Function at 0x4b8340
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
sub esp, 0xab4
mov ax, word [0x559900]
push ebp
push esi
mov esi, dword [esp + 0xac0]
push edi
mov word [esp + 0x6b0], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x6b2]
mov ebp, dword [sym.imp.MSVCRT.dll__snwprintf]
rep stosd dword es:[edi], eax
push 0x555d6c
push esi
push 0x528910
lea ecx, [esp + 0x6bc]
push 0x103
push ecx
mov dword [esp + 0x20], 1
stosw word es:[edi], ax
call ebp
add esp, 0x14
lea edx, [esp + 0x258]
lea eax, [esp + 0x6b0]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x4b83c6
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xab4
ret
mov eax, dword [esp + 0xad0]
push ebx
mov ebx, dword [esp + 0xacc]
test eax, eax
je 0x4b83f3
test ebx, ebx
je 0x4b83e2
cmp ebx, 1
jne 0x4b83f3
mov ecx, dword [esp + 0xad0]
push ecx
push esi
call fcn.004b8220
add esp, 8
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x4ae]
mov word [esp + 0x4ac], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x5d6c4c]
mov ecx, 0x32
inc eax
mov dword [0x5d6c4c], eax
cdq
idiv ecx
test edx, edx
jne 0x4b847e
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
xor esi, esi
push 1
push esi
push esi
lea edx, [esp + 0x44]
push esi
push edx
call edi
test eax, eax
je 0x4b847e
cmp dword [esp + 0x3c], 0x12
jne 0x4b844a
mov esi, 1
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0
push 0
lea edx, [esp + 0x44]
push 0
push edx
call edi
test eax, eax
jne 0x4b843e
test esi, esi
je 0x4b847e
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov esi, dword [sym.imp.MSVCRT.dll_wcscmp]
lea eax, [esp + 0x288]
push 0x528618
push eax
call esi
add esp, 8
test eax, eax
je 0x4b862f
lea ecx, [esp + 0x288]
push 0x53bf60
push ecx
call esi
add esp, 8
test eax, eax
je 0x4b862f
test byte [esp + 0x25c], 0x10
je 0x4b852d
mov dx, word [0x559900]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x8be]
mov word [esp + 0x8bc], dx
lea edx, [esp + 0x8bc]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xac8]
stosw word es:[edi], ax
lea eax, [esp + 0x288]
push eax
push ecx
push str._s_s_
push 0x103
push edx
call ebp
mov eax, dword [esp + 0xae8]
mov ecx, dword [esp + 0xae4]
push eax
push ecx
lea edx, [esp + 0x8d8]
push ebx
push edx
call fcn.004b8340
add esp, 0x24
jmp 0x4b862b
mov ax, word [0x559900]
mov edx, dword [esp + 0xac8]
mov word [esp + 0x54], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x56]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x288]
push ecx
push edx
stosw word es:[edi], ax
push 0x528910
lea eax, [esp + 0x60]
push 0x103
push eax
call ebp
xor edx, edx
add esp, 0x14
cmp ebx, edx
je 0x4b857a
cmp ebx, 1
jne 0x4b862f
cmp dword [esp + 0xad0], edx
je 0x4b85d8
lea ecx, [esp + 0x54]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov esi, eax
mov ecx, 0x82
push esi
xor eax, eax
lea edi, [esp + 0x4b0]
push str._s
lea edx, [esp + 0x4b4]
push 0x103
rep stosd dword es:[edi], eax
push edx
call ebp
add esp, 0x10
test esi, esi
je 0x4b862f
mov eax, dword [esp + 0xad0]
lea ecx, [esp + 0x4ac]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x4b862f
xor edx, edx
cmp dword [esp + 0xad4], edx
je 0x4b8620
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x2e], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x32], edx
lea eax, [esp + 0x18]
lea edx, [esp + 0x54]
push eax
mov dword [esp + 0x20], 3
mov dword [esp + 0x24], edx
mov word [esp + 0x2c], 0x454
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
jmp 0x4b862b
lea ecx, [esp + 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x25c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4b840f
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
je 0x4b865e
cmp ebx, 2
jne 0x4b8684
mov esi, dword [esp + 0xac8]
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 0xad4]
test eax, eax
jne 0x4b8684
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0xab4
ret