Function at 0x402e30
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x450260
push 0x4260f0
mov eax, dword fs:[0]
push eax
sub esp, 0x67c
mov eax, dword [0x45410c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
push 0x208
push 0
lea eax, [ebp - 0x434]
push eax
call fcn.00427180
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x22c]
push eax
call fcn.00427180
add esp, 0xc
push 0x250
push 0
lea eax, [ebp - 0x684]
push eax
call fcn.00427180
add esp, 0xc
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402eb2
sub ecx, edx
sar ecx, 1
lea eax, [ebp - 0x22c]
cmp ecx, 0x104
jae 0x402ee0
push esi
push 0x104
push eax
call fcn.0042c048
add esp, 0xc
jmp 0x402efa
push 0x103
push esi
push 0x104
push eax
call fcn.0042bb21
add esp, 0x10
xor eax, eax
mov word [ebp - 0x26], ax
lea esi, [ebp - 0x22c]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x402f03
sub esi, ecx
sar esi, 1
mov edi, esi
jne 0x402f1e
lea edi, [ebp - 0x22c]
jmp 0x402f56
dec esi
mov eax, 0x5c
cmp ax, word [ebp + esi*2 - 0x22c]
je 0x402f4d
push 0x44c590
push 0x104
lea eax, [ebp - 0x22c]
push eax
call fcn.0042bfd3
add esp, 0xc
test eax, eax
jne 0x402f4d
mov esi, edi
lea edi, [ebp - 0x22c]
lea edi, [edi + esi*2]
mov dword [ebp - 0x688], edi
lea ecx, [ebp - 0x22c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402f65
sub ecx, edx
sar ecx, 1
lea eax, [ebp - 0x22c]
cmp ecx, 0x104
jae 0x402f99
push eax
push 0x104
lea eax, [ebp - 0x434]
push eax
call fcn.0042c048
add esp, 0xc
jmp 0x402fbc
push 0x103
push eax
push 0x104
lea eax, [ebp - 0x434]
push eax
call fcn.0042bb21
add esp, 0x10
xor eax, eax
mov word [ebp - 0x22e], ax
push 0x44c5bc
mov edx, 0x104
lea ecx, [ebp - 0x434]
call fcn.004037e0
add esp, 4
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x68c], esi
cmp esi, 0xffffffff
je 0x40316c
test dword [ebp - 0x684], 0x10
jne 0x403084
lea eax, [ebp - 0x658]
push eax
mov edx, 0x104
lea ecx, [ebp - 0x22c]
call fcn.004037e0
add esp, 4
test bl, bl
je 0x40303c
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
je 0x403141
mov dword [ebp - 4], 0
push 4
push 0
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 4], 0xfffffffe
jmp 0x403141
cmp byte [ebp + 8], 0
je 0x403147
mov ecx, 0x44c5c4
lea eax, [ebp - 0x658]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4030c6
test dx, dx
je 0x4030c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4030c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4030a0
xor eax, eax
jmp 0x4030cb
sbb eax, eax
or eax, 1
test eax, eax
je 0x403147
mov ecx, 0x44c5c8
lea eax, [ebp - 0x658]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x403106
test dx, dx
je 0x403102
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x403106
add eax, 4
add ecx, 4
test dx, dx
jne 0x4030e0
xor eax, eax
jmp 0x40310b
sbb eax, eax
or eax, 1
test eax, eax
je 0x403147
lea eax, [ebp - 0x658]
push eax
mov edx, 0x104
lea ecx, [ebp - 0x22c]
call fcn.004037e0
add esp, 4
push 0x44c5bc
push ebx
push 1
mov dl, 1
lea ecx, [ebp - 0x22c]
call fcn.00402e30
add esp, 0xc
xor eax, eax
mov word [edi + 2], ax
lea eax, [ebp - 0x684]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402ff3
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
or esi, 0xffffffff
jmp 0x402fed
xor eax, eax
mov word [edi], ax
test bl, bl
je 0x403187
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp eax, 1
je 0x4031b1
mov dword [ebp - 4], 1
push 4
push 0
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x4031aa
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0040e5ad
mov esp, ebp
pop ebp
ret