Function at 0x410260
Capabilities:
Delete file
Enumerate files on windows
Move file

Disassembly:
push 0xffffffffffffffff
push 0x46dd28
mov eax, dword fs:[0]
push eax
sub esp, 0x4a8
mov eax, dword [0x498700]
xor eax, esp
mov dword [esp + 0x4a0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x498700]
xor eax, esp
push eax
lea eax, [esp + 0x4bc]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x4cc]
mov ebx, ecx
mov edi, edx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ebp
call fcn.0043ec5a
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4102cc
push 0x80004005
call fcn.004016d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x18], esi
mov dword [esp + 0x4c4], 0
call fcn.0043ec5a
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410301
push 0x80004005
call fcn.004016d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
push 0x4823ac
lea ecx, [esp + 0x44]
push ebx
push ecx
mov byte [esp + 0x4d0], 1
call fcn.00406360
mov eax, dword [eax]
add esp, 0xc
lea edx, [esp + 0x5c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
mov dword [esp + 0x44], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410360
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp ebx, 0xffffffff
jne 0x4103c0
mov byte [esp + 0x4c4], 0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41038c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov dword [esp + 0x4c4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4103b3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
jmp 0x4107e9
lea eax, [esp + 0x88]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4103d0
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x8c]
push ecx
lea ecx, [esp + 0x20]
call fcn.00401ca0
mov esi, dword [esp + 0x18]
mov ecx, 0x480fc4
mov eax, esi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x410426
test dx, dx
je 0x410422
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x410426
add eax, 4
add ecx, 4
test dx, dx
jne 0x410400
xor eax, eax
jmp 0x41042b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x41077d
mov ecx, 0x4823b4
mov eax, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x410466
test dx, dx
je 0x410462
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x410466
add eax, 4
add ecx, 4
test dx, dx
jne 0x410440
xor eax, eax
jmp 0x41046b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x41077d
test byte [esp + 0x5c], 0x10
je 0x410574
mov ebx, dword [edi + 8]
cmp dword [edi + 4], ebx
jbe 0x410490
call fcn.0044ec76
mov esi, dword [edi + 4]
cmp esi, dword [edi + 8]
jbe 0x41049d
call fcn.0044ec76
lea ecx, [esp + 0x18]
mov eax, esi
mov dword [esp + 0x2c], esi
call fcn.00412a70
mov esi, dword [edi + 8]
cmp dword [edi + 4], esi
mov ebx, eax
jbe 0x4104bf
call fcn.0044ec76
mov ebp, dword [esp + 0x1c]
test edi, edi
je 0x4104c7
cmp edi, edi
je 0x4104cc
call fcn.0044ec76
cmp ebx, esi
jne 0x41077d
call fcn.0043ec5a
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4102c2
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x18]
push ecx
push edx
lea eax, [esp + 0x58]
push eax
mov byte [esp + 0x4d0], 2
call fcn.004062a0
push eax
push 3
lea esi, [esp + 0x3c]
call fcn.00410190
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
add esp, 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410543
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4c4], 1
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41077d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41077d
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov ebx, dword [ebp + 8]
cmp dword [ebp + 4], ebx
mov edi, eax
mov dword [esp + 0x28], edi
jbe 0x41058e
call fcn.0044ec76
mov esi, dword [ebp + 4]
cmp esi, dword [ebp + 8]
jbe 0x41059b
call fcn.0044ec76
lea ecx, [esp + 0x28]
mov eax, esi
mov dword [esp + 0x58], esi
call fcn.00412a70
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov esi, dword [eax + 8]
cmp dword [eax + 4], esi
jbe 0x4105c1
call fcn.0044ec76
mov eax, dword [esp + 0x1c]
test ebp, ebp
je 0x4105c9
cmp ebp, eax
je 0x4105ce
call fcn.0044ec76
cmp ebx, esi
jne 0x410775
mov ecx, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x2b0]
push 0x104
push edx
call fcn.0044e1bb
add esp, 0xc
lea eax, [esp + 0x2ac]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea ecx, [esp + 0x2ac]
push ecx
lea ecx, [esp + 0x3c]
call fcn.004018b0
mov esi, dword [esp + 0x30]
push eax
lea edx, [esp + 0x4c]
push esi
push edx
mov byte [esp + 0x4d0], 3
call fcn.004062a0
push str..delete
push eax
lea eax, [esp + 0x60]
push eax
mov byte [esp + 0x4dc], 4
call fcn.00406360
push edi
push eax
lea ecx, [esp + 0x54]
mov bl, 5
push ecx
mov byte [esp + 0x4e8], bl
call fcn.00406360
add esp, 0x24
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c8], 6
call fcn.00409000
mov byte [esp + 0x4c4], bl
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x410690
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4c4], 4
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4106b8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4c4], 3
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4106e0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov bl, 1
mov byte [esp + 0x4c4], bl
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410709
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x40]
push esi
push edx
call fcn.004062a0
add esp, 0xc
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c8], 7
call fcn.00409000
mov byte [esp + 0x4c4], bl
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410755
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
push 9
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x41076e
push edi
jmp 0x41076f
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x1c]
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x5c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4103c0
mov byte [esp + 0x4c4], al
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4107bc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x4c4], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4107e7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [esp + 0x4bc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4a0]
xor ecx, esp
call fcn.0044de0c
add esp, 0x4b4
ret