Function at 0x42195a
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push 0x2a8
mov eax, 0x57e0bd
call fcn.0042c498
mov dword [ebp - 0x2ac], ecx
lea eax, [ebp + 8]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], ebx
call fcn.0041fc67
mov byte [ebp - 4], 1
call fcn.004315a0
test al, al
je 0x4219ab
pop ebx
push esi
push esp
pop eax
pop ebp
pop eax
push ebx
push ebx
push ebp
pop esi
pop esi
push ecx
pop ecx
push edi
pop esp
push edx
push edi
pop edx
pop edx
pop esp
push edx
push edx
pop ebp
pop edx
push esp
pop edx
pop edi
pop esp
push edi
pop esp
mov esi, 0x582684
push esi
call fcn.004525b1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x58]
call fcn.00420e5e
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x2a8]
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2b0], eax
cmp eax, 0xffffffff
je 0x421b90
push 0x2e
pop ebx
lea ecx, [ebp - 0x2a8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x421b90
cmp word [ebp - 0x27c], bx
je 0x421b85
cmp word [ebp - 0x27a], 0
je 0x421b85
cmp word [ebp - 0x27a], bx
jne 0x421a34
cmp word [ebp - 0x278], 0
je 0x421b85
call fcn.00431195
test al, al
je 0x421a5b
pop ebx
pop ecx
pop ebx
push esi
pop esp
push edx
push edx
push ebp
pop ecx
push edi
pop edx
push ebp
push ebx
pop esi
pop edi
push esp
pop ebx
pop esp
pop ecx
push edx
push ecx
push eax
pop ecx
push edi
push edx
pop ecx
push ecx
push edi
push esp
pop ecx
call fcn.004311da
test al, al
je 0x421a78
push edx
push esi
pop ebx
push ebx
pop esi
push edi
pop ecx
pop esi
pop esp
pop eax
pop ecx
push ebx
pop eax
push ebp
pop esi
push esi
pop ebp
push eax
push ebx
push ebp
call fcn.00431516
test al, al
je 0x421a9a
pop esi
pop edi
pop edi
push ebx
pop esp
pop ecx
pop edx
push ecx
push edx
push esi
push esi
push ecx
push eax
push ebp
pop esi
pop ebx
push esi
pop ebp
push edx
push ebx
pop esp
push edi
push edi
push ebp
push edi
xor eax, eax
mov dword [ebp - 0x2c], 7
xor ebx, ebx
mov word [ebp - 0x40], ax
mov dword [ebp - 0x30], ebx
cmp word [ebp - 0x27c], ax
je 0x421ac2
lea eax, [ebp - 0x27c]
push eax
call fcn.004525b1
pop ecx
push eax
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x40]
call fcn.004202e4
test byte [ebp - 0x2a8], 0x10
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
je 0x421b2f
call fcn.0041fc67
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x28]
call fcn.00420dbf
mov esi, 0x58268c
push esi
call fcn.004525b1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00420e5e
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.0041fc67
mov ecx, dword [ebp - 0x2ac]
call fcn.0042195a
jmp 0x421b68
call fcn.0041fc67
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x28]
call fcn.00420dbf
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.0041fc8f
mov ecx, dword [ebp - 0x2ac]
call fcn.00421c0a
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.0042019a
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.0042019a
push 0x2e
pop ebx
mov eax, dword [ebp - 0x2b0]
jmp 0x4219ec
call fcn.00431447
test al, al
je 0x421bb2
pop esi
push edi
pop ecx
push ebx
pop edx
pop edi
push edi
push ebx
pop ecx
pop ebx
push esp
push ebp
push edx
pop edi
push esp
pop edi
pop esi
push edx
push eax
pop ebx
pop esi
pop edx
pop esp
push ebp
push eax
push dword [ebp - 0x2b0]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x421bea
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 4
cmovae eax, dword [ebp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.0042019a
push 0
push 1
lea ecx, [ebp + 8]
call fcn.0042019a
call fcn.0042c453
ret 0x18