Function at 0x426f40
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47ba6b
mov eax, dword fs:[0]
push eax
sub esp, 0x690
mov eax, dword [0x4a8800]
xor eax, esp
mov dword [esp + 0x688], eax
push ebx
push esi
push edi
mov eax, dword [0x4a8800]
xor eax, esp
push eax
lea eax, [esp + 0x6a0]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x18], ebx
mov esi, dword [ebx + 0x14]
cmp esi, 8
jb 0x426f92
mov edx, dword [ebx]
jmp 0x426f94
mov edx, ebx
lea ecx, [esp + 0x48c]
jmp 0x426fa0
movzx eax, word [edx]
lea edx, [edx + 2]
mov word [ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x426fa0
lea ecx, [esp + 0x48c]
add ecx, 0xfffffffe
jmp 0x426fc0
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x426fc0
mov eax, dword [0x495498]
mov dword [ecx], eax
mov ax, word [0x49549c]
mov word [ecx + 4], ax
cmp esi, 8
jb 0x426fe6
mov ecx, dword [ebx]
jmp 0x426fe8
mov ecx, ebx
lea edx, [esp + 0x284]
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x426ff0
lea edi, [esp + 0x284]
add edi, 0xfffffffe
jmp 0x427010
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x427010
mov eax, dword [0x4950f8]
mov dword [edi], eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x490]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [esp + 0x14], ebx
cmp ebx, 0xffffffff
je 0x427214
xor ecx, ecx
jmp 0x427050
movzx eax, word [esp + ecx + 0x284]
lea ecx, [ecx + 2]
mov word [esp + ecx + 0x48a], ax
test ax, ax
jne 0x427050
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, edi
lea eax, [esp + 0x34]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4271e4
lea ecx, [esp + 0x60]
call fcn.00426ec0
test eax, eax
jne 0x427070
lea edx, [esp + 0x60]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x427097
lea edi, [esp + 0x284]
sub edx, esi
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4270b0
mov eax, dword [esp + 0x34]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test al, 0x10
je 0x427194
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
cmp word [esp + 0x284], ax
jne 0x4270fb
xor ecx, ecx
jmp 0x427114
lea ecx, [esp + 0x284]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427105
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x288]
push eax
lea ecx, [esp + 0x24]
call fcn.00422d00
lea ecx, [esp + 0x1c]
mov dword [esp + 0x6a8], 0
call fcn.00426f40
test al, al
mov dword [esp + 0x6a8], 0xffffffff
sete bl
cmp dword [esp + 0x30], 8
jb 0x42715d
push dword [esp + 0x1c]
call fcn.0045a050
add esp, 4
test bl, bl
jne 0x4271de
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [esp + 0x284]
push eax
call esi
xor ecx, ecx
movzx eax, word [esp + ecx + 0x48c]
lea ecx, [ecx + 2]
mov word [esp + ecx + 0x282], ax
test ax, ax
jne 0x427173
mov ebx, dword [esp + 0x14]
jmp 0x427070
test al, 1
je 0x4271ad
lea eax, [esp + 0x284]
push 0x80
push eax
call fcn.0045e94c
add esp, 8
lea eax, [esp + 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x42720d
xor eax, eax
movzx ecx, word [esp + eax + 0x48c]
lea eax, [eax + 2]
mov word [esp + eax + 0x282], cx
test cx, cx
jne 0x4271c1
jmp 0x427068
push dword [esp + 0x14]
jmp 0x42720e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x42720d
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x14], 8
jb 0x427202
mov eax, dword [eax]
push eax
call esi
dec eax
neg eax
sbb eax, eax
inc eax
jmp 0x427216
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
mov ecx, dword [esp + 0x6a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x688]
xor ecx, esp
call fcn.0045b1f5
mov esp, ebp
pop ebp
ret