Function at 0x426f9d
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push 0x2a4
mov eax, 0x5a43e1
call fcn.00437119
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x58]
call fcn.004028f0
mov esi, 0x5a87b4
mov byte [ebp - 4], 1
push esi
call fcn.004549af
pop ecx
push eax
push esi
lea ecx, [ebp - 0x58]
call fcn.00405530
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x2a8]
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2ac], eax
call fcn.00425000
test al, al
je 0x42700f
sub esp, dword [eax - 0x58]
adc dword [edi + 0x45be6b8e], ebp
mov byte [eax + 0x208fe02e], dl
popfd
mov eax, ebp
cmc
fdiv st(7), st(0)
inc dword [eax + eax*8 - 0x1e35e08c]
mov al, 0xd1
adc eax, 0x5224f616
mov esi, 0xafca2c25
or dword [edi + 0x42], esi
test byte [ecx + 0x6c2b60fb], dl
daa
xchg byte [edi - 0x121f8fd2], dl
call fcn.00424d09
test al, al
je 0x427037
retf 0xb0e1
stc
call fcn.00424b26
test al, al
je 0x427056
pop eax
cwde
jbe 0x427036
clc
mov ebp, es
sti
mov al, 0x55
push ecx
out 0xd7, eax
in al, 0x37
xor byte [0x7746277f], dl
dec edi
mov eax, dword [ebp - 0x2ac]
cmp eax, 0xffffffff
je 0x427192
push 0x2e
pop esi
mov edi, 0x623448
lea ecx, [ebp - 0x2a8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x427192
cmp word [ebp - 0x27c], si
je 0x427187
cmp word [ebp - 0x27a], 0
je 0x427187
cmp word [ebp - 0x27a], si
jne 0x4270b5
cmp word [ebp - 0x278], 0
je 0x427187
xor eax, eax
mov dword [ebp - 0x2c], 7
xor ebx, ebx
mov word [ebp - 0x40], ax
mov dword [ebp - 0x30], ebx
cmp word [ebp - 0x27c], ax
je 0x4270dd
lea eax, [ebp - 0x27c]
push eax
call fcn.004549af
pop ecx
push eax
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x40]
call fcn.00401ac0
test byte [ebp - 0x2a8], 0x10
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
je 0x42713f
call fcn.004028f0
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x28]
call fcn.00405660
push edi
call fcn.004549af
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00405530
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.004028f0
call fcn.00426f9d
jmp 0x42716a
call fcn.004028f0
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x28]
call fcn.00405660
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.004028f0
call fcn.00427234
add esp, 0x18
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.00401a00
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00401a00
mov eax, dword [ebp - 0x2ac]
jmp 0x42706d
call fcn.00424d09
test al, al
je 0x4271b6
je 0x4271ec
mov edx, 0x73bf733
xchg esi, eax
popfd
js 0x4271cf
cmc
push ebx
ljmp 0x66d4
call fcn.00424bb0
test al, al
je 0x4271dd
ret
mov ebx, 0xd173d64b
mov ebx, 0xbc8e54da
invalid
mov eax, dword [ebp - 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0x1c], 8
sbb al, 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x427216
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 4
cmovae eax, dword [ebp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.00401a00
push 0
push 1
lea ecx, [ebp + 8]
call fcn.00401a00
call fcn.004370d4
ret