Function at 0x415410
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f2046
mov eax, dword fs:[0]
push eax
sub esp, 0x2b4
mov eax, dword [0x6b7e40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x292], cl
push 0x63fb0c
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
mov byte [ebp - 0x298], 1
mov byte [ebp - 0x291], 0
call fcn.004204b0
push 0x63fb0c
lea ecx, [ebp + 8]
call fcn.0040f290
mov eax, dword [ebp + 8]
mov esi, dword [eax - 0xc]
cmp esi, 4
jl 0x415c6f
test esi, esi
js 0x4154a3
push 0x63eebc
push eax
call fcn.005bda07
mov ecx, eax
mov eax, dword [ebp + 8]
add esp, 8
test ecx, ecx
je 0x4154a3
sub ecx, eax
sar ecx, 1
jns 0x4154d2
cmp dword [eax - 0xc], 0
jl 0x415c6f
push 0x63e100
push eax
call fcn.005bda07
mov ecx, eax
mov eax, dword [ebp + 8]
add esp, 8
test ecx, ecx
je 0x415c6f
sub ecx, eax
sar ecx, 1
js 0x415c6f
sub esi, ecx
dec esi
push esi
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp + 8]
call fcn.00406670
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x2b0]
cmp dword [edi - 0xc], 0
je 0x41550d
push 0
xor dl, dl
lea ecx, [ebp - 0x2b0]
call fcn.0041a520
mov edi, dword [ebp - 0x2b0]
add esp, 4
mov dword [ebp - 0x3c], 0x63fb80
mov dword [ebp - 0x38], str.i386
mov dword [ebp - 0x34], str.Inetpub
mov dword [ebp - 0x30], str.Perl
mov dword [ebp - 0x2c], str.Program_Files
mov dword [ebp - 0x28], str.Program_Files__x86_
mov dword [ebp - 0x24], str.ProgramData
mov dword [ebp - 0x20], str.Windows
mov dword [ebp - 0x1c], str.Users
mov dword [ebp - 0x18], str.Config.msi
mov dword [ebp - 0x14], str.System_Volume_Information
xor esi, esi
lea esp, [esp]
mov ecx, dword [ebp + esi*4 - 0x3c]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x415599
push ecx
push edi
call fcn.005be8d5
add esp, 8
test eax, eax
je 0x415c36
inc esi
cmp esi, 0xb
jl 0x415560
call fcn.004a4516
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4155a3
push 0x80004005
call fcn.00402040
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2b8], eax
mov byte [ebp - 4], 2
call fcn.004a4516
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4155d3
push 0x80004005
call fcn.00402040
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x2a8], esi
push 1
push 0x63eebc
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
call fcn.00404910
push 0x63f828
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2ac]
push eax
call fcn.004067b0
add esp, 0xc
push eax
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 4
call fcn.00404570
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x2ac]
add edx, 0xfffffff0
or eax, 0xffffffff
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x415642
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x2b8]
lea eax, [ebp - 0x28c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2ac], eax
cmp eax, 0xffffffff
jne 0x4156d7
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x415681
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [ebx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41569e
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edi + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4156bb
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jmp 0x415c82
test eax, eax
je 0x415a4a
nop
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2c0]
push eax
call fcn.004067b0
add esp, 0xc
mov byte [ebp - 4], 5
mov eax, dword [eax]
lea ecx, [esi - 0x10]
lea edx, [eax - 0x10]
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x290], ecx
cmp edx, ecx
je 0x41577a
cmp dword [ecx + 0xc], 0
lea esi, [ecx + 0xc]
jl 0x415765
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x41575f
push edx
call fcn.004046f0
add esp, 4
mov dword [ebp - 0x2a0], eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x415754
mov esi, dword [ebp - 0x290]
push esi
mov ecx, dword [esi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x2a0]
lea esi, [eax + 0x10]
mov dword [ebp - 0x2a8], esi
jmp 0x41577a
mov eax, dword [ebp - 0x2a0]
push dword [eax - 0xc]
lea ecx, [ebp - 0x2a8]
push eax
call fcn.00402090
mov esi, dword [ebp - 0x2a8]
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x2c0]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41579e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
lea eax, [esi - 0x10]
cmp dword [eax + 0xc], 0
lea edx, [eax + 0xc]
jl 0x4157c9
cmp ecx, dword [eax]
jne 0x4157c9
mov dword [ebp - 0x290], eax
mov eax, 1
lock xadd dword [edx], eax
jmp 0x415806
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov dword [ebp - 0x290], eax
test eax, eax
je 0x415b94
mov ecx, dword [esi - 0xc]
mov dword [eax + 4], ecx
mov edx, dword [esi - 0xc]
lea ecx, [eax + 0x10]
lea eax, [edx*2 + 2]
push eax
push esi
lea eax, [edx*2 + 2]
push eax
push ecx
call fcn.005bc17a
add esp, 0x10
mov eax, dword [ebp - 0x290]
add eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41582f
and eax, 0xfffffffe
push eax
mov eax, dword [ebp - 0x290]
add eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [ebp - 0x290]
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41584c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x28c]
test al, 0x10
jne 0x415873
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb al, al
and byte [ebp - 0x298], al
mov dword [ebp - 4], 3
jmp 0x415a29
test al, 4
je 0x415958
push 0x63bfdc
lea ecx, [ebp - 0x2bc]
call fcn.004021e0
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x2b4]
push str.ERROR:_ATTEMPT_TO_DELETE_SYSTEM_SUBFOLDER:
push eax
mov byte [ebp - 4], 0xb
call fcn.00404060
mov dword [ebp - 0x290], eax
xor ecx, ecx
call fcn.004051a0
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x2bc]
add esp, 8
add ecx, 0xfffffff0
mov dword [ebp - 0x2a0], esp
push ecx
call fcn.004046f0
mov ecx, dword [ebp - 0x2a0]
add esp, 4
add eax, 0x10
push 0
push 0
push dword [ebp - 0x290]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x2a4]
push 0x663
push str.C:_amintegration_tools_setupishield_sldim_baseUtilities.cpp
push 1
push 1
call fcn.004055a0
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x2bc]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41592b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x2b4]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x415a29
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x415a29
mov ecx, 0x63a554
lea eax, [ebp - 0x260]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x415989
test dx, dx
je 0x415985
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x415989
add eax, 4
add ecx, 4
test dx, dx
jne 0x415963
xor eax, eax
jmp 0x41598e
sbb eax, eax
or eax, 1
test eax, eax
je 0x415a29
mov ecx, 0x63d07c
lea eax, [ebp - 0x260]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4159c7
test dx, dx
je 0x4159c3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4159c7
add eax, 4
add ecx, 4
test dx, dx
jne 0x4159a1
xor eax, eax
jmp 0x4159cc
sbb eax, eax
or eax, 1
test eax, eax
je 0x415a29
cmp byte [ebp - 0x292], 0
mov byte [ebp - 0x291], 1
jne 0x415a29
push ecx
lea eax, [esi - 0x10]
mov dword [ebp - 0x2a4], esp
push eax
mov byte [ebp - 0x299], 0
call fcn.004046f0
mov edx, dword [ebp - 0x2a4]
mov cl, byte [ebp - 0x299]
add eax, 0x10
add esp, 4
mov dword [edx], eax
call fcn.00415410
mov ecx, dword [ebp - 0x298]
movzx ecx, cl
xor edx, edx
add esp, 4
test al, al
cmove ecx, edx
mov dword [ebp - 0x298], ecx
lea eax, [ebp - 0x28c]
push eax
push dword [ebp - 0x2ac]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4156e0
mov eax, dword [ebp - 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
call fcn.004046f0
add esp, 4
add eax, 0x10
push eax
mov dword [ebp - 0x290], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x415a86
and eax, 0xfffffffe
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [ebp - 0x290]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x415aa6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.WindowsTemp
push edi
call fcn.005be8d5
add esp, 8
test eax, eax
je 0x415bb3
cmp byte [ebp - 0x292], 0
je 0x415ad2
cmp byte [ebp - 0x291], 0
jne 0x415bb3
lea eax, [ebp - 0x34]
push eax
xorps xmm0, xmm0
push 0
push dword [ebp + 8]
movq qword [ebp - 0x34], xmm0
movq qword [ebp - 0x2c], xmm0
movq qword [ebp - 0x24], xmm0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x415b99
test byte [ebp - 0x34], 4
je 0x415b99
push ecx
mov ecx, esp
mov dword [ebp - 0x2a4], esp
push 0x63bfdc
call fcn.004021e0
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2b4]
push str.ERROR:_ATTEMPT_TO_DELETE_SYSTEM_FOLDER:
push eax
mov byte [ebp - 4], 0xf
call fcn.00404060
add esp, 0xc
mov byte [ebp - 4], 0x10
push 0
push eax
push 0x68d
push str.C:_amintegration_tools_setupishield_sldim_baseUtilities.cpp
push 1
push 1
xor ecx, ecx
call fcn.004051a0
mov ecx, eax
mov byte [ebp - 4], 0x11
call fcn.004022e0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x2b4]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x415b8b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 0x298], 0
jmp 0x415bb3
call fcn.00401f40
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb al, al
and byte [ebp - 0x298], al
mov dword [ebp - 4], 3
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x415bd3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [ebx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x415bf0
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edi + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x415c0d
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp + 8]
add edi, 0xfffffff0
lea eax, [edi + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x415c2e
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, byte [ebp - 0x298]
jmp 0x415c8e
add edi, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [edi + 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x415c56
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jmp 0x415c82
lea edx, [eax - 0x10]
or ecx, 0xffffffff
lea eax, [edx + 0xc]
mov dword [ebp - 4], ecx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x415c8c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005bc16b
mov esp, ebp
pop ebp
ret