Function at 0x41a8e0
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes
Timestomp file

Disassembly:
sub esp, 0x364
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x12d]
mov byte [esp + 0x12c], 0
lea edx, [esp + 0x12c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x374]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x12c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x12b], 0x5c
je 0x41a97b
mov edi, 0x420078
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x12c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x420074
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x12c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x230]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
je 0x41aba4
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x374]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x28]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x27], 0x5c
je 0x41aa55
mov edi, 0x420078
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x25c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x28]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.0041ec9c
mov al, byte [esp + 0x234]
add esp, 4
test al, 0x10
je 0x41aad7
cmp byte [esp + 0x25c], 0x2e
je 0x41ab7e
lea ecx, [esp + 0x28]
push str.C:Windows
push ecx
call fcn.0041b200
add esp, 8
test eax, eax
jne 0x41ab7e
lea edx, [esp + 0x28]
push edx
call fcn.0041a8e0
add esp, 4
jmp 0x41ab7e
lea eax, [esp + 0x28]
push 0x2e
push eax
call fcn.0041b1d0
add esp, 8
test eax, eax
je 0x41ab7e
inc eax
je 0x41ab7e
push 0x420070
push eax
call fcn.0041ec10
add esp, 8
test eax, eax
jne 0x41ab7e
push eax
push 0x20
push 3
push eax
push eax
lea ecx, [esp + 0x3c]
push 0xc0000000
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x41ab7e
lea edx, [esp + 0x20]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
call fcn.0041a1d0
add esp, 4
mov edi, eax
lea edx, [esp + 0x20]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x41ab7e
lea edx, [esp + 0x28]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x230]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41a9d5
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
add esp, 0x364
ret