Function at 0x4fa844
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
test dword [0x7eeab0], 0xffffff80
jne 0x4fa86c
test dword [0x7eeab0], 0xffffffff
jne 0x4fabec
call fcn.006a7b4c
jmp fcn.004fa844
push edi
push esi
push ebp
push ebx
sub esp, 0x10
mov ebx, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
cmp eax, 1
je 0x4fabe2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x91
je 0x4fa89f
cmp eax, 5
je 0x4fa89f
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret
lea ecx, [esp + 4]
mov edx, ebx
call fcn.004f5c14
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
test eax, eax
je 0x4fa8f5
mov esi, 0x700ee0
mov edi, eax
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fa8bd
mov ecx, dword [esp + 8]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fa8e2
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fa8cd
dec eax
cmp byte [eax + 0x700edf], 0x5c
je 0x4fa8f7
mov byte [eax + 0x700ee0], 0x5c
inc eax
jmp 0x4fa8f7
xor eax, eax
lea edx, [eax + 0x700ee0]
mov byte [eax + 0x700ee0], 0
push 0x6d0a98
push 0x6c4a54
push edx
call fcn.006974c6
add esp, 0xc
mov ecx, 0x13e
call fcn.004dbdb8
mov ebp, eax
push ebp
push 0x700ee0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4fabd3
mov ecx, dword [ebp]
and ecx, 0x10
mov eax, 1
mov ecx, 0
cmovne ecx, eax
lea edi, [ebp + 0x2c]
mov dword [esp + 0xc], edi
mov esi, 0x6d09dc
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fa979
test dl, dl
je 0x4fa975
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fa979
add edi, 2
add esi, 2
test dl, dl
jne 0x4fa959
xor eax, eax
jmp 0x4fa97e
sbb eax, eax
or eax, 1
test eax, eax
je 0x4faaf0
mov edi, dword [esp + 0xc]
mov esi, 0x6d0a9c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fa9af
test dl, dl
je 0x4fa9ab
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fa9af
add edi, 2
add esi, 2
test dl, dl
jne 0x4fa98f
xor eax, eax
jmp 0x4fa9b4
sbb eax, eax
or eax, 1
test eax, eax
je 0x4faaf0
test ecx, ecx
jne 0x4faa75
mov eax, 0x700ce0
mov edx, 0x700de0
mov ecx, dword [esp + 8]
cmp ecx, eax
cmove eax, edx
mov dword [esp], eax
test ecx, ecx
je 0x4faa18
mov esi, eax
mov edi, ecx
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fa9e2
mov ecx, dword [esp + 8]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4faa07
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fa9f2
dec eax
mov edx, dword [esp]
cmp byte [eax + edx - 1], 0x5c
je 0x4faa1a
mov byte [eax + edx], 0x5c
inc eax
jmp 0x4faa1a
xor eax, eax
mov edx, dword [esp]
lea ecx, [edx + eax]
mov byte [eax + edx], 0
mov eax, dword [esp + 0xc]
push eax
push 0x6c4a54
push ecx
call fcn.006974c6
add esp, 0xc
mov eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
je 0x4faaf0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4faaf0
push 0x80
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4faaf0
mov eax, 0x700ce0
mov edx, 0x700de0
mov ecx, dword [esp + 8]
cmp ecx, eax
cmove eax, edx
mov dword [esp], eax
test ecx, ecx
je 0x4faac9
mov esi, eax
mov edi, ecx
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4faa93
mov ecx, dword [esp + 8]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4faab8
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4faaa3
dec eax
mov edx, dword [esp]
cmp byte [eax + edx - 1], 0x5c
je 0x4faacb
mov byte [eax + edx], 0x5c
inc eax
jmp 0x4faacb
xor eax, eax
mov edx, dword [esp]
lea ecx, [edx + eax]
mov byte [eax + edx], 0
mov eax, dword [esp + 0xc]
push eax
push 0x6c4a54
push ecx
call fcn.006974c6
add esp, 0xc
mov ecx, dword [esp]
call fcn.004fa844
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
jne 0x4fab98
mov edi, dword [esp + 0xc]
mov esi, 0x6d09dc
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fab2a
test dl, dl
je 0x4fab26
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fab2a
add edi, 2
add esi, 2
test dl, dl
jne 0x4fab0a
xor eax, eax
jmp 0x4fab2f
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fab87
mov edi, dword [esp + 0xc]
mov esi, 0x6d0a9c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fab5c
test dl, dl
je 0x4fab58
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fab5c
add edi, 2
add esi, 2
test dl, dl
jne 0x4fab3c
xor eax, eax
jmp 0x4fab61
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fab87
mov eax, dword [ebp]
xor edx, edx
and eax, 0x10
mov esi, 1
cmovne edx, esi
mov edi, dword [esp + 8]
push edi
mov ecx, dword [esp + 0x10]
call fcn.004fb7f0
test eax, eax
je 0x4fab98
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
je 0x4fab01
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, ebp
call fcn.004db4f8
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4fabb8
xor ebx, ebx
jmp 0x4fabc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [esp + 4]
call fcn.004db4f8
mov eax, ebx
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret
mov ecx, ebp
call fcn.004db4f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4faba6
xor eax, eax
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret
push edi
push esi
push ebp
push ebx
sub esp, 0x10
mov ebx, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
cmp eax, 1
je 0x4faf52
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x91
je 0x4fac1f
cmp eax, 5
je 0x4fac1f
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret
lea ecx, [esp]
mov edx, ebx
call fcn.004f5c14
mov eax, dword [esp]
mov dword [esp + 4], eax
test eax, eax
je 0x4fac73
mov esi, 0x700ee0
mov edi, eax
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fac3b
mov ecx, dword [esp + 4]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fac60
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fac4b
dec eax
cmp byte [eax + 0x700edf], 0x5c
je 0x4fac75
mov byte [eax + 0x700ee0], 0x5c
inc eax
jmp 0x4fac75
xor eax, eax
lea edx, [eax + 0x700ee0]
mov byte [eax + 0x700ee0], 0
push 0x6d0a98
push 0x6c4a54
push edx
call fcn.006974c6
add esp, 0xc
mov ecx, 0x13e
call fcn.004dbdb8
mov ebx, eax
push ebx
push 0x700ee0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
je 0x4faf43
mov eax, dword [ebx]
and eax, 0x10
xor ecx, ecx
test eax, eax
setne cl
lea edi, [ebx + 0x2c]
mov dword [esp + 0xc], edi
mov esi, 0x6d09dc
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4facf2
test dl, dl
je 0x4facee
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4facf2
add edi, 2
add esi, 2
test dl, dl
jne 0x4facd2
xor eax, eax
jmp 0x4facf7
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fae5a
mov edi, dword [esp + 0xc]
mov esi, 0x6d0a9c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fad28
test dl, dl
je 0x4fad24
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fad28
add edi, 2
add esi, 2
test dl, dl
jne 0x4fad08
xor eax, eax
jmp 0x4fad2d
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fae5a
test ecx, ecx
jne 0x4fade2
mov edx, 0x700ce0
mov eax, dword [esp + 4]
cmp eax, edx
je 0x4fad51
mov ebp, 0x700ce0
jmp 0x4fad56
mov ebp, 0x700de0
test eax, eax
je 0x4fad91
mov esi, ebp
mov edi, eax
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fad5e
mov ecx, dword [esp + 4]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fad83
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fad6e
dec eax
cmp byte [eax + ebp - 1], 0x5c
je 0x4fad93
mov byte [eax + ebp], 0x5c
inc eax
jmp 0x4fad93
xor eax, eax
lea edx, [ebp + eax]
mov byte [eax + ebp], 0
mov eax, dword [esp + 0xc]
push eax
push 0x6c4a54
push edx
call fcn.006974c6
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
je 0x4fae5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4fae5a
push 0x80
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4fae5a
mov edx, 0x700ce0
mov eax, dword [esp + 4]
cmp eax, edx
je 0x4fadf6
mov ebp, 0x700ce0
jmp 0x4fadfb
mov ebp, 0x700de0
test eax, eax
je 0x4fae36
mov esi, ebp
mov edi, eax
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fae03
mov ecx, dword [esp + 4]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fae28
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fae13
dec eax
cmp byte [eax + ebp - 1], 0x5c
je 0x4fae38
mov byte [eax + ebp], 0x5c
inc eax
jmp 0x4fae38
xor eax, eax
lea edx, [ebp + eax]
mov byte [eax + ebp], 0
mov eax, dword [esp + 0xc]
push eax
push 0x6c4a54
push edx
call fcn.006974c6
add esp, 0xc
mov ecx, ebp
call fcn.004fa844
push ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
jne 0x4faf06
mov ebp, dword [esp + 8]
mov edi, dword [esp + 0xc]
mov esi, 0x6d09dc
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fae9c
test dl, dl
je 0x4fae98
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fae9c
add edi, 2
add esi, 2
test dl, dl
jne 0x4fae7c
xor eax, eax
jmp 0x4faea1
sbb eax, eax
or eax, 1
test eax, eax
je 0x4faef5
mov edi, dword [esp + 0xc]
mov esi, 0x6d0a9c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4faece
test dl, dl
je 0x4faeca
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4faece
add edi, 2
add esi, 2
test dl, dl
jne 0x4faeae
xor eax, eax
jmp 0x4faed3
sbb eax, eax
or eax, 1
test eax, eax
je 0x4faef5
mov eax, dword [ebx]
and eax, 0x10
xor edx, edx
test eax, eax
setne dl
mov esi, dword [esp + 4]
push esi
mov ecx, dword [esp + 0x10]
call fcn.004fb7f0
test eax, eax
je 0x4faf06
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
je 0x4fae73
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, ebx
call fcn.004db4f8
push dword [esp]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4faf29
xor ebx, ebx
jmp 0x4faf31
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [esp]
call fcn.004db4f8
mov eax, ebx
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret
mov ecx, ebx
call fcn.004db4f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4faf18
xor eax, eax
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret