Function at 0x441b98
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push 0x42c
mov eax, 0x5a3612
call fcn.0056ce95
mov eax, dword [ebp + 8]
mov dword [ebp - 0x398], eax
mov eax, dword [ebp + 0xc]
mov ebx, ecx
push dword [ebx]
mov dword [ebp - 0x3a0], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x394], ebx
call fcn.0044184d
pop ecx
pop ecx
mov edi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x138]
push eax
call fcn.00409ac6
mov esi, eax
push str.Going_to_forget_package
push esi
mov byte [ebp - 4], 1
call fcn.0040fa1f
push esi
mov ecx, edi
call fcn.0040fbd3
add esp, 0xc
push 0x5c9300
push esi
call fcn.0040fa1f
lea ecx, [ebx + 4]
push esi
mov dword [ebp - 0x39c], ecx
call fcn.0040fbd3
add esp, 0xc
push 0x5c5bd4
push esi
call fcn.0040fa1f
pop ecx
pop ecx
lea eax, [ebp - 0x64]
push eax
mov eax, esi
call fcn.00409b30
mov byte [ebp - 4], 2
cmp dword [ebp - 0x50], 8
mov eax, dword [ebp - 0x64]
jae 0x441c41
lea eax, [ebp - 0x64]
push eax
push 3
pop ecx
call fcn.0047c666
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x64]
call fcn.0040b028
lea eax, [ebp - 0x138]
mov byte [ebp - 4], 0
call fcn.004021a3
or dword [ebp - 4], 0xffffffff
push 1
lea esi, [ebp - 0x2c]
call fcn.0040b028
push ebx
mov ebx, dword [ebp - 0x398]
lea eax, [ebp - 0x80]
push eax
call fcn.004430b7
push 8
pop edi
mov dword [ebp - 4], 3
cmp dword [eax + 0x14], edi
jb 0x441c95
mov eax, dword [eax]
mov dword [ebp - 0x38c], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
push dword [ebp - 0x38c]
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 4
call fcn.0040ad38
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
jne 0x441cda
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.0040b028
mov al, 1
jmp 0x441f0b
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x441ce5
lea eax, [ebp - 0x2c]
lea eax, [eax + ecx*2]
cmp word [eax - 2], 0x5c
je 0x441cfd
push 0x5c2724
lea eax, [ebp - 0x2c]
push eax
call fcn.004090e2
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
jbe 0x441d2e
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x441d0f
lea eax, [ebp - 0x2c]
cmp word [eax + ecx*2], 0x2f
jne 0x441d28
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x441d21
lea eax, [ebp - 0x2c]
push 0x5c
pop edx
mov word [eax + ecx*2], dx
inc ecx
cmp ecx, dword [ebp - 0x1c]
jb 0x441d04
lea eax, [ebp - 0x2c]
push eax
lea esi, [ebp - 0x64]
call fcn.0040905d
push 0x5da400
mov eax, esi
push eax
mov byte [ebp - 4], 5
call fcn.004090e2
push 0x250
lea eax, [ebp - 0x388]
push ebx
push eax
call fcn.00560d40
mov eax, dword [ebp - 0x64]
add esp, 0xc
cmp dword [ebp - 0x50], edi
jae 0x441d6a
mov eax, esi
lea ecx, [ebp - 0x388]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x390], eax
cmp eax, 0xffffffff
jne 0x441da2
push 1
xor edi, edi
lea esi, [ebp - 0x64]
call fcn.0040b028
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.0040b028
xor al, al
jmp 0x441f0b
lea eax, [ebp - 0x2c]
push eax
lea esi, [ebp - 0x48]
call fcn.0040905d
lea eax, [ebp - 0x35c]
push eax
mov eax, esi
push eax
mov byte [ebp - 4], 6
call fcn.004090e2
test byte [ebp - 0x388], 0x10
je 0x441e05
lea eax, [ebp - 0x35c]
push 0x5c3b10
push eax
call fcn.00561046
pop ecx
pop ecx
test eax, eax
je 0x441e66
lea eax, [ebp - 0x35c]
push 0x5c3b14
push eax
call fcn.00561046
pop ecx
pop ecx
test eax, eax
je 0x441e66
mov eax, esi
call fcn.00476884
jmp 0x441e66
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x34], edi
jae 0x441e10
lea eax, [ebp - 0x48]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
test eax, eax
jne 0x441e66
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x441e66
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x34], edi
jae 0x441e33
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp - 0x48]
cmp dword [ebp - 0x34], edi
jae 0x441e45
lea ecx, [ebp - 0x48]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x441e97
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x34], edi
jae 0x441e5f
lea eax, [ebp - 0x48]
push eax
call esi
test eax, eax
je 0x441e97
xor ebx, ebx
inc ebx
push ebx
xor edi, edi
lea esi, [ebp - 0x48]
mov byte [ebp - 4], 5
call fcn.0040b028
lea eax, [ebp - 0x388]
push eax
push dword [ebp - 0x390]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x441ea8
push 8
pop edi
jmp 0x441da2
push 1
xor edi, edi
lea esi, [ebp - 0x48]
call fcn.0040b028
jmp 0x441d83
push dword [ebp - 0x390]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [ebp - 0x38c]
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edi
call esi
test eax, eax
jne 0x441ef5
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x441ee4
push edi
call esi
test eax, eax
jne 0x441ef5
push ebx
xor edi, edi
lea esi, [ebp - 0x64]
call fcn.0040b028
push ebx
jmp 0x441d91
push ebx
xor edi, edi
lea esi, [ebp - 0x64]
call fcn.0040b028
push ebx
lea esi, [ebp - 0x2c]
call fcn.0040b028
mov al, bl
test al, al
sete bl
or dword [ebp - 4], 0xffffffff
push 1
xor edi, edi
lea esi, [ebp - 0x80]
call fcn.0040b028
test bl, bl
mov ebx, dword [ebp - 0x394]
je 0x441fba
push dword [ebx]
lea eax, [ebp - 0x80]
push eax
call fcn.0044184d
pop ecx
pop ecx
mov edi, eax
lea eax, [ebp - 0x138]
push eax
mov dword [ebp - 4], 7
call fcn.00409ac6
mov esi, eax
push str.Cannot_delete_files_of_package
push esi
mov byte [ebp - 4], 8
call fcn.0040fa1f
push esi
mov ecx, edi
call fcn.0040fbd3
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
mov eax, esi
call fcn.00409b30
mov byte [ebp - 4], 9
cmp dword [ebp - 0x50], 8
mov eax, dword [ebp - 0x64]
jae 0x441f87
lea eax, [ebp - 0x64]
push eax
push 2
pop ecx
call fcn.0047c666
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x64]
call fcn.0040b028
lea eax, [ebp - 0x138]
mov byte [ebp - 4], 7
call fcn.004021a3
or dword [ebp - 4], 0xffffffff
push 1
lea esi, [ebp - 0x80]
call fcn.0040b028
mov eax, dword [ebp - 0x3a0]
push 0
call fcn.0047bae8
test al, al
je 0x441fe3
lea ebx, [ebp - 0x130]
call fcn.00485ad3
push 0x5ffbe4
mov eax, ebx
push eax
call fcn.005676bc
mov eax, dword [ebp - 0x398]
mov ecx, dword [eax + 0x14]
push dword [ebx]
mov eax, dword [ecx]
call dword [eax + 8]
push dword [ebx]
lea eax, [ebp - 0x9c]
push eax
call fcn.0044184d
pop ecx
pop ecx
mov edi, eax
lea eax, [ebp - 0x438]
push eax
mov dword [ebp - 4], 0xa
call fcn.00409ac6
mov esi, eax
push 0x5ceda8
push esi
mov byte [ebp - 4], 0xb
call fcn.0040fa1f
push esi
mov ecx, edi
call fcn.0040fbd3
add esp, 0xc
push 0x5c9300
push esi
call fcn.0040fa1f
mov ecx, dword [ebp - 0x39c]
push esi
call fcn.0040fbd3
add esp, 0xc
push str.__removed.
push esi
call fcn.0040fa1f
pop ecx
pop ecx
lea eax, [ebp - 0x48]
push eax
mov eax, esi
call fcn.00409b30
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x442076
lea eax, [ebp - 0x48]
push eax
push 3
pop ecx
call fcn.0047c666
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x48]
call fcn.0040b028
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 0xa
call fcn.004021a3
push 1
lea esi, [ebp - 0x9c]
call fcn.0040b028
call fcn.0056cf18
ret 8