Function at 0x46ea70
Capabilities:
Check os version
Delete file
Enumerate files on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5f7b89
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x70b744]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70b744]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
mov ebp, 0xf
xor edi, edi
mov dword [esp + 0xdc], ebp
mov dword [esp + 0xd8], edi
mov byte [esp + 0xc8], 0
mov dword [esp + 0x248], edi
mov dword [esp + 0x88], ebp
mov dword [esp + 0x84], edi
mov byte [esp + 0x74], 0
mov byte [esp + 0x248], 1
push 5
push str..mdmp
lea ecx, [esp + 0x94]
mov dword [esp + 0xac], ebp
mov dword [esp + 0xa8], edi
mov byte [esp + 0x98], 0
call fcn.00410a89
push 0xffffffffffffffff
mov byte [esp + 0x24c], 2
push edi
push 0x70f9f0
lea ecx, [esp + 0xb4]
mov dword [esp + 0xcc], ebp
mov dword [esp + 0xc8], edi
mov byte [esp + 0xb8], 0
call fcn.0040f845
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
push 1
push 0xffffffffffffffff
lea eax, [esp + 0x2c]
mov byte [esp + 0x250], 4
push eax
lea ecx, [esp + 0xb4]
mov byte [esp + 0x30], 0x5c
call fcn.0046fe40
cmp eax, 0xffffffff
jne 0x46ec1b
mov esi, 0x10
cmp dword [esp + 0xc0], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
jb 0x46eba6
mov ecx, dword [esp + 0xac]
push ecx
call fcn.0051d492
add esp, 4
cmp dword [esp + 0xa4], esi
mov dword [esp + 0xc0], ebp
mov dword [esp + 0xbc], edi
mov byte [esp + 0xac], 0
jb 0x46ebd5
mov edx, dword [esp + 0x90]
push edx
call fcn.0051d492
add esp, 4
cmp dword [esp + 0x88], esi
mov dword [esp + 0xa4], ebp
mov dword [esp + 0xa0], edi
mov byte [esp + 0x90], 0
jb 0x46ec01
mov eax, dword [esp + 0x74]
push eax
call fcn.0051d492
add esp, 4
cmp dword [esp + 0xdc], esi
mov dword [esp + 0x88], ebp
mov dword [esp + 0x84], edi
jmp 0x46f53a
push eax
push edi
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 0xb4]
call fcn.0043fee7
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0xb4]
mov byte [esp + 0x254], 5
call fcn.0040f845
mov ebx, 0x10
mov byte [esp + 0x248], 4
cmp dword [esp + 0x54], ebx
jb 0x46ec66
mov eax, dword [esp + 0x40]
push eax
call fcn.0051d492
add esp, 4
push 1
push 0x6b031c
lea ecx, [esp + 0xb0]
call fcn.0040fae8
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0xb0]
push ecx
lea ecx, [esp + 0x7c]
call fcn.0040f845
push 1
push 0x69efc4
lea ecx, [esp + 0x78]
call fcn.0040fae8
cmp dword [esp + 0x88], ebx
mov eax, dword [esp + 0x74]
jae 0x46ecae
lea eax, [esp + 0x74]
lea edx, [esp + 0xfc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x30], esi
jne 0x46ed76
lea esi, [esp + 0x14]
call fcn.0046fb30
cmp dword [esp + 0xc0], ebx
jb 0x46ecee
mov eax, dword [esp + 0xac]
push eax
call fcn.0051d492
add esp, 4
cmp dword [esp + 0xa4], ebx
mov dword [esp + 0xc0], ebp
mov dword [esp + 0xbc], edi
mov byte [esp + 0xac], 0
jb 0x46ed1d
mov ecx, dword [esp + 0x90]
push ecx
call fcn.0051d492
add esp, 4
cmp dword [esp + 0x88], ebx
mov dword [esp + 0xa4], ebp
mov dword [esp + 0xa0], edi
mov byte [esp + 0x90], 0
jb 0x46ed49
mov edx, dword [esp + 0x74]
push edx
call fcn.0051d492
add esp, 4
cmp dword [esp + 0xdc], ebx
mov dword [esp + 0x88], ebp
mov dword [esp + 0x84], edi
mov byte [esp + 0x74], 0
jb 0x46f551
mov eax, dword [esp + 0xc8]
push eax
jmp 0x46f549
lea ecx, [esp + 0xfc]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x46f0cc
lea ecx, [ecx]
lea eax, [esp + 0x128]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x46eda0
sub eax, edx
push eax
lea edx, [esp + 0x12c]
push edx
lea ecx, [esp + 0xcc]
call fcn.00410a89
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xa0]
cmp eax, ecx
jbe 0x46f0a5
sub eax, ecx
push 0xffffffffffffffff
sub eax, 1
push eax
lea eax, [esp + 0xe8]
push eax
lea ecx, [esp + 0xd0]
call fcn.0043fee7
mov byte [esp + 0x248], 6
mov ecx, dword [esp + 0xd8]
sub ecx, dword [esp + 0xa0]
push 0xffffffffffffffff
push ecx
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 0xd0]
call fcn.0043fee7
mov byte [esp + 0x248], 7
mov ecx, dword [esp + 0x90]
mov esi, 0x10
cmp dword [esp + 0xa4], esi
jae 0x46ee40
lea ecx, [esp + 0x90]
mov edx, dword [esp + 0xa0]
push edx
push ecx
mov ecx, dword [eax + 0x14]
push ecx
push 0
mov ecx, eax
call fcn.004235bd
test eax, eax
sete bl
mov byte [esp + 0x248], 6
cmp dword [esp + 0x54], esi
jb 0x46ee76
mov edx, dword [esp + 0x40]
push edx
call fcn.0051d492
add esp, 4
test bl, bl
je 0x46f083
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x46f1be
lea ecx, [esp + 0x34]
lea esi, [esp + 0x28]
call fcn.0046e920
mov ecx, dword [esp + 0x18]
test ecx, ecx
mov esi, dword [esp + 0x1c]
je 0x46eedd
mov edx, esi
sub edx, ecx
mov eax, 0x38e38e39
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0xa
jb 0x46eedd
lea edi, [esp + 0x14]
call fcn.0046fc30
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ebp, dword [esp + 0x2c]
xor edi, edi
xor ebx, ebx
test ecx, ecx
jne 0x46eeed
xor eax, eax
jmp 0x46ef02
mov edx, esi
sub edx, ecx
mov eax, 0x38e38e39
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
ja 0x46f083
test ecx, ecx
jne 0x46ef12
xor eax, eax
jmp 0x46ef27
mov edx, esi
sub edx, ecx
mov eax, 0x38e38e39
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
je 0x46ef77
test ecx, ecx
je 0x46ef48
mov edx, esi
sub edx, ecx
mov eax, 0x38e38e39
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x46ef55
call fcn.0051e314
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + ebx + 4]
cmp edx, ebp
jl 0x46efe8
jg 0x46ef6c
mov eax, dword [ecx + ebx]
cmp eax, dword [esp + 0x28]
jb 0x46efe8
add edi, 1
add ebx, 0x24
jmp 0x46eee5
test ecx, ecx
je 0x46ef97
sub esi, ecx
mov eax, 0x38e38e39
imul esi
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0xa
jae 0x46f083
mov ecx, dword [esp + 0x28]
push 0xffffffffffffffff
push 0
lea edx, [esp + 0xcc]
mov dword [esp + 0x44], ecx
push edx
lea ecx, [esp + 0x50]
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], 0
mov byte [esp + 0x54], 0
call fcn.0040f845
lea eax, [esp + 0x3c]
push eax
lea esi, [esp + 0x18]
mov byte [esp + 0x24c], 8
call fcn.0046fb90
jmp 0x46f06f
mov edx, dword [esp + 0x28]
push 0xffffffffffffffff
push 0
lea eax, [esp + 0xcc]
push eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], 0
mov byte [esp + 0x54], 0
call fcn.0040f845
mov byte [esp + 0x248], 9
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x1c]
mov esi, eax
jbe 0x46f03b
call fcn.0051e314
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
mov ebx, ecx
lea ecx, [edi + edi*8]
mov dword [esp + 0x64], esi
lea esi, [esi + ecx*4]
cmp esi, dword [esp + 0x1c]
ja 0x46f055
cmp esi, eax
jae 0x46f05a
call fcn.0051e314
push esi
push ebx
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x24]
call fcn.0046fc70
cmp dword [esp + 0x5c], 0x10
jb 0x46f083
mov ecx, dword [esp + 0x48]
push ecx
call fcn.0051d492
add esp, 4
mov byte [esp + 0x248], 4
cmp dword [esp + 0xf8], 0x10
jb 0x46f0a5
mov edx, dword [esp + 0xe4]
push edx
call fcn.0051d492
add esp, 4
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0xfc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x46ed90
mov esi, dword [esp + 0x30]
lea ebp, [eax + 0xf]
xor edi, edi
lea ebx, [eax + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x88], ebx
mov eax, dword [esp + 0x74]
jae 0x46f0e4
lea eax, [esp + 0x74]
lea edx, [esp + 0xfc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x30], eax
jne 0x46f1c8
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x46f124
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
push ecx
push edx
call fcn.004724e0
mov eax, dword [esp + 0x20]
push eax
call fcn.0051d492
add esp, 0xc
cmp dword [esp + 0xc0], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
jb 0x46f149
mov ecx, dword [esp + 0xac]
push ecx
call fcn.0051d492
add esp, 4
cmp dword [esp + 0xa4], ebx
mov dword [esp + 0xc0], ebp
mov dword [esp + 0xbc], edi
mov byte [esp + 0xac], 0
jb 0x46f178
mov edx, dword [esp + 0x90]
push edx
call fcn.0051d492
add esp, 4
cmp dword [esp + 0x88], ebx
mov dword [esp + 0xa4], ebp
mov dword [esp + 0xa0], edi
mov byte [esp + 0x90], 0
jb 0x46f1a4
mov eax, dword [esp + 0x74]
push eax
call fcn.0051d492
add esp, 4
cmp dword [esp + 0xdc], ebx
mov dword [esp + 0x88], ebp
mov dword [esp + 0x84], edi
jmp 0x46f53a
push 0x80070057
call fcn.00410b80
lea edx, [esp + 0xfc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x46f46a
nop
lea eax, [esp + 0x128]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x46f1f0
sub eax, edx
push eax
lea eax, [esp + 0x12c]
push eax
lea ecx, [esp + 0xcc]
call fcn.00410a89
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xa0]
cmp eax, ecx
jbe 0x46f44f
sub eax, ecx
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xe8]
push ecx
lea ecx, [esp + 0xd0]
call fcn.0043fee7
mov byte [esp + 0x248], 0xa
mov ecx, dword [esp + 0x90]
mov esi, 0x10
cmp dword [esp + 0xa4], esi
jae 0x46f263
lea ecx, [esp + 0x90]
mov edx, dword [esp + 0xa0]
push edx
push ecx
mov ecx, dword [eax + 0x14]
push ecx
push 0
mov ecx, eax
call fcn.004235bd
test eax, eax
sete bl
mov byte [esp + 0x248], 4
cmp dword [esp + 0xf8], esi
jb 0x46f29f
mov edx, dword [esp + 0xe4]
push edx
call fcn.0051d492
add esp, 4
test bl, bl
je 0x46f44f
mov edi, dword [esp + 0x18]
xor ebp, ebp
mov dword [esp + 0x34], ebp
test edi, edi
mov dword [esp + 0x28], ebp
je 0x46f3cc
mov ecx, dword [esp + 0x1c]
sub ecx, edi
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x34], eax
jae 0x46f3c8
mov ebx, dword [edi + ebp + 0x1c]
mov edx, 0x10
cmp dword [edi + ebp + 0x20], edx
jb 0x46f2f3
mov ecx, dword [edi + ebp + 0xc]
jmp 0x46f2f7
lea ecx, [edi + ebp + 0xc]
mov eax, dword [esp + 0xd8]
cmp eax, ebx
jb 0x46f304
mov eax, ebx
cmp dword [esp + 0xdc], edx
mov esi, dword [esp + 0xc8]
jae 0x46f31b
lea esi, [esp + 0xc8]
cmp eax, 4
jb 0x46f334
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x46f338
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x46f320
test eax, eax
je 0x46f39d
movzx ebp, byte [ecx]
movzx edx, byte [esi]
sub edx, ebp
jne 0x46f387
sub eax, 1
add ecx, 1
add esi, 1
test eax, eax
je 0x46f399
movzx ebp, byte [ecx]
movzx edx, byte [esi]
sub edx, ebp
jne 0x46f387
sub eax, 1
add ecx, 1
add esi, 1
test eax, eax
je 0x46f399
movzx ebp, byte [ecx]
movzx edx, byte [esi]
sub edx, ebp
jne 0x46f387
sub eax, 1
add ecx, 1
add esi, 1
test eax, eax
je 0x46f399
movzx eax, byte [ecx]
movzx edx, byte [esi]
sub edx, eax
je 0x46f399
test edx, edx
mov ebp, dword [esp + 0x28]
mov eax, 1
jg 0x46f39f
or eax, 0xffffffff
jmp 0x46f39f
mov ebp, dword [esp + 0x28]
xor eax, eax
test eax, eax
jne 0x46f3bb
mov eax, dword [esp + 0xd8]
cmp eax, ebx
jb 0x46f3bb
xor ecx, ecx
cmp eax, ebx
setne cl
mov eax, ecx
test eax, eax
je 0x46f3c8
add dword [esp + 0x34], 1
add ebp, 0x24
jmp 0x46f2b1
test edi, edi
jne 0x46f3d0
xor eax, eax
jmp 0x46f3e7
mov ecx, dword [esp + 0x1c]
sub ecx, edi
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x34], eax
jne 0x46f44f
push 0xffffffffffffffff
push 0
lea edx, [esp + 0xb0]
push edx
lea ecx, [esp + 0x7c]
call fcn.0040f845
cmp dword [esp + 0xdc], 0x10
mov edx, dword [esp + 0xc8]
jae 0x46f41a
lea edx, [esp + 0xc8]
mov eax, edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x46f420
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x78]
call fcn.0040fae8
cmp dword [esp + 0x88], 0x10
mov eax, dword [esp + 0x74]
jae 0x46f448
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0xfc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x46f1e0
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x18]
xor esi, esi
cmp eax, esi
je 0x46f49b
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
push ecx
push edx
call fcn.004724e0
mov eax, dword [esp + 0x20]
push eax
call fcn.0051d492
add esp, 0xc
mov edi, 0x10
cmp dword [esp + 0xc0], edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
jb 0x46f4c5
mov ecx, dword [esp + 0xac]
push ecx
call fcn.0051d492
add esp, 4
cmp dword [esp + 0xa4], edi
mov ebx, 0xf
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xbc], esi
mov byte [esp + 0xac], 0
jb 0x46f4f9
mov edx, dword [esp + 0x90]
push edx
call fcn.0051d492
add esp, 4
cmp dword [esp + 0x88], edi
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa0], esi
mov byte [esp + 0x90], 0
jb 0x46f525
mov eax, dword [esp + 0x74]
push eax
call fcn.0051d492
add esp, 4
cmp dword [esp + 0xdc], edi
mov dword [esp + 0x88], ebx
mov dword [esp + 0x84], esi
mov byte [esp + 0x74], 0
jb 0x46f551
mov ecx, dword [esp + 0xc8]
push ecx
call fcn.0051d492
add esp, 4
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.0051d721
add esp, 0x238
ret