Function at 0x463b00
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x487c65
mov eax, dword fs:[0]
push eax
sub esp, 0x680
mov eax, dword [0x4bc00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x67c], ecx
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 0x680]
call fcn.00402680
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x680]
cmp dword [eax - 0xc], 0
jne 0x463b89
mov byte [ebp - 4], 2
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x680]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4640c1
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
jmp 0x4640c1
push ecx
mov dword [ebp - 0x684], esp
mov ebx, esp
mov dword [ebp - 0x688], ebx
lea esi, [eax - 0x10]
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi + 0xc]
cmp dword [eax], 0
jl 0x463bb7
cmp ecx, dword [esi]
jne 0x463bb7
mov edi, esi
lock inc dword [eax]
jmp 0x463be4
mov eax, dword [ecx]
push 2
push dword [esi + 4]
call dword [eax]
mov edi, eax
test edi, edi
je 0x4640df
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov edx, dword [esi + 4]
inc edx
push edx
lea eax, [esi + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.004031f0
add esp, 8
lea eax, [edi + 0x10]
mov dword [ebx], eax
mov byte [ebp - 4], 3
mov byte [ebp - 4], 4
mov byte [ebp - 4], 1
call fcn.00467760
add esp, 4
test al, al
jne 0x463c0a
mov byte [ebp - 4], 5
jmp 0x463b5e
mov esi, dword [ebp - 0x67c]
mov ecx, esi
lea edx, [ebp - 0x424]
sub edx, esi
nop word [eax + eax]
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x463c20
lea ecx, [ebp - 0x424]
add ecx, 0xfffffffe
nop dword [eax + eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x463c40
mov eax, dword [0x496ffc]
mov dword [ecx], eax
mov ax, word [0x497000]
mov word [ecx + 4], ax
mov ecx, esi
lea edx, [ebp - 0x21c]
sub edx, esi
nop word [eax + eax]
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x463c70
lea edi, [ebp - 0x21c]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x463c90
mov eax, dword [0x49a8d0]
mov dword [edi], eax
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [ebp - 0x684], edi
cmp edi, 0xffffffff
jne 0x463ccd
mov byte [ebp - 4], 6
jmp 0x463b5e
xor ecx, ecx
nop
movzx eax, word [ebp + ecx - 0x21c]
mov word [ebp + ecx - 0x424], ax
add ecx, 2
test ax, ax
jne 0x463cd0
mov al, 1
mov byte [ebp - 0x675], al
mov ebx, dword [sym.imp.VCRUNTIME140.dll_wcsstr]
test al, al
je 0x464036
lea eax, [ebp - 0x674]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x463fcf
lea ecx, [ebp - 0x648]
call fcn.004640f0
test eax, eax
je 0x463d2b
mov al, byte [ebp - 0x675]
jmp 0x463cf6
mov ecx, esi
lea edx, [ebp - 0x21c]
sub edx, esi
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x463d35
lea edi, [ebp - 0x21c]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x463d50
mov eax, dword [0x49a8d0]
mov dword [edi], eax
lea edx, [ebp - 0x648]
mov esi, edx
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x463d70
sub edx, esi
lea edi, [ebp - 0x21c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x463d86
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test byte [ebp - 0x674], 0x10
je 0x463e8f
mov ecx, 0x48b87c
mov eax, ecx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x463dda
test dx, dx
je 0x463dd6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x463dda
add eax, 4
add ecx, 4
test dx, dx
jne 0x463db4
xor eax, eax
jmp 0x463ddf
sbb eax, eax
or eax, 1
test eax, eax
je 0x463dfc
push 0x48b87c
lea eax, [ebp - 0x21c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x463fb8
mov edx, 0x48b87c
lea ecx, [ebp - 0x21c]
call fcn.00463b00
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push ecx
mov ecx, esp
mov dword [ebp - 0x688], esp
lea eax, [ebp - 0x21c]
push eax
call fcn.00402680
mov byte [ebp - 4], 7
push ecx
mov ecx, esp
mov dword [ebp - 0x68c], esp
push str.In_deletion
call fcn.0045fcf0
mov byte [ebp - 4], 8
mov byte [ebp - 4], 1
or ecx, 0xffffffff
call fcn.00462c10
add esp, 8
xor ecx, ecx
nop word [eax + eax]
movzx eax, word [ebp + ecx - 0x424]
mov word [ebp + ecx - 0x21c], ax
add ecx, 2
test ax, ax
jne 0x463e60
mov esi, dword [ebp - 0x67c]
mov al, byte [ebp - 0x675]
mov edi, dword [ebp - 0x684]
jmp 0x463cf6
push 0x497074
lea eax, [ebp - 0x21c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x463f8f
push str..exd
lea eax, [ebp - 0x21c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x463f8f
push str..xls
lea eax, [ebp - 0x21c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x463f8f
push str..xlsx
lea eax, [ebp - 0x21c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x463f8f
push str..xlsm
lea eax, [ebp - 0x21c]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x463f8f
push ecx
mov ecx, esp
mov dword [ebp - 0x68c], esp
lea eax, [ebp - 0x21c]
push eax
call fcn.00402680
mov byte [ebp - 4], 9
push ecx
mov ecx, esp
mov dword [ebp - 0x688], esp
push str.In_deletion
call fcn.0045fcf0
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 1
or ecx, 0xffffffff
call fcn.00462c10
add esp, 8
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
nop word [eax + eax]
movzx eax, word [ebp + ecx - 0x424]
mov word [ebp + ecx - 0x21c], ax
add ecx, 2
test ax, ax
jne 0x463f60
mov esi, dword [ebp - 0x67c]
mov al, byte [ebp - 0x675]
mov edi, dword [ebp - 0x684]
jmp 0x463cf6
xor ecx, ecx
nop dword [eax]
nop word [eax + eax]
movzx eax, word [ebp + ecx - 0x424]
mov word [ebp + ecx - 0x21c], ax
add ecx, 2
test ax, ax
jne 0x463fa0
mov esi, dword [ebp - 0x67c]
mov al, byte [ebp - 0x675]
mov edi, dword [ebp - 0x684]
jmp 0x463cf6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x463fe7
xor al, al
mov byte [ebp - 0x675], al
jmp 0x463cf6
push ecx
mov ecx, esp
mov dword [ebp - 0x68c], esp
push 0x48e2cc
call fcn.0045fcf0
mov byte [ebp - 4], 0xb
push ecx
mov ecx, esp
mov dword [ebp - 0x688], esp
push str.deleteDirectory_Error:_deleteDirectory_some_error_occured
call fcn.0045fcf0
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 1
or ecx, 0xffffffff
call fcn.00462c10
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [ebp - 0x675]
jmp 0x463cf6
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x680]
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x46406c
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov eax, esi
jmp 0x4640c3
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00471083
mov esp, ebp
pop ebp
ret
call fcn.004031e0
int3