Function at 0x4ad0cfaf
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [0x4ad33b78]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x470], edi
mov dword [ebp - 0x460], esi
mov dword [esi], 1
call dword [sym.imp.vmsvcrt.dll_wcslen]
mov ebx, eax
test ebx, ebx
pop ecx
je 0x4ad17a0a
lea eax, [ebx + 3]
cmp eax, 0x104
push edi
jg 0x4ad0d323
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.vmsvcrt.dll_wcscpy]
mov ax, word [edi + ebx*2 - 2]
cmp ax, 0x3a
pop ecx
pop ecx
je 0x4ad0d033
cmp ax, 0x5c
je 0x4ad0d033
lea eax, [ebp - 0x20c]
push 0x4ad0136c
push eax
call dword [sym.imp.vmsvcrt.dll_wcscat]
pop ecx
pop ecx
inc ebx
lea eax, [ebp - 0x20c]
push 0x4ad0c020
push eax
call dword [sym.imp.vmsvcrt.dll_wcscat]
pop ecx
pop ecx
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.vKERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x464], eax
je 0x4ad0d5cd
cmp dword [0x4ad2b9e8], 0
jne 0x4ad0d304
lea edi, [ebp - 0x228]
mov eax, edi
push eax
call dword [sym.imp.vmsvcrt.dll_wcslen]
test eax, eax
pop ecx
je 0x4ad0d4ec
add eax, ebx
cmp eax, 0x104
jge 0x4ad17b85
lea esi, [ebp + ebx*2 - 0x20c]
push edi
push esi
call dword [sym.imp.vmsvcrt.dll_wcscpy]
mov eax, dword [ebp - 0x45c]
mov edi, eax
and edi, 0x10
pop ecx
pop ecx
mov dword [ebp - 0x468], eax
jne 0x4ad0d501
test al, 1
jne 0x4ad17a59
test edi, edi
jne 0x4ad17a6f
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.vKERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4ad17a90
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x464]
call dword [sym.imp.vKERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4ad0d304
mov esi, dword [ebp - 0x460]
jmp 0x4ad0d06a
push dword [ebp - 0x464]
call dword [sym.imp.vKERNEL32.dll_FindClose]
cmp dword [0x4ad2b9e8], 0
jne 0x4ad17ba3
push dword [ebp - 0x470]
call fcn.4ad0d33c
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.4ad01305
leave
ret 8
lea edi, [ebp - 0x430]
mov eax, edi
push eax
call dword [sym.imp.vmsvcrt.dll_wcslen]
pop ecx
jmp 0x4ad0d08f
test ah, 4
jne 0x4ad0d0c4
mov esi, dword [sym.imp.vmsvcrt.dll_wcscmp]
lea eax, [ebp - 0x430]
push 0x4ad01a9c
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x4ad0d0e9
lea eax, [ebp - 0x430]
push 0x4ad01a94
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x4ad0d0e9
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad0cfaf
cmp dword [0x4ad2b9e8], 0
jne 0x4ad0d304
xor esi, esi
cmp eax, esi
je 0x4ad0d0e9
jmp 0x4ad17a14
push edi
jmp 0x4ad0d323
test edi, edi
je 0x4ad0d0d4
jmp 0x4ad0d0e9
mov eax, 0xa1
jmp 0x4ad0d328
cmp eax, 0x91
mov ecx, dword [ebp - 0x460]
mov dword [ecx], esi
jne 0x4ad17a2f
cmp dword [ebp - 0x46c], esi
je 0x4ad0d0e9
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x271b
call fcn.4ad05fb5
add esp, 0xc
push esi
call dword [sym.imp.vKERNEL32.dll_GetLastError]
push eax
call fcn.4ad05fb5
pop ecx
pop ecx
jmp 0x4ad0d0e9
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.vKERNEL32.dll_SetFileAttributesW]
jmp 0x4ad0d0cc
test byte [ebp - 0x467], 4
je 0x4ad0d5d3
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad0d33c
test eax, eax
je 0x4ad0d5d3
call dword [sym.imp.vKERNEL32.dll_GetLastError]
cmp eax, 0x4d3
je 0x4ad0d304
mov edi, dword [sym.imp.vmsvcrt.dll_wcslen]
lea eax, [ebp - 0x228]
push eax
call edi
test eax, eax
pop ecx
je 0x4ad17b3e
and word [esi], 0
lea eax, [ebp - 0x430]
push eax
call edi
add eax, ebx
cmp eax, 0x104
pop ecx
jb 0x4ad17afc
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.vmsvcrt.dll_wcscat]
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x271b
call fcn.4ad05fb5
add esp, 0x14
jmp 0x4ad17b54
mov edi, dword [sym.imp.vmsvcrt.dll_wcscat]
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x271b
call fcn.4ad05fb5
and word [esi], 0
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
add esp, 0x1c
jmp 0x4ad17b54
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x271b
call fcn.4ad05fb5
add esp, 0xc
push 0
call dword [sym.imp.vKERNEL32.dll_GetLastError]
push eax
call fcn.4ad05fb5
pop ecx
pop ecx
push dword [ebp - 0x468]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.vKERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp - 0x460]
and dword [eax], 0
jmp 0x4ad0d0e9
and dword [esi], 0
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x2724
call fcn.4ad05fb5
add esp, 0xc
jmp 0x4ad0d304
xor eax, eax
jmp 0x4ad0d328