Function at 0x416580
Capabilities:
Delete file
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x616952
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x6963f4]
xor eax, esp
mov dword [esp + 0x290], eax
push ebx
push esi
push edi
mov eax, dword [0x6963f4]
xor eax, esp
push eax
lea eax, [esp + 0x2a8]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x20], ebx
call fcn.004ac9c0
mov dword [esp + 0x1c], eax
call fcn.004ad350
mov edi, ebx
call fcn.0041aff0
call fcn.004ddee0
cmp dword [ebx + 0x294], 0
mov edi, eax
mov dword [esp + 0x24], edi
je 0x416889
mov esi, ebx
call fcn.004169f0
cmp edi, 1
jg 0x416889
lea eax, [esp + 0x194]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
lea ecx, [esp + 0x194]
push ecx
lea ecx, [esp + 0x14]
call fcn.00404e10
push 1
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x2b8], 0
call fcn.004134d0
mov eax, dword [eax]
push 0x63dab8
push eax
call fcn.0059e0af
add esp, 8
test eax, eax
mov eax, dword [esp + 0x18]
setne bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416677
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x416689
push 0x63dab8
lea ecx, [esp + 0x14]
call fcn.00407100
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
push eax
call fcn.00401db0
add eax, 0x10
add esp, 4
mov dword [esp + 0x18], eax
push 0x10
push str.HS6ClipImage_.
lea ecx, [esp + 0x18]
mov byte [esp + 0x2b8], 1
call fcn.004071b0
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x54]
push ecx
push edx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x416832
mov bl, 2
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x18]
call fcn.00404e10
mov byte [esp + 0x2b0], bl
mov ecx, dword [esp + 0x14]
push 0x5f
push ecx
call fcn.005a1267
add esp, 8
test eax, eax
jne 0x416705
or eax, 0xffffffff
jmp 0x416709
sub eax, dword [esp + 0x14]
add eax, 1
push eax
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x1c]
call fcn.0040ff60
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2b4], 3
call fcn.00407290
mov byte [esp + 0x2b0], bl
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416754
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
call fcn.0059ee4a
add esp, 4
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x18]
push 0x63eb1c
push edx
mov edi, eax
call fcn.0059fa45
mov eax, edi
sub eax, dword [esp + 0x50]
add esp, 0xc
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x5460
jle 0x4167eb
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.00401be0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2b4], 4
call fcn.00407290
mov byte [esp + 0x2b0], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4167e0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov byte [esp + 0x2b0], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416813
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x54]
push ecx
push esi
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x4166d5
push esi
call dword [sym.imp.kernel32.dll_FindClose]
mov edi, dword [esp + 0x24]
mov byte [esp + 0x2b0], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41685a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x2b0], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416885
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x20]
cmp dword [ebx + 0x54c], 0
jne 0x41689d
cmp dword [esp + 0x1c], 0
je 0x41691f
lea ecx, [esp + 0x30]
call fcn.00576879
cmp edi, 1
mov dword [esp + 0x2b0], 5
jle 0x41690b
lea edi, [esp + 0x30]
call fcn.004ddf30
test eax, eax
je 0x41690b
mov ecx, dword [ebx + 0x54c]
mov edi, dword [esp + 0x38]
add edi, 0xffffffff
mov dword [esp + 0x1c], ecx
mov dword [ebx + 0x54c], 0
js 0x41690b
test edi, edi
jl 0x4169e9
cmp edi, dword [esp + 0x38]
jge 0x4169e9
mov edx, dword [esp + 0x34]
lea esi, [edx + edi*4]
call sub.kernel32.dll_GetCurrentProcessId
cmp dword [esi], eax
jne 0x4169b7
sub edi, 1
jns 0x4168e0
lea ecx, [esp + 0x30]
mov dword [esp + 0x2b0], 0xffffffff
call fcn.00576890
mov edx, dword [ebx + 0x298]
mov edi, dword [sym.imp.gdi32.dll_DeleteObject]
push edx
call edi
mov eax, dword [ebx + 0x2d8]
push eax
call edi
mov ecx, dword [ebx + 0x2dc]
push ecx
call edi
mov edx, dword [ebx + 0x2e0]
push edx
call edi
mov eax, dword [ebx + 0x2e4]
push eax
call edi
mov eax, dword [ebx + 0x18c]
test eax, eax
je 0x416965
push eax
call fcn.005a01b3
add esp, 4
mov eax, dword [ebx + 0x184]
test eax, eax
je 0x416978
push eax
call fcn.005a01b3
add esp, 4
call fcn.0045b1b0
call fcn.005638c5
call fcn.00511a20
call fcn.005075d5
mov ecx, ebx
call fcn.00572cec
mov ecx, dword [esp + 0x2a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x290]
xor ecx, esp
call fcn.0059e0c2
mov esp, ebp
pop ebp
ret
cmp edi, dword [esp + 0x38]
jge 0x4169e9
mov eax, dword [esp + 0x34]
mov eax, dword [eax + edi*4]
call fcn.004ddff0
xor ecx, ecx
cmp dword [esp + 0x1c], ecx
sete cl
push ecx
push 0x8042
push 0x111
push eax
call dword [sym.imp.user32.dll_SendMessageA]
jmp 0x41690b
jmp fcn.00564f58