Function at 0x409ea0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x6264
call fcn.00415af0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 8
mov edi, ecx
call fcn.0040a5ce
add esp, 4
mov ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
call fcn.0040a5ce
add esp, 4
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [ebx], esi
mov dword [ebx + 4], 0
test ebx, ebx
je 0x409f23
mov esi, ebx
lea eax, [ebp - 0x2008]
mov ebx, dword [ebx + 4]
push dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [esi]
call fcn.0040a874
add esp, 4
push esi
call fcn.0040a874
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x2008]
push eax
call esi
mov dword [ebp - 0x6260], eax
lea eax, [ebp - 0x2008]
push 0x41e654
push eax
call edi
lea eax, [ebp - 0x6258]
push eax
lea eax, [ebp - 0x2008]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x625c], eax
cmp eax, 0xffffffff
je 0x40a17c
lea esp, [esp]
push 0x41e658
lea eax, [ebp - 0x622c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40a155
push 0x41e65c
lea eax, [ebp - 0x622c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40a155
mov eax, dword [ebp - 0x6260]
add eax, eax
cmp eax, 0x2000
jae 0x40a195
xor ecx, ecx
mov word [ebp + eax - 0x2008], cx
lea eax, [ebp - 0x622c]
push eax
lea eax, [ebp - 0x2008]
push eax
call edi
test byte [ebp - 0x6258], 0x10
je 0x40a056
push str.windows
lea eax, [ebp - 0x622c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40a056
push 0x41e674
lea eax, [ebp - 0x2008]
push eax
call edi
push 8
call fcn.0040a5ce
add esp, 4
mov edi, eax
lea eax, [ebp - 0x2008]
push eax
call esi
lea eax, [eax*2 + 2]
push eax
call fcn.0040a5ce
add esp, 4
mov esi, eax
lea eax, [ebp - 0x2008]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [edi], esi
mov dword [edi + 4], 0
test ebx, ebx
je 0x40a043
mov dword [edi + 4], ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x40a155
lea eax, [ebp - 0x622c]
push eax
call esi
mov ecx, dword [0x422198]
cmp eax, ecx
jle 0x40a086
push dword [0x423ac8]
sub eax, ecx
lea eax, [ebp + eax*2 - 0x622c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
sbb eax, eax
inc eax
jmp 0x40a088
xor eax, eax
test eax, eax
je 0x40a155
lea eax, [ebp - 0x2008]
push eax
lea eax, [ebp - 0x4008]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x4008]
push eax
call esi
sub eax, dword [0x422198]
add eax, eax
cmp eax, 0x2000
jae 0x40a195
xor ecx, ecx
lea edx, [ebp - 0x4008]
mov word [ebp + eax - 0x4008], cx
push ecx
lea ecx, [ebp - 0x2008]
call fcn.004090f0
add esp, 4
test eax, eax
je 0x40a155
push 0x41e678
call fcn.0040a8ec
add esp, 4
xor eax, eax
mov word [ebp - 0x6008], ax
push 0x1ffe
push eax
lea eax, [ebp - 0x6006]
push eax
call fcn.00410240
add esp, 0xc
lea eax, [ebp - 0x2008]
push eax
lea eax, [ebp - 0x6008]
push eax
call edi
lea eax, [ebp - 0x6008]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x41e674
lea eax, [ebp - 0x6008]
push eax
call edi
push dword [0x42219c]
lea eax, [ebp - 0x6008]
push eax
call edi
lea eax, [ebp - 0x6008]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x6258]
push eax
push dword [ebp - 0x625c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409f70
push dword [ebp - 0x625c]
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
jne 0x409efc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a5bf
mov esp, ebp
pop ebp
ret
call fcn.0040a798
int3