Function at 0x4936c0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
sub esp, 0xab4
mov ax, word [0x514ff0]
push ebp
push esi
mov esi, dword [esp + 0xac0]
push edi
mov word [esp + 0x6b0], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x6b2]
mov ebp, dword [sym.imp.MSVCRT.dll__snwprintf]
rep stosd dword es:[edi], eax
push 0x4f9b10
push esi
push 0x4f7884
lea ecx, [esp + 0x6bc]
push 0x103
push ecx
mov dword [esp + 0x20], 1
stosw word es:[edi], ax
call ebp
add esp, 0x14
lea edx, [esp + 0x258]
lea eax, [esp + 0x6b0]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x493746
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xab4
ret
mov eax, dword [esp + 0xad0]
push ebx
mov ebx, dword [esp + 0xacc]
test eax, eax
je 0x493773
test ebx, ebx
je 0x493762
cmp ebx, 1
jne 0x493773
mov ecx, dword [esp + 0xad0]
push ecx
push esi
call fcn.004935a0
add esp, 8
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x4ae]
mov word [esp + 0x4ac], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x5ed684]
mov ecx, 0x32
inc eax
mov dword [0x5ed684], eax
cdq
idiv ecx
test edx, edx
jne 0x4937fe
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
xor esi, esi
push 1
push esi
push esi
lea edx, [esp + 0x44]
push esi
push edx
call edi
test eax, eax
je 0x4937fe
cmp dword [esp + 0x3c], 0x12
jne 0x4937ca
mov esi, 1
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0
push 0
lea edx, [esp + 0x44]
push 0
push edx
call edi
test eax, eax
jne 0x4937be
test esi, esi
je 0x4937fe
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov esi, dword [sym.imp.MSVCRT.dll_wcscmp]
lea eax, [esp + 0x288]
push 0x4f7314
push eax
call esi
add esp, 8
test eax, eax
je 0x4939af
lea ecx, [esp + 0x288]
push 0x4f9b08
push ecx
call esi
add esp, 8
test eax, eax
je 0x4939af
test byte [esp + 0x25c], 0x10
je 0x4938ad
mov dx, word [0x514ff0]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x8be]
mov word [esp + 0x8bc], dx
lea edx, [esp + 0x8bc]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xac8]
stosw word es:[edi], ax
lea eax, [esp + 0x288]
push eax
push ecx
push 0x4f7858
push 0x103
push edx
call ebp
mov eax, dword [esp + 0xae8]
mov ecx, dword [esp + 0xae4]
push eax
push ecx
lea edx, [esp + 0x8d8]
push ebx
push edx
call fcn.004936c0
add esp, 0x24
jmp 0x4939ab
mov ax, word [0x514ff0]
mov edx, dword [esp + 0xac8]
mov word [esp + 0x54], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x56]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x288]
push ecx
push edx
stosw word es:[edi], ax
push 0x4f7884
lea eax, [esp + 0x60]
push 0x103
push eax
call ebp
xor edx, edx
add esp, 0x14
cmp ebx, edx
je 0x4938fa
cmp ebx, 1
jne 0x4939af
cmp dword [esp + 0xad0], edx
je 0x493958
lea ecx, [esp + 0x54]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov esi, eax
mov ecx, 0x82
push esi
xor eax, eax
lea edi, [esp + 0x4b0]
push str._s
lea edx, [esp + 0x4b4]
push 0x103
rep stosd dword es:[edi], eax
push edx
call ebp
add esp, 0x10
test esi, esi
je 0x4939af
mov eax, dword [esp + 0xad0]
lea ecx, [esp + 0x4ac]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x4939af
xor edx, edx
cmp dword [esp + 0xad4], edx
je 0x4939a0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x2e], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x32], edx
lea eax, [esp + 0x18]
lea edx, [esp + 0x54]
push eax
mov dword [esp + 0x20], 3
mov dword [esp + 0x24], edx
mov word [esp + 0x2c], 0x454
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
jmp 0x4939ab
lea ecx, [esp + 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x25c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x49378f
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
je 0x4939de
cmp ebx, 2
jne 0x493a04
mov esi, dword [esp + 0xac8]
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 0xad4]
test eax, eax
jne 0x493a04
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0xab4
ret