Function at 0x4ad20492
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x464], eax
mov dword [eax], 1
mov eax, esi
mov dword [ebp - 0x460], esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad204c6
sub eax, edx
sar eax, 1
mov ebx, eax
mov dword [ebp - 0x468], ebx
jne 0x4ad204e8
mov eax, 0xa1
jmp 0x4ad208d9
push edi
lea eax, [ebx + 3]
mov edi, 0x104
cmp eax, edi
jle 0x4ad204fb
push esi
jmp 0x4ad208d3
lea eax, [ebp - 0x45c]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
call esi
cmp eax, 0xffffffff
jne 0x4ad20523
and dword [ebp - 0x438], 0
mov dword [ebp - 0x45c], 0x10
jmp 0x4ad2052a
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp - 0x45c], 0x10
je 0x4ad208cd
test dword [ebp - 0x45c], 0x400
je 0x4ad20553
test dword [ebp - 0x438], 0x20000000
jne 0x4ad208cd
push dword [ebp - 0x460]
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.4ad0185a
mov eax, dword [ebp - 0x460]
movzx eax, word [eax + ebx*2 - 2]
cmp ax, 0x3a
je 0x4ad20596
cmp ax, 0x5c
je 0x4ad20596
push 0x4ad02ec8
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad020a9
inc ebx
mov dword [ebp - 0x468], ebx
push 0x4ad09ffc
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad020a9
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
mov dword [ebp - 0x46c], eax
cmp eax, 0xffffffff
je 0x4ad208cd
cmp dword [0x4ad241b4], 0
jne 0x4ad208b4
lea edx, [ebp - 0x228]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad205df
sub eax, esi
sar eax, 1
jne 0x4ad20608
lea edx, [ebp - 0x430]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad205fa
sub eax, esi
sar eax, 1
add eax, ebx
cmp eax, edi
push edx
jge 0x4ad20896
mov eax, edi
sub eax, ebx
push eax
lea esi, [ebp + ebx*2 - 0x20c]
push esi
call fcn.4ad0185a
mov eax, dword [ebp - 0x45c]
mov ebx, eax
test al, 0x10
je 0x4ad20721
mov ecx, 0x4ad02ec4
lea eax, [ebp - 0x430]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4ad20666
test dx, dx
je 0x4ad20662
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4ad20666
add eax, 4
add ecx, 4
test dx, dx
jne 0x4ad20640
xor eax, eax
jmp 0x4ad2066b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4ad2082c
mov ecx, 0x4ad02ebc
lea eax, [ebp - 0x430]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4ad206a4
test dx, dx
je 0x4ad206a0
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4ad206a4
add eax, 4
add ecx, 4
test dx, dx
jne 0x4ad2067e
xor eax, eax
jmp 0x4ad206a9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4ad2082c
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad20492
cmp dword [0x4ad241b4], 0
jne 0x4ad208b4
test eax, eax
je 0x4ad2082c
mov ecx, dword [ebp - 0x464]
and dword [ecx], 0
cmp eax, 0x91
jne 0x4ad206f6
cmp dword [ebp - 0x470], 0
je 0x4ad2082c
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x4000271b
call fcn.4ad06d44
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.4ad06d44
pop ecx
pop ecx
jmp 0x4ad2082c
test al, 1
je 0x4ad20736
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4ad2082c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4d3
je 0x4ad208b4
cmp eax, 3
jne 0x4ad2079a
push 4
lea eax, [ebp - 0x20c]
push 0x4ad208ec
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x4ad2079a
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, edi
jle 0x4ad2079a
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x228]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad207a3
sub eax, edx
sar eax, 1
je 0x4ad207ef
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x430]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad207c1
mov ecx, dword [ebp - 0x468]
sub eax, edx
sar eax, 1
add eax, ecx
cmp eax, edi
jb 0x4ad2084e
lea eax, [ebp - 0x228]
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad020a9
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x4000271b
call fcn.4ad06d44
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.4ad06d44
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp - 0x464]
and dword [eax], 0
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x46c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4ad208b4
mov ebx, dword [ebp - 0x468]
jmp 0x4ad205c7
lea eax, [ebp - 0x430]
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad020a9
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x4000271b
call fcn.4ad06d44
xor eax, eax
add esp, 0xc
mov word [esi], ax
lea eax, [ebp - 0x228]
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad020a9
jmp 0x4ad20805
push dword [ebp - 0x460]
mov eax, dword [ebp - 0x464]
and dword [eax], 0
push 2
push 0x400023da
call fcn.4ad06d44
add esp, 0x10
push dword [ebp - 0x46c]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [0x4ad241b4], 0
je 0x4ad208cd
xor eax, eax
jmp 0x4ad208d8
push dword [ebp - 0x460]
call fcn.4ad20202
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.4ad013a9
leave
ret 8