Function at 0x41d92a
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
and dword [ebp - 0x140], 0
push ebx
push esi
push edi
push 0x4f
xor eax, eax
pop ecx
lea edi, [ebp - 0x13c]
rep stosd dword es:[edi], eax
lea ecx, [ecx]
sub eax, dword [0x7f5508]
sub ebx, dword [str.dj:]
sub edx, dword [0x7f550c]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub ecx, dword [0x7f5510]
mov edx, edx
add ebx, dword [str.dj:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
inc edx
add edx, dword [0x7f550c]
mov al, byte [0x7f5500]
push 6
push eax
push 0x7fddec
call fcn.00412eee
add esp, 0xc
mov dword [0x7fddf4], eax
lea ecx, [ecx]
sub eax, dword [0x7f5508]
sub ebx, dword [str.dj:]
sub edx, dword [0x7f550c]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub ecx, dword [0x7f5510]
mov edx, edx
add ebx, dword [str.dj:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
inc edx
add edx, dword [0x7f550c]
lea eax, [ebp - 0x140]
push eax
push dword [0x7fddf4]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
lea ecx, [ecx]
sub eax, dword [0x7f5508]
sub ebx, dword [str.dj:]
sub edx, dword [0x7f550c]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub ecx, dword [0x7f5510]
mov edx, edx
add ebx, dword [str.dj:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
inc edx
add edx, dword [0x7f550c]
cmp esi, 0xffffffff
je 0x41db4b
lea ecx, [ecx]
sub eax, dword [0x7f5508]
sub ebx, dword [str.dj:]
sub edx, dword [0x7f550c]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub ecx, dword [0x7f5510]
mov edx, edx
add ebx, dword [str.dj:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
inc edx
add edx, dword [0x7f550c]
test byte [ebp - 0x140], 0x10
jne 0x41daba
lea ecx, [ecx]
sub eax, dword [0x7f5508]
sub ebx, dword [str.dj:]
sub edx, dword [0x7f550c]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub ecx, dword [0x7f5510]
mov edx, edx
add ebx, dword [str.dj:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
inc edx
add edx, dword [0x7f550c]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ecx]
sub eax, dword [0x7f5508]
sub ebx, dword [str.dj:]
sub edx, dword [0x7f550c]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub ecx, dword [0x7f5510]
mov edx, edx
add ebx, dword [str.dj:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
inc edx
add edx, dword [0x7f550c]
lea eax, [ebp - 0x140]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41da30
lea ecx, [ecx]
sub eax, dword [0x7f5508]
sub ebx, dword [str.dj:]
sub edx, dword [0x7f550c]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub ecx, dword [0x7f5510]
mov edx, edx
add ebx, dword [str.dj:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
inc edx
add edx, dword [0x7f550c]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ecx]
sub eax, dword [0x7f5508]
sub ebx, dword [str.dj:]
sub edx, dword [0x7f550c]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub ecx, dword [0x7f5510]
mov edx, edx
add ebx, dword [str.dj:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
inc edx
add edx, dword [0x7f550c]
push dword [0x7fddf4]
call fcn.0042881a
pop ecx
lea ecx, [ecx]
sub eax, dword [0x7f5508]
sub ebx, dword [str.dj:]
sub edx, dword [0x7f550c]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub ecx, dword [0x7f5510]
mov edx, edx
add ebx, dword [str.dj:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
inc edx
add edx, dword [0x7f550c]
and dword [0x7fddf4], 0
lea ecx, [ecx]
sub eax, dword [0x7f5508]
sub ebx, dword [str.dj:]
sub edx, dword [0x7f550c]
mov ebx, ebx
add ecx, dword [0x7f5510]
sub ecx, dword [0x7f5510]
mov edx, edx
add ebx, dword [str.dj:]
add eax, dword [0x7f5508]
dec edx
lea edi, [edi]
inc edx
add edx, dword [0x7f550c]
pop edi
pop esi
pop ebx
leave
ret