Function at 0x429d85
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Get disk information
Query environment variable

Disassembly:
push 0xa54
mov eax, 0x432298
call fcn.004148fb
mov dword [ebp - 0x950], ecx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x18], 8
lea esi, [ebx + 4]
jb 0x429daa
mov eax, dword [esi]
jmp 0x429dac
mov eax, esi
push eax
push ecx
call fcn.0041ebeb
test al, al
je 0x42a3c0
cmp dword [ebx + 0x18], 8
mov eax, dword [ebx + 0x14]
jb 0x429dc8
mov ecx, dword [esi]
jmp 0x429dca
mov ecx, esi
inc eax
push eax
lea eax, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x429e05
sub esp, 0x1c
mov ecx, esp
push 0x4047b0
call fcn.0040b41d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x429dff
movzx eax, ax
or eax, 0x80070000
push eax
call fcn.004150e1
lea edi, [ebp - 0x218]
xor edx, edx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, dx
jne 0x429e10
sub edi, ecx
sar edi, 1
je 0x42a3c0
cmp edi, dword [ebx + 0x14]
ja 0x42a377
cmp dword [ebx + 0x18], 8
jb 0x429e36
mov esi, dword [esi]
push edi
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x42a377
and dword [ebp - 0x688], eax
lea ecx, [ebp - 0x69c]
mov word [ebp - 0x698], ax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x684], 7
call fcn.0040b660
mov ecx, dword [ebp - 0x698]
xor edx, edx
inc edx
cmp dword [ebp - 0x684], 8
mov dword [ebp - 4], edx
jae 0x429e94
lea ecx, [ebp - 0x698]
mov eax, dword [ebp - 0x688]
push 0x5c
pop esi
cmp word [ecx + eax*2 - 2], si
je 0x429eb1
push esi
push edx
lea ecx, [ebp - 0x69c]
call fcn.004186eb
push 0x104
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
sub esp, 0x1c
mov esi, eax
mov ecx, esp
push 0x4047d8
call fcn.0040b41d
push esi
call fcn.004150e1
and dword [ebp - 0x94c], 0
lea eax, [ebp - 0x94c]
push eax
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x950]
call fcn.0041e9bd
sub esp, 0x1c
mov esi, eax
mov ecx, esp
push 0x404cec
call fcn.0040b41d
push esi
call fcn.004150e1
push dword [ebp - 0x94c]
lea ecx, [ebp - 0x664]
call fcn.0040b41d
cmp dword [ebp - 0x64c], 8
mov ecx, dword [ebp - 0x660]
mov byte [ebp - 4], 2
jae 0x429f42
lea ecx, [ebp - 0x660]
mov eax, dword [ebp - 0x650]
push 0x5c
pop edx
cmp word [ecx + eax*2 - 2], dx
je 0x429f60
push edx
push 1
lea ecx, [ebp - 0x664]
call fcn.004186eb
push 0xffffffffffffffff
push edi
xor eax, eax
mov dword [ebp - 0x630], 7
xor esi, esi
mov word [ebp - 0x644], ax
push ebx
lea ecx, [ebp - 0x648]
mov dword [ebp - 0x634], esi
call fcn.0040b6f9
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x648]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x664]
call fcn.0040dff4
push esi
push 1
lea ecx, [ebp - 0x648]
mov byte [ebp - 4], 2
call fcn.0040b613
cmp dword [ebp - 0x64c], 8
mov ecx, dword [ebp - 0x660]
jae 0x429fca
lea ecx, [ebp - 0x660]
mov eax, dword [ebp - 0x650]
push 0x5c
pop edx
cmp word [ecx + eax*2 - 2], dx
je 0x429fe8
push edx
push 1
lea ecx, [ebp - 0x664]
call fcn.004186eb
lea eax, [ebx + 0x1c]
push eax
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x680]
push eax
call fcn.0040e0d5
add esp, 0xc
cmp dword [ebp - 0x668], 8
mov eax, dword [ebp - 0x67c]
mov byte [ebp - 4], 4
jae 0x42a01b
lea eax, [ebp - 0x67c]
push 0x104
lea ecx, [ebp - 0x62c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x42a059
sub esp, 0x1c
mov ecx, esp
push 0x404d18
call fcn.0040b41d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42a053
movzx eax, ax
or eax, 0x80070000
push eax
call fcn.004150e1
lea eax, [ebp - 0x944]
push eax
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x42a347
lea eax, [ebp - 0x918]
push eax
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x6b8]
push eax
call fcn.0040e08c
add esp, 0xc
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x680]
mov byte [ebp - 4], 5
call fcn.0040b6f9
push 0
push 1
lea ecx, [ebp - 0x6b8]
mov byte [ebp - 4], 4
call fcn.0040b613
mov ecx, 0x404d4c
lea eax, [ebp - 0x918]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42a0ed
test dx, dx
je 0x42a0e9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42a0ed
add eax, 4
add ecx, 4
test dx, dx
jne 0x42a0c7
xor eax, eax
jmp 0x42a0f2
sbb eax, eax
or eax, 1
test eax, eax
je 0x42a32a
mov ecx, 0x404d50
lea eax, [ebp - 0x918]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42a12b
test dx, dx
je 0x42a127
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42a12b
add eax, 4
add ecx, 4
test dx, dx
jne 0x42a105
xor eax, eax
jmp 0x42a130
sbb eax, eax
or eax, 1
test eax, eax
je 0x42a32a
test byte [ebp - 0x944], 0x10
je 0x42a1fa
cmp byte [ebx + 0x38], 0
je 0x42a1fa
push ebx
lea ecx, [ebp - 0x648]
call fcn.0040b470
cmp dword [ebp - 0x630], 8
mov ecx, dword [ebp - 0x644]
mov byte [ebp - 4], 6
jae 0x42a174
lea ecx, [ebp - 0x644]
mov eax, dword [ebp - 0x634]
push 0x5c
pop edx
cmp word [ecx + eax*2 - 2], dx
je 0x42a192
push edx
push 1
lea ecx, [ebp - 0x648]
call fcn.004186eb
lea eax, [ebp - 0x918]
push eax
lea ecx, [ebp - 0x648]
call fcn.0040e12d
movzx eax, byte [ebx + 0x38]
lea ecx, [ebp - 0x6f4]
push eax
lea eax, [ebx + 0x1c]
push eax
lea eax, [ebp - 0x648]
push eax
call fcn.00417607
mov ecx, dword [ebp - 0x950]
lea eax, [ebp - 0x6f4]
push eax
mov byte [ebp - 4], 7
call fcn.00429d85
lea ecx, [ebp - 0x6f4]
add esi, eax
call fcn.004103e2
push 0
push 1
lea ecx, [ebp - 0x648]
mov byte [ebp - 4], 4
call fcn.0040b613
jmp 0x42a32a
push 1
push 3
lea ecx, [ebp - 0xa60]
call fcn.0040fb3a
lea eax, [ebp - 0x680]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0xa58]
push 0x404d58
push eax
call fcn.0040f341
pop ecx
pop ecx
push eax
call fcn.0040f49f
pop ecx
pop ecx
lea eax, [ebp - 0x648]
push eax
lea ecx, [ebp - 0xa54]
call fcn.004133d2
push 2
lea eax, [ebp - 0x648]
mov byte [ebp - 4], 9
push eax
call fcn.0041541f
push 0
push 1
lea ecx, [ebp - 0x648]
mov byte [ebp - 4], 8
call fcn.0040b613
cmp dword [ebp - 0x668], 8
mov eax, dword [ebp - 0x67c]
jae 0x42a27b
lea eax, [ebp - 0x67c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x42a31a
push 1
push 3
lea ecx, [ebp - 0x9d8]
call fcn.0040fb3a
mov byte [ebp - 4], 0xa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x404d78
lea eax, [ebp - 0x680]
push eax
lea eax, [ebp - 0x9d0]
push 0x404d9c
push eax
call fcn.0040f341
pop ecx
pop ecx
push eax
call fcn.0040f49f
pop ecx
pop ecx
push eax
call fcn.0040f341
pop ecx
pop ecx
mov ecx, eax
call fcn.0041d98e
lea eax, [ebp - 0x6b8]
push eax
lea ecx, [ebp - 0x9cc]
call fcn.004133d2
push 2
lea eax, [ebp - 0x6b8]
mov byte [ebp - 4], 0xb
push eax
call fcn.0041541f
push 0
push 1
lea ecx, [ebp - 0x6b8]
call fcn.0040b613
lea ecx, [ebp - 0x9d8]
call fcn.004109cb
jmp 0x42a31b
inc esi
lea ecx, [ebp - 0xa60]
mov byte [ebp - 4], 4
call fcn.004109cb
lea eax, [ebp - 0x944]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x42a078
push edi
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
xor ebx, ebx
lea ecx, [ebp - 0x680]
push ebx
push 1
call fcn.0040b613
push ebx
push 1
lea ecx, [ebp - 0x664]
call fcn.0040b613
push ebx
push 1
lea ecx, [ebp - 0x69c]
call fcn.0040b613
mov eax, esi
jmp 0x42a3c2
xor eax, eax
mov dword [ebp - 0x630], 7
xor ebx, ebx
mov word [ebp - 0x644], ax
push 0x404cb8
lea ecx, [ebp - 0x648]
mov dword [ebp - 0x634], ebx
call fcn.0040b660
push ebx
lea eax, [ebp - 0x648]
mov dword [ebp - 4], ebx
push eax
call fcn.0041541f
push ebx
push 1
lea ecx, [ebp - 0x648]
call fcn.0040b613
xor eax, eax
call fcn.004148aa
ret 4