Function at 0x40c44c
Capabilities:
Delete file
Enumerate files on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x658
push ebx
push esi
push edi
mov dword [ebp - 0x654], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x650], 0
xor eax, eax
mov al, byte [0x704c40]
test eax, eax
jne 0x40c552
mov edi, 0x9a3940
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0x704c40
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x704c40
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x40c52e
dec dword [ebp - 0x210]
mov eax, dword [ebp - 0x210]
xor ecx, ecx
mov cl, byte [eax + 0x704c40]
cmp ecx, 0x5c
je 0x40c52e
mov edi, 0x704c40
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov ax, word [0x46c624]
mov word [edi - 1], ax
mov edx, 0x46c628
mov edi, 0x704c40
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov eax, dword [edx]
mov dword [edi], eax
mov eax, dword [edx + 4]
mov dword [edi + 4], eax
mov al, byte [edx + 8]
mov byte [edi + 8], al
push 0x704c40
push 0x46c634
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp dword [0x45e03c], 0
je 0x40c598
lea eax, [ebp - 0x204]
push eax
push 0
call fcn.00452990
add esp, 4
push eax
push str._r_n__X_SCANNING_OFFLINE_USAGE_UPL_r_n____s__
call fcn.00452380
add esp, 0xc
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x658], eax
cmp dword [ebp - 0x658], 0xffffffff
je 0x40c92b
cmp dword [0x4622c8], 0
je 0x40c5de
mov eax, dword [ebp - 0x658]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40c92b
test byte [ebp - 0x64c], 0x10
jne 0x40c8f3
lea eax, [ebp - 0x620]
push eax
push 0x704c40
push 0x46c66c
lea eax, [ebp - 0x50c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
cmp dword [0x45e03c], 0
je 0x40c62d
lea eax, [ebp - 0x50c]
push eax
push str._r_nFOUND_OFFLINE_USAGE_FILE___s_
call fcn.00452380
add esp, 8
push 0
push 0
push 3
push 0
push 1
push bind
lea eax, [ebp - 0x50c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x218], eax
cmp dword [0x45e03c], 0
je 0x40c677
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x218]
push eax
push str._r_n_Open___X__GLE_d
call fcn.00452380
add esp, 0xc
cmp dword [ebp - 0x218], 0xffffffff
je 0x40c8f3
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0x7d000
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
lea eax, [ebp - 0x210]
push eax
push 0x7d000
push 0x482660
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x20c], eax
push 0x1d
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x45e03c], 0
je 0x40c6fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x210]
push eax
mov eax, dword [ebp - 0x20c]
push eax
push str._r_n__Read_d__Size_d_GLE_d
call fcn.00452380
add esp, 0x10
cmp dword [ebp - 0x210], 0
je 0x40c882
cmp dword [0x462198], 0
je 0x40c863
mov eax, dword [0x4620e0]
push eax
call fcn.00437f47
add esp, 4
mov dword [ebp - 0x650], 0
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 4]
push eax
push 0x3e8
push 0x5f8fe0
mov eax, dword [ebp - 0x210]
push eax
push 0x482660
mov eax, dword [0x462198]
push eax
call fcn.00408950
add esp, 0x20
test eax, eax
jne 0x40c800
mov eax, dword [0x4620e0]
push eax
call fcn.00437f6e
add esp, 4
cmp dword [ebp - 0x208], 0
jne 0x40c795
cmp dword [ebp - 0x650], 0
je 0x40c7f1
mov dword [ebp - 0x214], 0
cmp dword [ebp - 0x208], 0
je 0x40c7ec
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x658]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [0x45e03c], 0
je 0x40c7e7
mov eax, dword [ebp - 0x650]
push eax
push str._r_nOFFLINE_XFER_SERVER_UNAVAILABLE___EARLY_EXIT_EW3.00._d
call fcn.00452380
add esp, 8
jmp 0x40c92b
jmp 0x40c7fb
mov dword [ebp - 0x214], 1
jmp 0x40c85e
mov eax, dword [0x4620e0]
push eax
call fcn.00437f6e
add esp, 4
mov dword [ebp - 0x214], 0
cmp dword [ebp - 0x208], 0
je 0x40c85e
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x658]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [0x45e03c], 0
je 0x40c859
push str._r_nOFFLINE_XFER_SERVER_UNAVAILABLE___EARLY_EXIT_EW3.1
call fcn.00452380
add esp, 4
jmp 0x40c92b
jmp 0x40c87d
cmp dword [0x45e03c], 0
je 0x40c87d
push 0x46c73c
call fcn.00452380
add esp, 4
jmp 0x40c8a6
cmp dword [ebp - 0x210], 0
jne 0x40c8a6
cmp dword [ebp - 0x20c], 0
je 0x40c8a6
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x214], 0
je 0x40c8f3
lea eax, [ebp - 0x50c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
mov ax, word [0x462330]
test eax, eax
jne 0x40c8f3
cmp dword [ebp - 0x650], 0
jne 0x40c8f3
mov word [0x462324], 0
lea eax, [ebp - 0x64c]
push eax
mov eax, dword [ebp - 0x658]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40c926
mov eax, dword [ebp - 0x658]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x658], 0xffffffff
jmp 0x40c5b2
pop edi
pop esi
pop ebx
leave
ret