Function at 0x402a30
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40ae47
mov eax, dword fs:[0]
push eax
sub esp, 0x538
mov eax, dword [0x40f01c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x544], ecx
mov dword [ebp - 0x538], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov edi, 8
cmp dword [ebp + 0x1c], edi
jae 0x402a7f
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x402aa3
cmp dword [ebp + 0x1c], edi
jb 0x402a9c
mov eax, dword [ebp + 8]
push eax
call fcn.004049bc
add esp, 4
mov al, 1
jmp 0x40305c
push 0x24c
lea ecx, [ebp - 0x530]
push ebx
push ecx
mov dword [ebp - 0x534], ebx
call fcn.00407f30
add esp, 0xc
push 0x40d2f4
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x28c]
push eax
call fcn.00403ef0
add esp, 0xc
cmp dword [eax + 0x14], edi
jb 0x402add
mov eax, dword [eax]
lea ecx, [ebp - 0x534]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x540], esi
cmp dword [ebp - 0x278], edi
jb 0x402b0a
mov edx, dword [ebp - 0x28c]
push edx
call fcn.004049bc
add esp, 4
xor eax, eax
mov dword [ebp - 0x278], 7
mov dword [ebp - 0x27c], ebx
mov word [ebp - 0x28c], ax
cmp esi, 0xffffffff
jne 0x402b52
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x1c], edi
jae 0x402b33
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp dword [ebp + 0x1c], edi
jb 0x402b4b
mov ecx, dword [ebp + 8]
push ecx
call fcn.004049bc
add esp, 4
xor al, al
jmp 0x40305c
xor ebx, ebx
xor edx, edx
lea eax, [ebp - 0x508]
mov word [ebp - 0x254], dx
mov dword [ebp - 0x240], 7
mov dword [ebp - 0x244], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x402b76
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x508]
lea esi, [ebp - 0x254]
call fcn.00403ac0
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x244]
mov edx, esi
cmp esi, 1
jb 0x402bad
mov edx, 1
mov ecx, dword [ebp - 0x254]
cmp dword [ebp - 0x240], edi
jae 0x402bc1
lea ecx, [ebp - 0x254]
mov eax, 0x40d2fc
cmp edx, ebx
jbe 0x402be6
lea ebx, [ebx]
mov di, word [ecx]
cmp di, word [eax]
jne 0x402bf0
add ecx, 2
add eax, 2
dec edx
jne 0x402bd0
mov edi, 8
cmp esi, 1
jae 0x402c01
or eax, 0xffffffff
jmp 0x402c09
sbb eax, eax
and eax, 0xfffffffe
inc eax
cmp eax, ebx
je 0x402be1
mov edi, 8
jmp 0x402c09
xor eax, eax
cmp esi, 1
setne al
cmp eax, ebx
sete al
test al, al
jne 0x40316f
mov edx, esi
cmp esi, 2
jb 0x402c22
mov edx, 2
mov ecx, dword [ebp - 0x254]
cmp dword [ebp - 0x240], edi
jae 0x402c36
lea ecx, [ebp - 0x254]
mov eax, 0x40d300
cmp edx, ebx
jbe 0x402c56
nop
mov di, word [ecx]
cmp di, word [eax]
jne 0x402c60
add ecx, 2
add eax, 2
dec edx
jne 0x402c40
mov edi, 8
cmp esi, 2
jae 0x402c71
or eax, 0xffffffff
jmp 0x402c79
sbb eax, eax
and eax, 0xfffffffe
inc eax
cmp eax, ebx
je 0x402c51
mov edi, 8
jmp 0x402c79
xor eax, eax
cmp esi, 2
setne al
cmp eax, ebx
sete al
test al, al
jne 0x40316f
push 0x40d10c
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x270]
push ecx
call fcn.00403ef0
add esp, 0xc
push ebx
lea edx, [ebp - 0x254]
push edx
or eax, 0xffffffff
lea esi, [ebp - 0x270]
mov byte [ebp - 4], 2
call fcn.004039d0
test byte [ebp - 0x534], 1
je 0x402cdd
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0x25c], edi
jae 0x402cd1
mov eax, esi
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test byte [ebp - 0x534], 0x10
je 0x40307a
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0x240], edi
jae 0x402cfe
lea eax, [ebp - 0x254]
push str.Funshion
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x402d48
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x53c], esp
xor eax, eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], ebx
push ebx
lea edx, [ebp - 0x270]
mov word [ecx], ax
push edx
or eax, 0xffffffff
call fcn.00403810
mov ecx, dword [ebp - 0x544]
call fcn.00402a30
jmp 0x403118
xor eax, eax
mov word [ebp - 0x238], ax
push 0xc
mov eax, str.Funshion.exe
lea esi, [ebp - 0x238]
mov dword [ebp - 0x224], 7
mov dword [ebp - 0x228], ebx
call fcn.00403ac0
mov byte [ebp - 4], 3
or dword [ebp - 0x538], 1
mov edi, esi
call fcn.004018a0
test al, al
je 0x402d96
call fcn.004031a0
test al, al
jne 0x402d96
mov bl, 1
jmp 0x402d98
xor bl, bl
mov dword [ebp - 4], 2
test byte [ebp - 0x538], 1
je 0x402dc7
and dword [ebp - 0x538], 0xfffffffe
cmp dword [ebp - 0x224], 8
jb 0x402dc7
mov ecx, dword [ebp - 0x238]
push ecx
call fcn.004049bc
add esp, 4
test bl, bl
je 0x403113
push 0x206
xor esi, esi
lea eax, [ebp - 0x21a]
xor edx, edx
push esi
push eax
mov word [ebp - 0x21c], dx
call fcn.00407f30
add esp, 0xc
push esi
push 0x19
lea ecx, [ebp - 0x21c]
push ecx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x21c]
lea ecx, [ebp - 0x2a8]
call fcn.00403720
push eax
mov eax, 0x40d338
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 4
call fcn.00403fe0
add esp, 4
mov ebx, 8
mov byte [ebp - 4], 6
cmp dword [ebp - 0x294], ebx
jb 0x402e49
mov edx, dword [ebp - 0x2a8]
push edx
call fcn.004049bc
add esp, 4
sub esp, 0x1c
xor ecx, ecx
mov eax, 7
mov word [ebp - 0x2a8], cx
mov ecx, esp
mov dword [ecx + 0x14], eax
mov dword [ebp - 0x294], eax
mov dword [ebp - 0x53c], esp
push esi
lea eax, [ebp - 0x238]
xor edx, edx
push eax
mov dword [ecx + 0x10], esi
or eax, 0xffffffff
mov dword [ebp - 0x298], esi
mov word [ecx], dx
call fcn.00403810
call fcn.004010c0
test al, al
je 0x402ead
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0x224], ebx
jae 0x402ea6
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x21c]
lea ecx, [ebp - 0x2e0]
call fcn.00403720
push eax
mov eax, str.Funshion.lnk
lea ecx, [ebp - 0x2c4]
mov byte [ebp - 4], 7
call fcn.00403fe0
add esp, 4
mov edi, eax
lea esi, [ebp - 0x238]
mov byte [ebp - 4], 8
call fcn.004037a0
cmp dword [ebp - 0x2b0], ebx
jb 0x402efe
mov ecx, dword [ebp - 0x2c4]
push ecx
call fcn.004049bc
add esp, 4
xor edi, edi
xor edx, edx
mov esi, 7
mov byte [ebp - 4], 6
mov dword [ebp - 0x2b0], esi
mov dword [ebp - 0x2b4], edi
mov word [ebp - 0x2c4], dx
cmp dword [ebp - 0x2cc], ebx
jb 0x402f35
mov eax, dword [ebp - 0x2e0]
push eax
call fcn.004049bc
add esp, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x53c], esp
push edi
lea eax, [ebp - 0x238]
xor edx, edx
push eax
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], edi
or eax, 0xffffffff
mov word [ecx], dx
call fcn.00403810
call fcn.004010c0
test al, al
je 0x402f7f
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0x224], ebx
jae 0x402f78
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x224], ebx
jb 0x402f96
mov ecx, dword [ebp - 0x238]
push ecx
call fcn.004049bc
add esp, 4
xor edx, edx
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x228], edi
mov word [ebp - 0x238], dx
cmp dword [ebp - 0x25c], ebx
jb 0x402fc2
mov eax, dword [ebp - 0x270]
push eax
call fcn.004049bc
add esp, 4
xor ecx, ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x260], edi
mov word [ebp - 0x270], cx
cmp dword [ebp - 0x240], ebx
jb 0x402ff1
mov edx, dword [ebp - 0x254]
push edx
call fcn.004049bc
add esp, 4
mov edi, 8
mov ecx, dword [ebp - 0x540]
lea eax, [ebp - 0x534]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402b52
mov edx, dword [ebp - 0x540]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x1c], edi
jae 0x40302a
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x1c], edi
jae 0x40303c
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
sete bl
cmp dword [ebp + 0x1c], edi
jb 0x40305a
mov eax, dword [ebp + 8]
push eax
call fcn.004049bc
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00404872
mov esp, ebp
pop ebp
ret 0x1c
xor eax, eax
push ebx
lea ecx, [ebp + 8]
mov word [ebp - 0x238], ax
push ecx
or eax, 0xffffffff
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x224], 7
mov dword [ebp - 0x228], ebx
call fcn.00403810
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0x224], edi
jae 0x4030be
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x53c], esp
push ebx
lea eax, [ebp - 0x238]
xor edx, edx
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], ebx
or eax, 0xffffffff
mov word [ecx], dx
call fcn.00403810
lea esi, [ebp - 0x270]
call fcn.004011e0
cmp dword [ebp - 0x224], edi
jb 0x403118
mov ecx, dword [ebp - 0x238]
push ecx
call fcn.004049bc
add esp, 4
jmp 0x403118
mov edi, 8
cmp dword [ebp - 0x25c], edi
jb 0x40312f
mov edx, dword [ebp - 0x270]
push edx
call fcn.004049bc
add esp, 4
xor eax, eax
mov byte [ebp - 4], al
mov dword [ebp - 0x25c], 7
mov dword [ebp - 0x260], 0
mov word [ebp - 0x270], ax
cmp dword [ebp - 0x240], edi
jb 0x402ff6
mov ecx, dword [ebp - 0x254]
push ecx
call fcn.004049bc
add esp, 4
jmp 0x402ff6
mov byte [ebp - 4], 0
cmp dword [ebp - 0x240], edi
jb 0x402ff6
mov edx, dword [ebp - 0x254]
push edx
call fcn.004049bc
add esp, 4
jmp 0x402ff6