Function at 0x4fa724
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
test dword [0x7eda90], 0xffffff80
jne 0x4fa74c
test dword [0x7eda90], 0xffffffff
jne 0x4faacc
call fcn.006a6b5c
jmp fcn.004fa724
push edi
push esi
push ebp
push ebx
sub esp, 0x10
mov ebx, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
cmp eax, 1
je 0x4faac2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x91
je 0x4fa77f
cmp eax, 5
je 0x4fa77f
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret
lea ecx, [esp + 4]
mov edx, ebx
call fcn.004f5acc
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
test eax, eax
je 0x4fa7d5
mov esi, 0x6ffec0
mov edi, eax
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fa79d
mov ecx, dword [esp + 8]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fa7c2
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fa7ad
dec eax
cmp byte [eax + 0x6ffebf], 0x5c
je 0x4fa7d7
mov byte [eax + 0x6ffec0], 0x5c
inc eax
jmp 0x4fa7d7
xor eax, eax
lea edx, [eax + 0x6ffec0]
mov byte [eax + 0x6ffec0], 0
push 0x6cfa98
push 0x6c3a54
push edx
call fcn.006964d6
add esp, 0xc
mov ecx, 0x13e
call fcn.004dbcd8
mov ebp, eax
push ebp
push 0x6ffec0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4faab3
mov ecx, dword [ebp]
and ecx, 0x10
mov eax, 1
mov ecx, 0
cmovne ecx, eax
lea edi, [ebp + 0x2c]
mov dword [esp + 0xc], edi
mov esi, 0x6cf9dc
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fa859
test dl, dl
je 0x4fa855
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fa859
add edi, 2
add esi, 2
test dl, dl
jne 0x4fa839
xor eax, eax
jmp 0x4fa85e
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fa9d0
mov edi, dword [esp + 0xc]
mov esi, 0x6cfa9c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fa88f
test dl, dl
je 0x4fa88b
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fa88f
add edi, 2
add esi, 2
test dl, dl
jne 0x4fa86f
xor eax, eax
jmp 0x4fa894
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fa9d0
test ecx, ecx
jne 0x4fa955
mov eax, 0x6ffcc0
mov edx, 0x6ffdc0
mov ecx, dword [esp + 8]
cmp ecx, eax
cmove eax, edx
mov dword [esp], eax
test ecx, ecx
je 0x4fa8f8
mov esi, eax
mov edi, ecx
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fa8c2
mov ecx, dword [esp + 8]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fa8e7
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fa8d2
dec eax
mov edx, dword [esp]
cmp byte [eax + edx - 1], 0x5c
je 0x4fa8fa
mov byte [eax + edx], 0x5c
inc eax
jmp 0x4fa8fa
xor eax, eax
mov edx, dword [esp]
lea ecx, [edx + eax]
mov byte [eax + edx], 0
mov eax, dword [esp + 0xc]
push eax
push 0x6c3a54
push ecx
call fcn.006964d6
add esp, 0xc
mov eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
je 0x4fa9d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4fa9d0
push 0x80
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4fa9d0
mov eax, 0x6ffcc0
mov edx, 0x6ffdc0
mov ecx, dword [esp + 8]
cmp ecx, eax
cmove eax, edx
mov dword [esp], eax
test ecx, ecx
je 0x4fa9a9
mov esi, eax
mov edi, ecx
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fa973
mov ecx, dword [esp + 8]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fa998
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fa983
dec eax
mov edx, dword [esp]
cmp byte [eax + edx - 1], 0x5c
je 0x4fa9ab
mov byte [eax + edx], 0x5c
inc eax
jmp 0x4fa9ab
xor eax, eax
mov edx, dword [esp]
lea ecx, [edx + eax]
mov byte [eax + edx], 0
mov eax, dword [esp + 0xc]
push eax
push 0x6c3a54
push ecx
call fcn.006964d6
add esp, 0xc
mov ecx, dword [esp]
call fcn.004fa724
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
jne 0x4faa78
mov edi, dword [esp + 0xc]
mov esi, 0x6cf9dc
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4faa0a
test dl, dl
je 0x4faa06
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4faa0a
add edi, 2
add esi, 2
test dl, dl
jne 0x4fa9ea
xor eax, eax
jmp 0x4faa0f
sbb eax, eax
or eax, 1
test eax, eax
je 0x4faa67
mov edi, dword [esp + 0xc]
mov esi, 0x6cfa9c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4faa3c
test dl, dl
je 0x4faa38
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4faa3c
add edi, 2
add esi, 2
test dl, dl
jne 0x4faa1c
xor eax, eax
jmp 0x4faa41
sbb eax, eax
or eax, 1
test eax, eax
je 0x4faa67
mov eax, dword [ebp]
xor edx, edx
and eax, 0x10
mov esi, 1
cmovne edx, esi
mov edi, dword [esp + 8]
push edi
mov ecx, dword [esp + 0x10]
call fcn.004fb6d0
test eax, eax
je 0x4faa78
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
je 0x4fa9e1
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, ebp
call fcn.004db418
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4faa98
xor ebx, ebx
jmp 0x4faaa0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [esp + 4]
call fcn.004db418
mov eax, ebx
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret
mov ecx, ebp
call fcn.004db418
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4faa86
xor eax, eax
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret
push edi
push esi
push ebp
push ebx
sub esp, 0x10
mov ebx, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
cmp eax, 1
je 0x4fae32
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x91
je 0x4faaff
cmp eax, 5
je 0x4faaff
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret
lea ecx, [esp]
mov edx, ebx
call fcn.004f5acc
mov eax, dword [esp]
mov dword [esp + 4], eax
test eax, eax
je 0x4fab53
mov esi, 0x6ffec0
mov edi, eax
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fab1b
mov ecx, dword [esp + 4]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fab40
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fab2b
dec eax
cmp byte [eax + 0x6ffebf], 0x5c
je 0x4fab55
mov byte [eax + 0x6ffec0], 0x5c
inc eax
jmp 0x4fab55
xor eax, eax
lea edx, [eax + 0x6ffec0]
mov byte [eax + 0x6ffec0], 0
push 0x6cfa98
push 0x6c3a54
push edx
call fcn.006964d6
add esp, 0xc
mov ecx, 0x13e
call fcn.004dbcd8
mov ebx, eax
push ebx
push 0x6ffec0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
je 0x4fae23
mov eax, dword [ebx]
and eax, 0x10
xor ecx, ecx
test eax, eax
setne cl
lea edi, [ebx + 0x2c]
mov dword [esp + 0xc], edi
mov esi, 0x6cf9dc
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fabd2
test dl, dl
je 0x4fabce
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fabd2
add edi, 2
add esi, 2
test dl, dl
jne 0x4fabb2
xor eax, eax
jmp 0x4fabd7
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fad3a
mov edi, dword [esp + 0xc]
mov esi, 0x6cfa9c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fac08
test dl, dl
je 0x4fac04
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fac08
add edi, 2
add esi, 2
test dl, dl
jne 0x4fabe8
xor eax, eax
jmp 0x4fac0d
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fad3a
test ecx, ecx
jne 0x4facc2
mov edx, 0x6ffcc0
mov eax, dword [esp + 4]
cmp eax, edx
je 0x4fac31
mov ebp, 0x6ffcc0
jmp 0x4fac36
mov ebp, 0x6ffdc0
test eax, eax
je 0x4fac71
mov esi, ebp
mov edi, eax
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fac3e
mov ecx, dword [esp + 4]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fac63
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fac4e
dec eax
cmp byte [eax + ebp - 1], 0x5c
je 0x4fac73
mov byte [eax + ebp], 0x5c
inc eax
jmp 0x4fac73
xor eax, eax
lea edx, [ebp + eax]
mov byte [eax + ebp], 0
mov eax, dword [esp + 0xc]
push eax
push 0x6c3a54
push edx
call fcn.006964d6
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
je 0x4fad3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4fad3a
push 0x80
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4fad3a
mov edx, 0x6ffcc0
mov eax, dword [esp + 4]
cmp eax, edx
je 0x4facd6
mov ebp, 0x6ffcc0
jmp 0x4facdb
mov ebp, 0x6ffdc0
test eax, eax
je 0x4fad16
mov esi, ebp
mov edi, eax
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4face3
mov ecx, dword [esp + 4]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fad08
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4facf3
dec eax
cmp byte [eax + ebp - 1], 0x5c
je 0x4fad18
mov byte [eax + ebp], 0x5c
inc eax
jmp 0x4fad18
xor eax, eax
lea edx, [ebp + eax]
mov byte [eax + ebp], 0
mov eax, dword [esp + 0xc]
push eax
push 0x6c3a54
push edx
call fcn.006964d6
add esp, 0xc
mov ecx, ebp
call fcn.004fa724
push ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
jne 0x4fade6
mov ebp, dword [esp + 8]
mov edi, dword [esp + 0xc]
mov esi, 0x6cf9dc
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fad7c
test dl, dl
je 0x4fad78
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fad7c
add edi, 2
add esi, 2
test dl, dl
jne 0x4fad5c
xor eax, eax
jmp 0x4fad81
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fadd5
mov edi, dword [esp + 0xc]
mov esi, 0x6cfa9c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fadae
test dl, dl
je 0x4fadaa
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fadae
add edi, 2
add esi, 2
test dl, dl
jne 0x4fad8e
xor eax, eax
jmp 0x4fadb3
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fadd5
mov eax, dword [ebx]
and eax, 0x10
xor edx, edx
test eax, eax
setne dl
mov esi, dword [esp + 4]
push esi
mov ecx, dword [esp + 0x10]
call fcn.004fb6d0
test eax, eax
je 0x4fade6
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
je 0x4fad53
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, ebx
call fcn.004db418
push dword [esp]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4fae09
xor ebx, ebx
jmp 0x4fae11
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [esp]
call fcn.004db418
mov eax, ebx
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret
mov ecx, ebx
call fcn.004db418
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4fadf8
xor eax, eax
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret