Function at 0x412ec8
Capabilities:
Delete file
Enumerate files on windows
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x474248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c0
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], 0xa
push edi
xor ebx, ebx
mov dword [esp + 0x30], esi
push esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], ebx
call fcn.0040dacf
mov dword [esp + 0x4d4], ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x412f21
mov eax, ebx
jmp 0x412f34
lea ecx, [esp + 0x14]
call fcn.0040db52
mov ebx, dword [esp + 0x14]
neg eax
sbb eax, eax
and eax, ebx
mov edx, 0x482bb8
mov ecx, eax
call fcn.0040da1e
mov edi, eax
mov dword [esp + 0x3c], edi
test ebx, ebx
je 0x412f4e
mov eax, ebx
jmp 0x412f61
lea ecx, [esp + 0x14]
call fcn.0040db52
mov ebx, dword [esp + 0x14]
neg eax
sbb eax, eax
and eax, ebx
mov edx, str.cache
mov ecx, eax
call fcn.0040da1e
push 0x103
mov dword [esp + 0x44], eax
lea eax, [esp + 0x3c5]
push 0
push eax
mov byte [esp + 0x3cc], 0
call fcn.00443c10
mov ecx, dword [esp + 0x3c]
add esp, 0xc
add esi, 0x208
lea eax, [ecx + 0x30c]
push eax
push esi
push ecx
lea eax, [esp + 0x3cc]
push str._Smupdb_s__S
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
and dword [esp + 0x84], 0
lea eax, [esp + 0x88]
add esp, 0x14
push 0x13c
push 0
push eax
call fcn.00443c10
add esp, 0xc
mov byte [esp + 0x1b0], 0
lea eax, [esp + 0x1b1]
push 0x103
push 0
push eax
call fcn.00443c10
add esp, 0xc
lea eax, [esp + 0x1b0]
push esi
push 0x480b40
push edi
push str._s_s_s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x1b4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x413154
mov ebx, eax
lea edx, [esp + 0x9c]
mov ecx, edi
call fcn.0040da1e
xor ecx, ecx
mov dword [esp + 0x38], eax
push ecx
push ecx
push 3
push ecx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, 0xffffffff
je 0x413127
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x28], eax
test eax, eax
je 0x413127
lea esi, [eax + 1]
push esi
call fcn.0041ed67
pop ecx
push esi
mov edi, eax
push 0
push edi
call fcn.00443c10
mov esi, dword [esp + 0x34]
lea eax, [esp + 0x40]
and dword [esp + 0x40], 0
add esp, 0xc
push 0
push eax
push esi
push edi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ecx
push ecx
push 5
push esi
push edi
lea ecx, [esp + 0x58]
call fcn.0040abd6
xor edi, edi
mov byte [esp + 0x4d4], 1
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0x44]
push edi
push edi
push 1
mov dword [esp + 0x2c], edi
call dword [eax + 0x18]
test eax, eax
je 0x41310e
mov ebx, dword [esp + 0x24]
inc edi
lea ecx, [esp + 0x44]
push 0
push 0
inc ebx
lea eax, [edi + 1]
push eax
mov eax, dword [esp + 0x50]
call dword [eax + 0x18]
test eax, eax
jne 0x4130e9
mov dword [esp + 0x24], ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x20], edi
lea ecx, [esp + 0x44]
mov byte [esp + 0x4d4], 0
call fcn.0040ac63
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x3c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x38]
call fcn.0041ed70
pop ecx
lea eax, [esp + 0x70]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x413036
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x1b4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x413370
mov ebx, dword [esp + 0x30]
lea edx, [esp + 0x9c]
mov ecx, edi
call fcn.0040da1e
xor ecx, ecx
mov dword [esp + 0x34], eax
push ecx
push ecx
push 3
push ecx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, 0xffffffff
je 0x413331
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x28], eax
test eax, eax
je 0x413331
lea esi, [eax + 1]
push esi
call fcn.0041ed67
pop ecx
push esi
mov edi, eax
push 0
push edi
call fcn.00443c10
mov esi, dword [esp + 0x34]
lea eax, [esp + 0x44]
and dword [esp + 0x44], 0
add esp, 0xc
push 0
push eax
push esi
push edi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ecx
push ecx
push 5
push esi
push edi
lea ecx, [esp + 0x58]
call fcn.0040abd6
xor edi, edi
mov byte [esp + 0x4d4], 2
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0x44]
push edi
push edi
push 1
mov dword [esp + 0x2c], edi
call dword [eax + 0x18]
mov esi, eax
test esi, esi
je 0x413314
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0x44]
push 1
push str.shared
push esi
call dword [eax + 0x14]
test eax, eax
jne 0x4132f2
push 0x103
push eax
mov byte [esp + 0x2c0], al
lea eax, [esp + 0x2c1]
push eax
call fcn.00443c10
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x50]
add esp, 0xc
push 0
push str.location
push esi
call dword [eax + 0x18]
mov esi, eax
push str.systemcomponents
push esi
call fcn.0043f060
pop ecx
pop ecx
test eax, eax
je 0x41329f
push 0x5c
push esi
call fcn.0043d730
pop ecx
pop ecx
lea esi, [eax + 1]
push esi
push 0x480b40
push ebx
lea eax, [esp + 0x2c4]
push str._S_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [esp + 0x2b8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x2b8]
call fcn.00420df8
push dword [esp + 0x24]
mov eax, dword [esp + 0x30]
add eax, edi
push eax
push 0x404
push dword [ebx + 0x324]
call dword [sym.imp.USER32.dll_PostMessageA]
inc edi
lea ecx, [esp + 0x44]
push 0
push 0
lea eax, [edi + 1]
push eax
mov eax, dword [esp + 0x50]
call dword [eax + 0x18]
mov esi, eax
test esi, esi
jne 0x413234
mov dword [esp + 0x20], edi
add dword [esp + 0x2c], edi
lea ecx, [esp + 0x44]
mov byte [esp + 0x4d4], 0
call fcn.0040ac63
mov edi, dword [esp + 0x3c]
mov esi, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x34]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, esi
call fcn.00420df8
push esi
call fcn.0041ed70
pop ecx
lea eax, [esp + 0x70]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41317f
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x3c0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor dl, dl
mov ecx, edi
call fcn.00420e1b
mov esi, dword [esp + 0x40]
xor dl, dl
mov ecx, esi
call fcn.00420e1b
push edi
call fcn.0041ed70
pop ecx
push esi
call fcn.0041ed70
pop ecx
call fcn.00412495
mov esi, eax
test esi, esi
je 0x4133cb
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4133b9
sub ecx, edx
je 0x4133cb
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call fcn.0041ed70
pop ecx
test ebx, ebx
jne 0x4133e9
lea ecx, [esp + 0x14]
call fcn.0040db52
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, dword [esp + 0x14]
mov edx, str.systemcomponents
mov ecx, ebx
call fcn.0040da1e
lea ecx, [esp + 0x14]
mov edi, eax
call fcn.0040dba7
mov dl, 1
mov ecx, edi
mov esi, eax
call fcn.00420e1b
mov dl, 1
mov ecx, esi
call fcn.00420e1b
push esi
call fcn.0041ed70
pop ecx
push edi
call fcn.0041ed70
pop ecx
push dword [esp + 0x24]
mov ecx, dword [esp + 0x34]
push dword [esp + 0x24]
push 0x405
push dword [ecx + 0x324]
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [esp + 0x14]
call fcn.0040db31
mov ecx, dword [esp + 0x4cc]
xor eax, eax
pop edi
pop esi
inc eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret