Function at 0x461be0
Capabilities:
Check os version
Delete file
Enumerate files on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5d9349
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x6dd9a4]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6dd9a4]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
mov ebp, 0xf
xor edi, edi
mov dword [esp + 0xdc], ebp
mov dword [esp + 0xd8], edi
mov byte [esp + 0xc8], 0
mov dword [esp + 0x248], edi
mov dword [esp + 0x88], ebp
mov dword [esp + 0x84], edi
mov byte [esp + 0x74], 0
mov byte [esp + 0x248], 1
push 5
push str..mdmp
lea ecx, [esp + 0x94]
mov dword [esp + 0xac], ebp
mov dword [esp + 0xa8], edi
mov byte [esp + 0x98], 0
call fcn.0041072d
push 0xffffffffffffffff
mov byte [esp + 0x24c], 2
push edi
push 0x6e07c0
lea ecx, [esp + 0xb4]
mov dword [esp + 0xcc], ebp
mov dword [esp + 0xc8], edi
mov byte [esp + 0xb8], 0
call fcn.0040f4da
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
push 1
push 0xffffffffffffffff
lea eax, [esp + 0x2c]
mov byte [esp + 0x250], 4
push eax
lea ecx, [esp + 0xb4]
mov byte [esp + 0x30], 0x5c
call fcn.00463020
cmp eax, 0xffffffff
jne 0x461d8b
mov esi, 0x10
cmp dword [esp + 0xc0], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
jb 0x461d16
mov ecx, dword [esp + 0xac]
push ecx
call fcn.005112a2
add esp, 4
cmp dword [esp + 0xa4], esi
mov dword [esp + 0xc0], ebp
mov dword [esp + 0xbc], edi
mov byte [esp + 0xac], 0
jb 0x461d45
mov edx, dword [esp + 0x90]
push edx
call fcn.005112a2
add esp, 4
cmp dword [esp + 0x88], esi
mov dword [esp + 0xa4], ebp
mov dword [esp + 0xa0], edi
mov byte [esp + 0x90], 0
jb 0x461d71
mov eax, dword [esp + 0x74]
push eax
call fcn.005112a2
add esp, 4
cmp dword [esp + 0xdc], esi
mov dword [esp + 0x88], ebp
mov dword [esp + 0x84], edi
jmp 0x4626aa
push eax
push edi
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 0xb4]
call fcn.00462cd0
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0xb4]
mov byte [esp + 0x254], 5
call fcn.0040f4da
mov ebx, 0x10
mov byte [esp + 0x248], 4
cmp dword [esp + 0x54], ebx
jb 0x461dd6
mov eax, dword [esp + 0x40]
push eax
call fcn.005112a2
add esp, 4
push 1
push 0x68d3bc
lea ecx, [esp + 0xb0]
call fcn.0040f77d
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0xb0]
push ecx
lea ecx, [esp + 0x7c]
call fcn.0040f4da
push 1
push 0x67d864
lea ecx, [esp + 0x78]
call fcn.0040f77d
cmp dword [esp + 0x88], ebx
mov eax, dword [esp + 0x74]
jae 0x461e1e
lea eax, [esp + 0x74]
lea edx, [esp + 0xfc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x30], esi
jne 0x461ee6
lea esi, [esp + 0x14]
call fcn.00462d10
cmp dword [esp + 0xc0], ebx
jb 0x461e5e
mov eax, dword [esp + 0xac]
push eax
call fcn.005112a2
add esp, 4
cmp dword [esp + 0xa4], ebx
mov dword [esp + 0xc0], ebp
mov dword [esp + 0xbc], edi
mov byte [esp + 0xac], 0
jb 0x461e8d
mov ecx, dword [esp + 0x90]
push ecx
call fcn.005112a2
add esp, 4
cmp dword [esp + 0x88], ebx
mov dword [esp + 0xa4], ebp
mov dword [esp + 0xa0], edi
mov byte [esp + 0x90], 0
jb 0x461eb9
mov edx, dword [esp + 0x74]
push edx
call fcn.005112a2
add esp, 4
cmp dword [esp + 0xdc], ebx
mov dword [esp + 0x88], ebp
mov dword [esp + 0x84], edi
mov byte [esp + 0x74], 0
jb 0x4626c1
mov eax, dword [esp + 0xc8]
push eax
jmp 0x4626b9
lea ecx, [esp + 0xfc]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x46223c
lea ecx, [ecx]
lea eax, [esp + 0x128]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x461f10
sub eax, edx
push eax
lea edx, [esp + 0x12c]
push edx
lea ecx, [esp + 0xcc]
call fcn.0041072d
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xa0]
cmp eax, ecx
jbe 0x462215
sub eax, ecx
push 0xffffffffffffffff
sub eax, 1
push eax
lea eax, [esp + 0xe8]
push eax
lea ecx, [esp + 0xd0]
call fcn.00462cd0
mov byte [esp + 0x248], 6
mov ecx, dword [esp + 0xd8]
sub ecx, dword [esp + 0xa0]
push 0xffffffffffffffff
push ecx
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 0xd0]
call fcn.00462cd0
mov byte [esp + 0x248], 7
mov ecx, dword [esp + 0x90]
mov esi, 0x10
cmp dword [esp + 0xa4], esi
jae 0x461fb0
lea ecx, [esp + 0x90]
mov edx, dword [esp + 0xa0]
push edx
push ecx
mov ecx, dword [eax + 0x14]
push ecx
push 0
mov ecx, eax
call fcn.0042326c
test eax, eax
sete bl
mov byte [esp + 0x248], 6
cmp dword [esp + 0x54], esi
jb 0x461fe6
mov edx, dword [esp + 0x40]
push edx
call fcn.005112a2
add esp, 4
test bl, bl
je 0x4621f3
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x46232e
lea ecx, [esp + 0x34]
lea esi, [esp + 0x28]
call fcn.00461a90
mov ecx, dword [esp + 0x18]
test ecx, ecx
mov esi, dword [esp + 0x1c]
je 0x46204d
mov edx, esi
sub edx, ecx
mov eax, 0x38e38e39
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0xa
jb 0x46204d
lea edi, [esp + 0x14]
call fcn.00462e10
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebp, dword [esp + 0x2c]
xor edi, edi
xor ebx, ebx
test ecx, ecx
jne 0x46205d
xor eax, eax
jmp 0x462072
mov edx, esi
sub edx, ecx
mov eax, 0x38e38e39
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
ja 0x4621f3
test ecx, ecx
jne 0x462082
xor eax, eax
jmp 0x462097
mov edx, esi
sub edx, ecx
mov eax, 0x38e38e39
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
je 0x4620e7
test ecx, ecx
je 0x4620b8
mov edx, esi
sub edx, ecx
mov eax, 0x38e38e39
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x4620c5
call fcn.00512070
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + ebx + 4]
cmp edx, ebp
jl 0x462158
jg 0x4620dc
mov eax, dword [ecx + ebx]
cmp eax, dword [esp + 0x28]
jb 0x462158
add edi, 1
add ebx, 0x24
jmp 0x462055
test ecx, ecx
je 0x462107
sub esi, ecx
mov eax, 0x38e38e39
imul esi
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0xa
jae 0x4621f3
mov ecx, dword [esp + 0x28]
push 0xffffffffffffffff
push 0
lea edx, [esp + 0xcc]
mov dword [esp + 0x44], ecx
push edx
lea ecx, [esp + 0x50]
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], 0
mov byte [esp + 0x54], 0
call fcn.0040f4da
lea eax, [esp + 0x3c]
push eax
lea esi, [esp + 0x18]
mov byte [esp + 0x24c], 8
call fcn.00462d70
jmp 0x4621df
mov edx, dword [esp + 0x28]
push 0xffffffffffffffff
push 0
lea eax, [esp + 0xcc]
push eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], 0
mov byte [esp + 0x54], 0
call fcn.0040f4da
mov byte [esp + 0x248], 9
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x1c]
mov esi, eax
jbe 0x4621ab
call fcn.00512070
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
mov ebx, ecx
lea ecx, [edi + edi*8]
mov dword [esp + 0x64], esi
lea esi, [esi + ecx*4]
cmp esi, dword [esp + 0x1c]
ja 0x4621c5
cmp esi, eax
jae 0x4621ca
call fcn.00512070
push esi
push ebx
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x24]
call fcn.00462e50
cmp dword [esp + 0x5c], 0x10
jb 0x4621f3
mov ecx, dword [esp + 0x48]
push ecx
call fcn.005112a2
add esp, 4
mov byte [esp + 0x248], 4
cmp dword [esp + 0xf8], 0x10
jb 0x462215
mov edx, dword [esp + 0xe4]
push edx
call fcn.005112a2
add esp, 4
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0xfc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x461f00
mov esi, dword [esp + 0x30]
lea ebp, [eax + 0xf]
xor edi, edi
lea ebx, [eax + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x88], ebx
mov eax, dword [esp + 0x74]
jae 0x462254
lea eax, [esp + 0x74]
lea edx, [esp + 0xfc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x30], eax
jne 0x462338
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x462294
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
push ecx
push edx
call fcn.00465760
mov eax, dword [esp + 0x20]
push eax
call fcn.005112a2
add esp, 0xc
cmp dword [esp + 0xc0], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
jb 0x4622b9
mov ecx, dword [esp + 0xac]
push ecx
call fcn.005112a2
add esp, 4
cmp dword [esp + 0xa4], ebx
mov dword [esp + 0xc0], ebp
mov dword [esp + 0xbc], edi
mov byte [esp + 0xac], 0
jb 0x4622e8
mov edx, dword [esp + 0x90]
push edx
call fcn.005112a2
add esp, 4
cmp dword [esp + 0x88], ebx
mov dword [esp + 0xa4], ebp
mov dword [esp + 0xa0], edi
mov byte [esp + 0x90], 0
jb 0x462314
mov eax, dword [esp + 0x74]
push eax
call fcn.005112a2
add esp, 4
cmp dword [esp + 0xdc], ebx
mov dword [esp + 0x88], ebp
mov dword [esp + 0x84], edi
jmp 0x4626aa
push 0x80070057
call fcn.00410824
lea edx, [esp + 0xfc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x4625da
nop
lea eax, [esp + 0x128]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x462360
sub eax, edx
push eax
lea eax, [esp + 0x12c]
push eax
lea ecx, [esp + 0xcc]
call fcn.0041072d
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xa0]
cmp eax, ecx
jbe 0x4625bf
sub eax, ecx
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xe8]
push ecx
lea ecx, [esp + 0xd0]
call fcn.00462cd0
mov byte [esp + 0x248], 0xa
mov ecx, dword [esp + 0x90]
mov esi, 0x10
cmp dword [esp + 0xa4], esi
jae 0x4623d3
lea ecx, [esp + 0x90]
mov edx, dword [esp + 0xa0]
push edx
push ecx
mov ecx, dword [eax + 0x14]
push ecx
push 0
mov ecx, eax
call fcn.0042326c
test eax, eax
sete bl
mov byte [esp + 0x248], 4
cmp dword [esp + 0xf8], esi
jb 0x46240f
mov edx, dword [esp + 0xe4]
push edx
call fcn.005112a2
add esp, 4
test bl, bl
je 0x4625bf
mov edi, dword [esp + 0x18]
xor ebp, ebp
mov dword [esp + 0x34], ebp
test edi, edi
mov dword [esp + 0x28], ebp
je 0x46253c
mov ecx, dword [esp + 0x1c]
sub ecx, edi
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x34], eax
jae 0x462538
mov ebx, dword [edi + ebp + 0x1c]
mov edx, 0x10
cmp dword [edi + ebp + 0x20], edx
jb 0x462463
mov ecx, dword [edi + ebp + 0xc]
jmp 0x462467
lea ecx, [edi + ebp + 0xc]
mov eax, dword [esp + 0xd8]
cmp eax, ebx
jb 0x462474
mov eax, ebx
cmp dword [esp + 0xdc], edx
mov esi, dword [esp + 0xc8]
jae 0x46248b
lea esi, [esp + 0xc8]
cmp eax, 4
jb 0x4624a4
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x4624a8
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x462490
test eax, eax
je 0x46250d
movzx ebp, byte [ecx]
movzx edx, byte [esi]
sub edx, ebp
jne 0x4624f7
sub eax, 1
add ecx, 1
add esi, 1
test eax, eax
je 0x462509
movzx ebp, byte [ecx]
movzx edx, byte [esi]
sub edx, ebp
jne 0x4624f7
sub eax, 1
add ecx, 1
add esi, 1
test eax, eax
je 0x462509
movzx ebp, byte [ecx]
movzx edx, byte [esi]
sub edx, ebp
jne 0x4624f7
sub eax, 1
add ecx, 1
add esi, 1
test eax, eax
je 0x462509
movzx eax, byte [ecx]
movzx edx, byte [esi]
sub edx, eax
je 0x462509
test edx, edx
mov ebp, dword [esp + 0x28]
mov eax, 1
jg 0x46250f
or eax, 0xffffffff
jmp 0x46250f
mov ebp, dword [esp + 0x28]
xor eax, eax
test eax, eax
jne 0x46252b
mov eax, dword [esp + 0xd8]
cmp eax, ebx
jb 0x46252b
xor ecx, ecx
cmp eax, ebx
setne cl
mov eax, ecx
test eax, eax
je 0x462538
add dword [esp + 0x34], 1
add ebp, 0x24
jmp 0x462421
test edi, edi
jne 0x462540
xor eax, eax
jmp 0x462557
mov ecx, dword [esp + 0x1c]
sub ecx, edi
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x34], eax
jne 0x4625bf
push 0xffffffffffffffff
push 0
lea edx, [esp + 0xb0]
push edx
lea ecx, [esp + 0x7c]
call fcn.0040f4da
cmp dword [esp + 0xdc], 0x10
mov edx, dword [esp + 0xc8]
jae 0x46258a
lea edx, [esp + 0xc8]
mov eax, edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x462590
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x78]
call fcn.0040f77d
cmp dword [esp + 0x88], 0x10
mov eax, dword [esp + 0x74]
jae 0x4625b8
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0xfc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x462350
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x18]
xor esi, esi
cmp eax, esi
je 0x46260b
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
push ecx
push edx
call fcn.00465760
mov eax, dword [esp + 0x20]
push eax
call fcn.005112a2
add esp, 0xc
mov edi, 0x10
cmp dword [esp + 0xc0], edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
jb 0x462635
mov ecx, dword [esp + 0xac]
push ecx
call fcn.005112a2
add esp, 4
cmp dword [esp + 0xa4], edi
mov ebx, 0xf
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xbc], esi
mov byte [esp + 0xac], 0
jb 0x462669
mov edx, dword [esp + 0x90]
push edx
call fcn.005112a2
add esp, 4
cmp dword [esp + 0x88], edi
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa0], esi
mov byte [esp + 0x90], 0
jb 0x462695
mov eax, dword [esp + 0x74]
push eax
call fcn.005112a2
add esp, 4
cmp dword [esp + 0xdc], edi
mov dword [esp + 0x88], ebx
mov dword [esp + 0x84], esi
mov byte [esp + 0x74], 0
jb 0x4626c1
mov ecx, dword [esp + 0xc8]
push ecx
call fcn.005112a2
add esp, 4
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.005112a7
add esp, 0x238
ret