Function at 0x401cb0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x494
mov eax, dword [0x42668c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
mov ebx, ecx
push eax
mov dword [ebp - 0x490], ebx
call fcn.0040b380
push dword [ebx + 0x24]
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00408311
push str.ext_
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0040825a
push str..log
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0040825a
xor eax, eax
add esp, 0x30
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x488], eax
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x210]
xor edi, edi
push eax
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x484], edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, eax
mov dword [ebp - 0x480], ecx
cmp ecx, 0xffffffff
je 0x401f33
jmp 0x401d70
test byte [ebp - 0x478], 0x10
jne 0x401e49
mov eax, dword [ebp - 0x470]
inc dword [ebp - 0x47c]
cmp eax, esi
jb 0x401d95
test esi, esi
jne 0x401e49
cmp word [ebp - 0x44c], 0
mov esi, eax
mov dword [ebp - 0x48c], esi
je 0x401e32
lea esi, [ebp - 0x44c]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x401db4
sub esi, ecx
sar esi, 1
cmp edi, esi
jg 0x401e00
mov edi, 2
cmp esi, edi
jle 0x401dd6
add edi, edi
cmp edi, esi
jl 0x401dd0
lea eax, [edi*2 + 2]
push eax
push ebx
call fcn.00408b52
add esp, 8
test eax, eax
je 0x401dff
mov ecx, dword [ebp - 0x488]
xor edx, edx
mov ebx, eax
mov word [eax + ecx*2], dx
mov dword [ebp - 0x484], edi
inc edi
push esi
lea eax, [ebp - 0x44c]
push eax
push edi
push ebx
call fcn.00408691
mov edi, dword [ebp - 0x484]
mov ecx, dword [ebp - 0x480]
add esp, 0x10
xor eax, eax
mov word [ebx + esi*2], ax
mov dword [ebp - 0x488], esi
mov esi, dword [ebp - 0x48c]
jmp 0x401e49
test ebx, ebx
je 0x401e49
xor eax, eax
xor edi, edi
mov word [ebx], ax
mov dword [ebp - 0x484], edi
mov dword [ebp - 0x488], eax
lea eax, [ebp - 0x478]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, dword [ebp - 0x480]
test eax, eax
jne 0x401d70
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x47c], 9
jle 0x401f26
mov eax, dword [ebp - 0x490]
push 0xffffffffffffffff
push dword [eax + 0x24]
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x218], 0
call fcn.00402130
test ebx, ebx
je 0x401ee8
cmp word [ebx], 0
je 0x401ee8
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401eb2
mov eax, dword [ebp - 0x220]
sub ecx, edx
sar ecx, 1
add eax, ecx
push eax
lea ecx, [ebp - 0x224]
call fcn.00402570
mov esi, dword [ebp - 0x224]
push ebx
push eax
push esi
call fcn.0040825a
add esp, 0xc
jmp 0x401eee
mov esi, dword [ebp - 0x224]
test esi, esi
je 0x401efa
cmp word [esi], 0
mov eax, esi
jne 0x401eff
mov eax, 0x423ff0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
je 0x401f13
push esi
call fcn.00408538
add esp, 4
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x401f26
push eax
call fcn.00408538
add esp, 4
test ebx, ebx
je 0x401f33
push ebx
call fcn.00408538
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406a3a
mov esp, ebp
pop ebp
ret