Function at 0x405b1b
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405e51
test bl, 8
mov dword [ebp - 0xc], eax
je 0x405b5a
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x437788], eax
jmp 0x405d42
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405b74
test eax, eax
je 0x405cc4
test bl, 2
je 0x405cc4
mov esi, 0x430240
push edi
push esi
call fcn.004062e1
cmp dword [ebp + 8], 0
je 0x405b93
push str..
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405b99
push edi
call fcn.00405d95
cmp word [edi], 0
jne 0x405ba9
cmp word [0x430240], 0x5c
jne 0x405bb4
push 0x40a4e4
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x405cb9
lea eax, [ebp - 0x230]
push 0x3f
push eax
lea esi, [ebp - 0x230]
call fcn.00405d76
xor ecx, ecx
cmp word [eax], cx
je 0x405bfb
cmp word [ebp - 0x28], cx
je 0x405bfb
lea esi, [ebp - 0x28]
cmp word [esi], 0x2e
jne 0x405c1a
mov ax, word [esi + 2]
cmp ax, cx
je 0x405c98
cmp ax, 0x2e
jne 0x405c1a
cmp word [esi + 4], cx
je 0x405c98
push esi
push ebx
call fcn.004062e1
test byte [ebp - 0x25c], 0x10
je 0x405c3f
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405c98
push dword [ebp + 0xc]
push edi
call fcn.00405b1b
jmp 0x405c98
push edi
push str.Delete:_DeleteFile___s__
call fcn.004067a6
pop ecx
pop ecx
push dword [ebp - 4]
push edi
call fcn.00405ad3
test eax, eax
push edi
jne 0x405c91
cmp dword [ebp - 4], eax
je 0x405c7d
push str.Delete:_DeleteFile_on_Reboot___s__
call fcn.004067a6
pop ecx
pop ecx
push edi
push 0xfffffffffffffff1
call fcn.0040550b
push 0
push edi
call fcn.0040617b
jmp 0x405c98
push str.Delete:_DeleteFile_failed___s__
call fcn.004067a6
inc dword [0x437788]
pop ecx
pop ecx
jmp 0x405c98
push 0xfffffffffffffff2
call fcn.0040550b
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405bd7
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405cc4
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405d42
cmp dword [ebp - 0xc], esi
push edi
jne 0x405ce5
push str.RMDir:_RemoveDirectory_invalid_input___s__
call fcn.004067a6
inc dword [0x437788]
pop ecx
pop ecx
jmp 0x405d42
call fcn.004067d7
test eax, eax
je 0x405d42
push edi
call fcn.00405d49
push edi
push str.RMDir:_RemoveDirectory___s__
call fcn.004067a6
mov eax, dword [ebp - 4]
pop ecx
pop ecx
or al, 1
push eax
push edi
call fcn.00405ad3
test eax, eax
push edi
jne 0x405d3b
cmp dword [ebp - 4], esi
je 0x405d34
push str.RMDir:_RemoveDirectory_on_Reboot___s__
call fcn.004067a6
pop ecx
pop ecx
push edi
push 0xfffffffffffffff1
call fcn.0040550b
push esi
push edi
call fcn.0040617b
jmp 0x405d42
push str.RMDir:_RemoveDirectory_failed___s__
jmp 0x405cd6
push 0xffffffffffffffe5
call fcn.0040550b
pop edi
pop esi
pop ebx
leave
ret 8