Function at 0x4096d0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x477ee8
push 0x43fda0
mov eax, dword fs:[0]
push eax
sub esp, 0x67c
mov eax, dword [0x47d144]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
push 0x208
push 0
lea eax, [ebp - 0x434]
push eax
call fcn.00440840
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x22c]
push eax
call fcn.00440840
add esp, 0xc
push 0x250
push 0
lea eax, [ebp - 0x684]
push eax
call fcn.00440840
add esp, 0xc
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409752
sub ecx, edx
sar ecx, 1
lea eax, [ebp - 0x22c]
cmp ecx, 0x104
jae 0x409780
push esi
push 0x104
push eax
call fcn.004476de
add esp, 0xc
jmp 0x40979a
push 0x103
push esi
push 0x104
push eax
call fcn.004474cf
add esp, 0x10
xor eax, eax
mov word [ebp - 0x26], ax
lea esi, [ebp - 0x22c]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4097a3
sub esi, ecx
sar esi, 1
mov edi, esi
jne 0x4097be
lea edi, [ebp - 0x22c]
jmp 0x4097f6
dec esi
mov eax, 0x5c
cmp ax, word [ebp + esi*2 - 0x22c]
je 0x4097ed
push 0x471e4c
push 0x104
lea eax, [ebp - 0x22c]
push eax
call fcn.00447669
add esp, 0xc
test eax, eax
jne 0x4097ed
mov esi, edi
lea edi, [ebp - 0x22c]
lea edi, [edi + esi*2]
mov dword [ebp - 0x688], edi
lea ecx, [ebp - 0x22c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409805
sub ecx, edx
sar ecx, 1
lea eax, [ebp - 0x22c]
cmp ecx, 0x104
jae 0x409839
push eax
push 0x104
lea eax, [ebp - 0x434]
push eax
call fcn.004476de
add esp, 0xc
jmp 0x40985c
push 0x103
push eax
push 0x104
lea eax, [ebp - 0x434]
push eax
call fcn.004474cf
add esp, 0x10
xor eax, eax
mov word [ebp - 0x22e], ax
push 0x4729d8
mov edx, 0x104
lea ecx, [ebp - 0x434]
call fcn.0040a0a0
add esp, 4
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x68c], esi
cmp esi, 0xffffffff
je 0x409a0c
test dword [ebp - 0x684], 0x10
jne 0x409924
lea eax, [ebp - 0x658]
push eax
mov edx, 0x104
lea ecx, [ebp - 0x22c]
call fcn.0040a0a0
add esp, 4
test bl, bl
je 0x4098dc
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
je 0x4099e1
mov dword [ebp - 4], 0
push 4
push 0
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 4], 0xfffffffe
jmp 0x4099e1
cmp byte [ebp + 8], 0
je 0x4099e7
mov ecx, 0x4729e0
lea eax, [ebp - 0x658]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x409966
test dx, dx
je 0x409962
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x409966
add eax, 4
add ecx, 4
test dx, dx
jne 0x409940
xor eax, eax
jmp 0x40996b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4099e7
mov ecx, 0x4729e4
lea eax, [ebp - 0x658]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4099a6
test dx, dx
je 0x4099a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4099a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x409980
xor eax, eax
jmp 0x4099ab
sbb eax, eax
or eax, 1
test eax, eax
je 0x4099e7
lea eax, [ebp - 0x658]
push eax
mov edx, 0x104
lea ecx, [ebp - 0x22c]
call fcn.0040a0a0
add esp, 4
push 0x4729d8
push ebx
push 1
mov dl, 1
lea ecx, [ebp - 0x22c]
call fcn.004096d0
add esp, 0xc
xor eax, eax
mov word [edi + 2], ax
lea eax, [ebp - 0x684]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409893
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
or esi, 0xffffffff
jmp 0x40988d
xor eax, eax
mov word [edi], ax
test bl, bl
je 0x409a27
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp eax, 1
je 0x409a51
mov dword [ebp - 4], 1
push 4
push 0
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x409a4a
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004281b1
mov esp, ebp
pop ebp
ret