Function at 0x40aa30
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x45ffa0
push 0x42b640
mov eax, dword fs:[0]
push eax
sub esp, 0x674
mov eax, dword [0x463188]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
push 0x208
push 0
lea eax, [ebp - 0x42c]
push eax
call fcn.0042c0e0
push 0x208
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.0042c0e0
push 0x250
push 0
lea eax, [ebp - 0x67c]
push eax
call fcn.0042c0e0
add esp, 0x24
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40aab0
sub ecx, edx
sar ecx, 1
lea eax, [ebp - 0x224]
cmp ecx, 0x104
jae 0x40aade
push esi
push 0x104
push eax
call fcn.00437bdd
add esp, 0xc
jmp 0x40aaf8
push 0x103
push esi
push 0x104
push eax
call fcn.004379ef
add esp, 0x10
xor eax, eax
mov word [ebp - 0x1e], ax
lea esi, [ebp - 0x224]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40ab01
sub esi, ecx
sar esi, 1
mov edi, esi
jne 0x40ab1c
lea edi, [ebp - 0x224]
jmp 0x40ab54
dec esi
mov eax, 0x5c
cmp ax, word [ebp + esi*2 - 0x224]
je 0x40ab4b
push 0x45b22c
push 0x104
lea eax, [ebp - 0x224]
push eax
call fcn.00437b68
add esp, 0xc
test eax, eax
jne 0x40ab4b
mov esi, edi
lea edi, [ebp - 0x224]
lea edi, [edi + esi*2]
mov dword [ebp - 0x680], edi
lea ecx, [ebp - 0x224]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ab63
sub ecx, edx
sar ecx, 1
lea eax, [ebp - 0x224]
cmp ecx, 0x104
jae 0x40ab97
push eax
push 0x104
lea eax, [ebp - 0x42c]
push eax
call fcn.00437bdd
add esp, 0xc
jmp 0x40abba
push 0x103
push eax
push 0x104
lea eax, [ebp - 0x42c]
push eax
call fcn.004379ef
add esp, 0x10
xor eax, eax
mov word [ebp - 0x226], ax
push 0x45bdc4
mov edx, 0x104
lea ecx, [ebp - 0x42c]
call fcn.0040aed0
add esp, 4
lea eax, [ebp - 0x67c]
push eax
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x684], esi
cmp esi, 0xffffffff
je 0x40ad5a
test dword [ebp - 0x67c], 0x10
jne 0x40ac82
lea eax, [ebp - 0x650]
push eax
mov edx, 0x104
lea ecx, [ebp - 0x224]
call fcn.0040aed0
add esp, 4
test bl, bl
je 0x40ac3a
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
je 0x40ad2f
mov dword [ebp - 4], 0
push 4
push 0
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 4], 0xfffffffe
jmp 0x40ad2f
cmp byte [ebp + 8], 0
je 0x40ad35
mov ecx, 0x45bdcc
lea eax, [ebp - 0x650]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40acbd
test dx, dx
je 0x40acb9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40acbd
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ac97
xor eax, eax
jmp 0x40acc2
sbb eax, eax
or eax, 1
test eax, eax
je 0x40ad35
mov ecx, 0x45bdd0
lea eax, [ebp - 0x650]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40acf7
test dx, dx
je 0x40acf3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40acf7
add eax, 4
add ecx, 4
test dx, dx
jne 0x40acd1
xor eax, eax
jmp 0x40acfc
sbb eax, eax
or eax, 1
test eax, eax
je 0x40ad35
lea eax, [ebp - 0x650]
push eax
mov edx, 0x104
lea ecx, [ebp - 0x224]
call fcn.0040aed0
push 0x45bdc4
push ebx
push 1
mov dl, 1
lea ecx, [ebp - 0x224]
call fcn.0040aa30
add esp, 0x10
xor eax, eax
mov word [edi + 2], ax
lea eax, [ebp - 0x67c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40abf1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
or esi, 0xffffffff
jmp 0x40abeb
xor eax, eax
mov word [edi], ax
test bl, bl
je 0x40ad75
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp eax, 1
je 0x40ad9f
mov dword [ebp - 4], 1
push 4
push 0
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x40ad98
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004299ea
mov esp, ebp
pop ebp
ret