Function at 0x47d280
Capabilities:
Delete file
Enumerate files on windows
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x567258
mov eax, dword fs:[0]
push eax
sub esp, 0x57c
mov eax, dword [0x5b3680]
xor eax, esp
mov dword [esp + 0x574], eax
push esi
push edi
mov eax, dword [0x5b3680]
xor eax, esp
push eax
lea eax, [esp + 0x588]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
call fcn.00402a00
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x47d2e2
push 0x80004005
call fcn.004027b0
mov eax, dword [edx]
mov ecx, edx
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x44], esi
mov dword [esp + 0x590], 1
call fcn.00402a00
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x47d319
push 0x80004005
call fcn.004027b0
mov eax, dword [edx]
mov ecx, edx
mov eax, dword [eax + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x48], edi
mov byte [esp + 0x590], 3
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x14], 0
jne 0x47dbee
mov ecx, dword [eax + 0x18]
sub ecx, 0x10
call fcn.004022c0
add eax, 0x10
mov dword [esp + 0x34], eax
mov byte [esp + 0x590], 5
lea ecx, [esp + 0x34]
push 6
push 0x58d888
call fcn.00443ec0
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov byte [esp + 0x590], 6
lea eax, [esp + 0x124]
push eax
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x47d40b
or edi, 0xffffffff
jmp 0x47d3a0
lea eax, [esp + 0x150]
push eax
lea ecx, [esp + 0x28]
call fcn.004031c0
mov byte [esp + 0x590], 7
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x3c]
call fcn.00459110
mov byte [esp + 0x590], 6
mov ecx, edi
mov edx, dword [esp + 0x24]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x47d3ec
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esp + 0x124]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x47d3a0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [esp + 0x48]
mov eax, dword [esp + 0x38]
mov esi, eax
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], esi
cmp eax, ecx
je 0x47d888
movsd xmm0, qword [0x593278]
movsd qword [esp + 0x4c], xmm0
movsd xmm0, qword [0x5931b8]
movsd qword [esp + 0x8c], xmm0
mov eax, dword [esp + 0x18]
mov edi, dword [eax + 0x18]
sub edi, 0x10
mov ecx, dword [edi]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
mov ecx, eax
jl 0x47d46d
cmp ecx, dword [edi]
jne 0x47d46d
mov eax, 1
lock xadd dword [edx], eax
jmp 0x47d4b3
mov eax, dword [ecx]
push 2
push dword [edi + 4]
mov eax, dword [eax]
call eax
mov edx, eax
mov dword [esp + 0x30], edx
test edx, edx
je 0x47dbe9
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
mov ecx, dword [edi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edx + 0x10]
push eax
call fcn.005297ad
mov edi, dword [esp + 0x40]
add esp, 0x10
lea eax, [edi + 0x10]
mov dword [esp + 0x14], eax
mov byte [esp + 0x590], 0xa
lea ecx, [esp + 0x14]
push 1
push 0x58af04
call fcn.00443ec0
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push dword [eax - 0xc]
push eax
call fcn.00443ec0
mov edi, dword [esp + 0x14]
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
je 0x47d84b
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
push 8
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x47d83b
push 0
lea ecx, [esp + 0x80]
push ecx
push dword [esp + 0x38]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x7c], eax
jne 0x47d828
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
cmp dword [eax + 0x1c], 0
je 0x47d95e
mov eax, dword [ecx + 0x28]
add eax, ecx
push eax
lea eax, [esp + 0x378]
push 0x104
push eax
call fcn.0052c92e
mov eax, dword [esp + 0x28]
add esp, 0xc
movdqu xmm0, xmmword [eax + 0x68]
lea eax, [esp + 0xb4]
push eax
lea eax, [esp + 0x118]
push eax
push 0
movdqu xmmword [esp + 0x120], xmm0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
lea eax, [esp + 0x94]
push eax
mov eax, dword [esp + 0x1c]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ax, word [esp + 0xa2]
cmp ax, word [esp + 0xc2]
jne 0x47d68a
mov ax, word [esp + 0xa0]
cmp ax, word [esp + 0xc0]
jne 0x47d68a
mov ax, word [esp + 0x9e]
cmp ax, word [esp + 0xbe]
jne 0x47d68a
mov ax, word [esp + 0x9c]
cmp ax, word [esp + 0xbc]
jne 0x47d68a
mov ax, word [esp + 0x9a]
cmp ax, word [esp + 0xba]
jne 0x47d68a
mov ax, word [esp + 0x96]
cmp ax, word [esp + 0xb6]
jne 0x47d68a
mov ax, word [esp + 0x94]
cmp ax, word [esp + 0xb4]
jne 0x47d68a
mov eax, dword [edi - 0xc]
lea ecx, [esp + 0x14]
add eax, 0xfffffffc
push eax
lea eax, [esp + 0x74]
push eax
call fcn.00414320
mov byte [esp + 0x590], 0xb
lea ecx, [esp + 0x14]
push eax
call fcn.00416320
mov byte [esp + 0x590], 0xa
lea ecx, [esp + 0x70]
jmp 0x47da7e
mov eax, dword [esp + 0x1c]
movdqu xmm0, xmmword [eax + 0x68]
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0xe8]
push eax
movdqu xmmword [esp + 0xec], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToSystemTime]
test eax, eax
je 0x47d6d5
movzx eax, word [esp + 0xf2]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [esp + 0x4c]
addsd xmm0, qword [esp + 0x54]
movsd qword [esp + 0x54], xmm0
movdqa xmm0, xmmword [esp + 0x94]
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0xd8]
movdqa xmmword [esp + 0xd8], xmm0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToSystemTime]
test eax, eax
je 0x47d72b
movzx eax, word [esp + 0xe2]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [esp + 0x4c]
addsd xmm0, qword [esp + 0x84]
movsd qword [esp + 0x84], xmm0
jmp 0x47d734
movsd xmm0, qword [esp + 0x84]
subsd xmm0, qword [esp + 0x54]
comisd xmm0, xmmword [esp + 0x8c]
jbe 0x47d828
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi - 0xc]
lea ecx, [esp + 0x14]
add eax, 0xfffffffc
push eax
lea eax, [esp + 0x84]
push eax
call fcn.00414320
mov byte [esp + 0x590], 0xc
lea ecx, [esp + 0x14]
push eax
call fcn.00416320
mov byte [esp + 0x590], 0xa
or ecx, 0xffffffff
mov edx, dword [esp + 0x80]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x47d7b5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.004022c0
add eax, 0x10
mov dword [esp + 0x2c], eax
mov byte [esp + 0x590], 0xf
lea ecx, [esp + 0x14]
push str..spl
call fcn.00443fd0
push str..shd
lea ecx, [esp + 0x30]
call fcn.00443fd0
mov esi, dword [esp + 0x2c]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [esp + 0x590], 0xa
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x47d824
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [esp + 0x24]
push dword [esp + 0x1c]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x20]
cmp eax, 0xffffffff
je 0x47d84b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0x590], 6
add edi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x47d86d
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esp + 0x3c]
add esi, 4
mov dword [esp + 0x24], esi
cmp esi, ecx
jne 0x47d440
mov edi, dword [esp + 0x48]
mov eax, dword [esp + 0x38]
mov byte [esp + 0x590], 5
test eax, eax
je 0x47d8c6
push ecx
mov edx, ecx
mov ecx, eax
call fcn.0045a940
mov eax, dword [esp + 0x3c]
add esp, 4
push eax
call fcn.005295dd
add esp, 4
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov byte [esp + 0x590], 3
or ecx, 0xffffffff
mov edx, dword [esp + 0x34]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x47d8ec
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [esp + 0x44]
mov byte [esp + 0x590], 1
add edi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x47d912
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x590], 0xffffffff
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x47d937
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [esp + 0x588]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x574]
xor ecx, esp
call fcn.005295e2
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ecx + 0x1c]
add eax, ecx
push eax
lea eax, [esp + 0x378]
push 0x104
push eax
call fcn.0052c92e
mov eax, dword [esp + 0x28]
add esp, 0xc
movdqu xmm0, xmmword [eax + 0x3c]
lea eax, [esp + 0xc4]
push eax
lea eax, [esp + 0xf8]
push eax
push 0
movdqu xmmword [esp + 0x100], xmm0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
lea eax, [esp + 0xa4]
push eax
mov eax, dword [esp + 0x1c]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ax, word [esp + 0xb2]
cmp ax, word [esp + 0xd2]
jne 0x47dab2
mov ax, word [esp + 0xb0]
cmp ax, word [esp + 0xd0]
jne 0x47dab2
mov ax, word [esp + 0xae]
cmp ax, word [esp + 0xce]
jne 0x47dab2
mov ax, word [esp + 0xac]
cmp ax, word [esp + 0xcc]
jne 0x47dab2
mov ax, word [esp + 0xaa]
cmp ax, word [esp + 0xca]
jne 0x47dab2
mov ax, word [esp + 0xa6]
cmp ax, word [esp + 0xc6]
jne 0x47dab2
mov ax, word [esp + 0xa4]
cmp ax, word [esp + 0xc4]
jne 0x47dab2
mov eax, dword [edi - 0xc]
lea ecx, [esp + 0x14]
add eax, 0xfffffffc
push eax
lea eax, [esp + 0x64]
push eax
call fcn.00414320
mov byte [esp + 0x590], 0x11
lea ecx, [esp + 0x14]
push eax
call fcn.00416320
mov byte [esp + 0x590], 0xa
lea ecx, [esp + 0x60]
call fcn.00402750
push str..spl
lea ecx, [esp + 0x18]
call fcn.00443fd0
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
lea ecx, [edi + 0x30]
call fcn.00416320
mov dword [edi + 0x38], 1
mov edi, dword [esp + 0x14]
jmp 0x47d828
mov eax, dword [esp + 0x1c]
movdqu xmm0, xmmword [eax + 0x3c]
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0xd8]
push eax
movdqu xmmword [esp + 0xdc], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToSystemTime]
test eax, eax
je 0x47dafd
movzx eax, word [esp + 0xe2]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [esp + 0x4c]
addsd xmm0, qword [esp + 0x74]
movsd qword [esp + 0x74], xmm0
movdqa xmm0, xmmword [esp + 0xa4]
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0xe8]
movdqa xmmword [esp + 0xe8], xmm0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToSystemTime]
test eax, eax
je 0x47db4a
movzx eax, word [esp + 0xf2]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [esp + 0x4c]
addsd xmm0, qword [esp + 0x64]
movsd qword [esp + 0x64], xmm0
jmp 0x47db50
movsd xmm0, qword [esp + 0x64]
subsd xmm0, qword [esp + 0x74]
comisd xmm0, xmmword [esp + 0x8c]
jbe 0x47d828
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi - 0xc]
lea ecx, [esp + 0x14]
add eax, 0xfffffffc
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.00414320
mov byte [esp + 0x590], 0x12
lea ecx, [esp + 0x14]
push eax
call fcn.00416320
mov byte [esp + 0x590], 0xa
or ecx, 0xffffffff
mov edx, dword [esp + 0x28]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x47dbcb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str..spl
lea ecx, [esp + 0x18]
call fcn.00443fd0
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x47d828
call fcn.00402540
xor eax, eax
push 0x206
push eax
mov word [esp + 0x12c], ax
lea eax, [esp + 0x12e]
push eax
call fcn.00531bd0
mov ecx, dword [esp + 0x24]
add esp, 0xc
add ecx, 0x28
mov dword [esp + 0x28], ecx
mov eax, dword [ecx]
cmp dword [eax - 4], 1
jle 0x47dc2d
push dword [eax - 0xc]
call fcn.004024c0
mov ecx, dword [esp + 0x28]
push dword [ecx]
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xorps xmm0, xmm0
mov dword [esp + 0xf4], 0
movdqu xmmword [esp + 0xf8], xmm0
lea eax, [esp + 0x124]
mov word [esp + 0x110], 0
movq qword [esp + 0x108], xmm0
mov dword [esp + 0xfc], eax
xor eax, eax
push 0x206
push eax
mov word [esp + 0x37c], ax
lea eax, [esp + 0x37e]
push eax
mov dword [esp + 0x104], 2
call fcn.00531bd0
mov eax, dword [esp + 0x24]
add esp, 0xc
add eax, 0x2c
mov dword [esp + 0x2c], eax
mov ecx, dword [eax]
cmp dword [ecx - 4], 1
jle 0x47dcc1
push dword [ecx - 0xc]
mov ecx, eax
call fcn.004024c0
mov eax, dword [esp + 0x2c]
push dword [eax]
lea eax, [esp + 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push 0x80
push 3
lea eax, [esp + 0x380]
push 0
mov dword [esp + 0x110], eax
mov eax, 0x614
push 1
mov word [esp + 0x118], ax
lea eax, [esp + 0x138]
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x28], eax
cmp eax, 0xffffffff
jne 0x47dd24
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x47d8f0
mov ecx, dword [esp + 0x18]
push dword [esp + 0x2c]
lea ecx, [ecx + 0x34]
call fcn.00416320
lea eax, [esp + 0xf4]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x47d8f0