Function at 0x42d000
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push 0x2a4
mov eax, 0x5a6380
call fcn.0043caa9
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x58]
call fcn.004036d0
mov esi, 0x5ab08c
mov byte [ebp - 4], 1
push esi
call fcn.004561c7
pop ecx
push eax
push esi
lea ecx, [ebp - 0x58]
call fcn.004052c0
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x2a8]
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2ac], eax
call fcn.004265cf
test al, al
je 0x42d072
lodsd eax, dword [esi]
in al, dx
int 0xc9
mov ebx, 0x2f5af3e7
mov bh, 0xad
rcl dword [ecx + edi*2 - 0x1711e94e], cl
popal
xchg edx, eax
invalid
call fcn.004262d8
test al, al
je 0x42d09a
mov bh, 0x91
invalid
into
insd dword es:[edi], dx
test dword [esi], ecx
mov edx, 0xcaf9cc4a
invalid
call fcn.004260f5
test al, al
je 0x42d0b9
scasb al, byte es:[edi]
movsd dword es:[edi], dword [esi]
push cs
pushfd
jge 0x42d07e
std
jp 0x42d0ca
mov esp, 0xc6897faf
fadd st(3)
jnp 0x42d0b9
and byte [ecx], 0xa7
pushfd
mov eax, dword [ebp - 0x2ac]
cmp eax, 0xffffffff
je 0x42d1f5
push 0x2e
pop esi
mov edi, 0x5a9ce8
lea ecx, [ebp - 0x2a8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x42d1f5
cmp word [ebp - 0x27c], si
je 0x42d1ea
cmp word [ebp - 0x27a], 0
je 0x42d1ea
cmp word [ebp - 0x27a], si
jne 0x42d118
cmp word [ebp - 0x278], 0
je 0x42d1ea
xor eax, eax
mov dword [ebp - 0x2c], 7
xor ebx, ebx
mov word [ebp - 0x40], ax
mov dword [ebp - 0x30], ebx
cmp word [ebp - 0x27c], ax
je 0x42d140
lea eax, [ebp - 0x27c]
push eax
call fcn.004561c7
pop ecx
push eax
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x40]
call fcn.00402110
test byte [ebp - 0x2a8], 0x10
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
je 0x42d1a2
call fcn.004036d0
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x28]
call fcn.004051b0
push edi
call fcn.004561c7
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.004052c0
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.004036d0
call fcn.0042d000
jmp 0x42d1cd
call fcn.004036d0
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x28]
call fcn.004051b0
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.004036d0
call fcn.0042d297
add esp, 0x18
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.004254f0
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.004254f0
add dword [ebp + 0x45c6c04d], ecx
cld
add eax, ebp
push es
cmp edi, 0xffffffff
mov eax, dword [ebp - 0x2ac]
jmp 0x42d0d0
call fcn.004262d8
test al, al
je 0x42d219
cmp eax, 0x6226446b
sbb eax, dword [ebx - 0x49]
xchg ecx, eax
cli
cwde
fisub word [ecx + 0x44834a41]
sar edx, 0x86
xchg ebx, eax
cmc
push cs
jl 0x42d1dd
call fcn.0042617f
test al, al
je 0x42d240
mov dl, al
xor edi, dword [eax - 0x61]
pop ebx
sti
inc esi
mov ebp, 0xb93c0b64
add dword [edx - 0x5e], 0x44dcbaf3
sub byte [eax], bl
invalid
mov eax, dword [ebp - 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x42d279
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 4
cmovae eax, dword [ebp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.004254f0
push 0
push 1
lea ecx, [ebp + 8]
call fcn.004254f0
call fcn.0043ca64
ret