Function at 0x4064e3
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, ebx
and eax, 4
push esi
mov dword [ebp - 4], eax
call fcn.004067ff
mov dword [ebp - 0x10], eax
test bl, 8
je 0x406522
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x799e08], eax
jmp 0x40670d
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x40653c
test eax, eax
je 0x406690
test bl, 2
je 0x406690
push esi
mov edi, 0x794c88
push edi
call fcn.00406c86
cmp dword [ebp + 8], 0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x40655e
push str..
push edi
call ebx
jmp 0x406563
call fcn.00406759
cmp word [esi], 0
jne 0x406573
cmp word [0x794c88], 0x5c
jne 0x40657b
push 0x409ac4
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x260]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x406680
lea edi, [ebp - 0x234]
push 0x3f
mov eax, edi
call fcn.0040673b
xor ebx, ebx
cmp word [eax], bx
je 0x4065c1
cmp word [ebp - 0x2c], bx
je 0x4065c1
lea edi, [ebp - 0x2c]
cmp word [edi], 0x2e
jne 0x4065df
movzx eax, word [edi + 2]
cmp ax, bx
je 0x40665d
cmp eax, 0x2e
jne 0x4065df
cmp word [edi + 4], bx
je 0x40665d
push edi
push dword [ebp - 8]
call fcn.00406c86
test byte [ebp - 0x260], 0x10
je 0x406606
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x40665d
push dword [ebp + 0xc]
push esi
call fcn.004064e3
jmp 0x40665d
push esi
push str.Delete:_DeleteFile___s__
call fcn.00407166
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.0040649f
push esi
test eax, eax
jne 0x406656
cmp dword [ebp - 4], ebx
je 0x406642
push str.Delete:_DeleteFile_on_Reboot___s__
call fcn.00407166
pop ecx
pop ecx
push esi
push 0xfffffffffffffff1
call fcn.00405eb9
push ebx
push esi
call fcn.00406b26
jmp 0x40665d
push str.Delete:_DeleteFile_failed___s__
call fcn.00407166
inc dword [0x799e08]
pop ecx
pop ecx
jmp 0x40665d
push 0xfffffffffffffff2
call fcn.00405eb9
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4065a2
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x406682
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406690
mov ecx, dword [ebp - 8]
xor eax, eax
mov word [ecx - 2], ax
xor edi, edi
cmp dword [ebp + 8], edi
je 0x40670d
push esi
cmp dword [ebp - 0x10], edi
jne 0x4066a4
push str.RMDir:_RemoveDirectory_invalid_input___s__
jmp 0x4066f7
call fcn.0040719a
test eax, eax
je 0x40670d
call fcn.00406714
push esi
push str.RMDir:_RemoveDirectory___s__
call fcn.00407166
mov eax, dword [ebp - 4]
pop ecx
pop ecx
or eax, 1
push eax
call fcn.0040649f
push esi
test eax, eax
jne 0x406706
cmp dword [ebp - 4], edi
je 0x4066f2
push str.RMDir:_RemoveDirectory_on_Reboot___s__
call fcn.00407166
pop ecx
pop ecx
push esi
push 0xfffffffffffffff1
call fcn.00405eb9
push edi
push esi
call fcn.00406b26
jmp 0x40670d
push str.RMDir:_RemoveDirectory_failed___s__
call fcn.00407166
inc dword [0x799e08]
pop ecx
pop ecx
jmp 0x40670d
push 0xffffffffffffffe5
call fcn.00405eb9
pop edi
pop esi
pop ebx
leave
ret 8