Function at 0x409fe4
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x350
push ebx
push esi
or ebx, 0xffffffff
push edi
mov edi, dword [ebp + 8]
mov ecx, ebx
xor eax, eax
lea edx, [ebp - 0x210]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [ebp - 0x210]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40be90
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebx
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x10c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x10c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40b630
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebx
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x350]
mov ecx, edx
push eax
and ecx, 3
lea eax, [ebp - 0x210]
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x40a1f8
lea edi, [ebp - 0x10c]
mov ecx, ebx
xor eax, eax
lea edx, [ebp - 0x210]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 1], 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x350]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
je 0x40a1bf
lea eax, [ebp - 0x324]
push eax
call fcn.00409f70
test eax, eax
pop ecx
jne 0x40a1ce
lea edi, [ebp - 0x324]
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x10c]
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebx
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
test byte [ebp - 0x350], 0x10
rep movsb byte es:[edi], byte [esi]
je 0x40a191
lea eax, [ebp - 0x10c]
push eax
call fcn.00409fe4
test eax, eax
pop ecx
je 0x40a1ef
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
lea edi, [ebp - 0x210]
mov ecx, ebx
xor eax, eax
lea edx, [ebp - 0x10c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x40a1ce
test byte [ebp - 0x350], 1
je 0x40a1ac
lea eax, [ebp - 0x10c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
je 0x40a1ef
jmp 0x40a167
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x12
jne 0x40a1ef
and byte [ebp - 1], 0
cmp byte [ebp - 1], 0
jne 0x40a0e2
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor eax, eax
jmp 0x40a1ea