Function at 0x40ed40
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Get session user name
Set current directory

Disassembly:
sub esp, 0x450
push ebx
mov ebx, ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
lea esi, [ebx + 0x52eedc]
push edi
push esi
call ebp
test eax, eax
je 0x40f072
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x21c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x220]
push eax
call esi
lea ecx, [esp + 0x21c]
push ecx
call ebp
dec eax
js 0x40edc6
mov ecx, 1
mov edi, 0x41aec8
lea esi, [esp + eax + 0x21c]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40edad
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
je 0x40edb6
dec eax
jns 0x40ed91
jmp 0x40edc0
lea edx, [esp + eax + 0x21c]
mov byte [edx], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea edi, [ebx + 0x18a48]
push edi
call ebp
test eax, eax
je 0x40f072
lea eax, [esp + 0x14]
push edi
push eax
call esi
mov eax, dword [ebx + 0x5c9018]
test eax, eax
jne 0x40ee1e
push 1
mov ecx, ebx
call fcn.0040e960
test eax, eax
jne 0x40ee10
push 2
mov ecx, ebx
call fcn.0040e960
test eax, eax
je 0x40ee1e
lea ecx, [ebx + 0x18b4c]
lea edx, [esp + 0x14]
push ecx
push edx
call esi
lea eax, [esp + 0x14]
push str..
push eax
call esi
cmp dword [ebx + 8], 1
jne 0x40ee9f
lea ecx, [esp + 0x118]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x11b]
push str.Documents_and_Settings_
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x118]
push eax
call ebp
mov ecx, 0x104
lea edx, [esp + 0x10]
sub ecx, eax
lea eax, [esp + eax + 0x118]
push edx
push eax
mov dword [esp + 0x18], ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea ecx, [esp + 0x118]
push str.Local_SettingsTemp_
push ecx
call esi
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
xor ebp, ebp
jmp 0x40eeca
lea edx, [esp + 0x118]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
xor ebp, ebp
jmp 0x40eeca
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test ebp, ebp
jne 0x40ef96
lea ecx, [esp + 0x320]
lea edx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40f072
push 4
mov ecx, ebx
call fcn.0040e960
test eax, eax
jne 0x40ef2a
xor esi, esi
lea edi, [ebx + 0x52efe0]
lea eax, [esp + 0x34c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40eec4
inc esi
add edi, 0x104
cmp esi, 0xa
jl 0x40ef05
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [ebx + 0x18a48]
lea ecx, [esp + 0x14]
push eax
push ecx
call esi
mov eax, dword [ebx + 0x5c9018]
test eax, eax
jne 0x40ef77
push 1
mov ecx, ebx
call fcn.0040e960
test eax, eax
jne 0x40ef69
push 2
mov ecx, ebx
call fcn.0040e960
test eax, eax
je 0x40ef77
lea edx, [ebx + 0x18b4c]
lea eax, [esp + 0x14]
push edx
push eax
call esi
lea ecx, [esp + 0x34c]
lea edx, [esp + 0x14]
push ecx
push edx
call esi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40eeca
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x320]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40f057
push 4
mov ecx, ebx
call fcn.0040e960
test eax, eax
jne 0x40eff8
xor esi, esi
lea edi, [ebx + 0x52efe0]
lea edx, [esp + 0x34c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40eec4
inc esi
add edi, 0x104
cmp esi, 0xa
jl 0x40efcf
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebx + 0x18a48]
push eax
lea eax, [esp + 0x18]
push eax
call esi
mov eax, dword [ebx + 0x5c9018]
test eax, eax
jne 0x40f038
push 1
mov ecx, ebx
call fcn.0040e960
test eax, eax
jne 0x40f02a
push 2
mov ecx, ebx
call fcn.0040e960
test eax, eax
je 0x40f038
lea ecx, [ebx + 0x18b4c]
lea edx, [esp + 0x14]
push ecx
push edx
call esi
lea eax, [esp + 0x34c]
lea ecx, [esp + 0x14]
push eax
push ecx
call esi
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40eeca
test ebp, ebp
je 0x40f062
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x450
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x450
ret