
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2b4], 4
call fcn.004074e0
mov byte [esp + 0x2b0], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4171d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov byte [esp + 0x2b0], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x417203
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x54]
push ecx
push esi
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x4170c5
push esi
call dword [sym.imp.kernel32.dll_FindClose]
mov edi, dword [esp + 0x24]
mov byte [esp + 0x2b0], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41724a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x2b0], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417275
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x20]
cmp dword [ebx + 0x54c], 0
jne 0x41728d
cmp dword [esp + 0x1c], 0
je 0x41730f
lea ecx, [esp + 0x30]
call fcn.0057e362
cmp edi, 1
mov dword [esp + 0x2b0], 5
jle 0x4172fb
lea edi, [esp + 0x30]
call fcn.004e1320
test eax, eax
je 0x4172fb
mov ecx, dword [ebx + 0x54c]
mov edi, dword [esp + 0x38]
add edi, 0xffffffff
mov dword [esp + 0x1c], ecx
mov dword [ebx + 0x54c], 0
js 0x4172fb
test edi, edi
jl 0x4173d9
cmp edi, dword [esp + 0x38]
jge 0x4173d9
mov edx, dword [esp + 0x34]
lea esi, [edx + edi*4]
call sub.kernel32.dll_GetCurrentProcessId
cmp dword [esi], eax
jne 0x4173a7
sub edi, 1
jns 0x4172d0
lea ecx, [esp + 0x30]
mov dword [esp + 0x2b0], 0xffffffff
call fcn.0057e379
mov edx, dword [ebx + 0x298]
mov edi, dword [sym.imp.gdi32.dll_DeleteObject]
push edx
call edi
mov eax, dword [ebx + 0x2d8]
push eax
call edi
mov ecx, dword [ebx + 0x2dc]
push ecx
call edi
mov edx, dword [ebx + 0x2e0]
push edx
call edi
mov eax, dword [ebx + 0x2e4]
push eax
call edi
mov eax, dword [ebx + 0x18c]
test eax, eax
je 0x417355
push eax
call fcn.005a8a7b
add esp, 4
mov eax, dword [ebx + 0x184]
test eax, eax
je 0x417368
push eax
call fcn.005a8a7b
add esp, 4
call fcn.0045d650
call fcn.00529b09
call fcn.00519410
call fcn.0050c28b
mov ecx, ebx
call fcn.0057b341
mov ecx, dword [esp + 0x2a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x290]
xor ecx, esp
call fcn.005a58d9
mov esp, ebp
pop ebp
ret
cmp edi, dword [esp + 0x38]
jge 0x4173d9
mov eax, dword [esp + 0x34]
mov eax, dword [eax + edi*4]
call fcn.004e13e0
xor ecx, ecx
cmp dword [esp + 0x1c], ecx
sete cl
push ecx
push 0x8042
push 0x111
push eax
call dword [sym.imp.user32.dll_SendMessageA]
jmp 0x4172fb
jmp fcn.0056c8bd