Function at 0x4207e0
Capabilities:
Delete directory
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x4500d6
mov eax, dword fs:[0]
push eax
sub esp, 0x920
mov eax, dword [0x463070]
xor eax, esp
mov dword [esp + 0x91c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x463070]
xor eax, esp
push eax
lea eax, [esp + 0x934]
mov dword fs:[0], eax
mov edi, dword [esp + 0x944]
xor ebx, ebx
cmp edi, ebx
je 0x420ae2
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x420831
sub eax, edx
sar eax, 1
je 0x420ae2
mov eax, 0x5c
mov word [esp + 0x474], ax
mov dword [esp + 0x478], ebx
mov dword [esp + 0x47c], ebx
push 0x18e
lea edx, [esp + 0x7a6]
xor ecx, ecx
push ebx
mov dword [esp + 0x944], ebx
push edx
mov word [esp + 0x7ac], cx
call fcn.00437380
push edi
push str._s.
lea eax, [esp + 0x7b4]
push 0x190
push eax
call fcn.00421740
add esp, 0x1c
lea eax, [esp + 0x7a0]
lea esi, [esp + 0x1c]
call fcn.00421630
test eax, eax
je 0x420a93
jmp 0x4208c0
mov eax, dword [esp + 0x478]
cmp eax, ebx
jne 0x4208d6
mov eax, dword [esp + 0x47c]
xor ebp, ebp
jmp 0x4208f8
cmp dword [esp + 0x47c], ebx
jne 0x4208e3
xor ebp, ebp
jmp 0x42092f
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [esp + 0x47c], eax
mov ebp, eax
cmp eax, ebx
je 0x42092f
mov edx, dword [esp + 0x1c]
shr edx, 4
and edx, 1
je 0x42092f
cmp word [esp + 0x48], 0x2e
jne 0x42092f
mov ax, word [esp + 0x4a]
cmp ax, bx
je 0x420a8b
cmp ax, 0x2e
jne 0x42092f
cmp word [esp + 0x4c], bx
je 0x420a8b
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
call fcn.004215b0
push eax
mov eax, 0xc8
mov byte [esp + 0x940], 1
call fcn.004098d0
lea ecx, [esp + 0x610]
mov esi, eax
mov eax, ecx
mov edx, 0x190
sub esi, eax
lea eax, [edx + 0x7ffffe6e]
test eax, eax
je 0x420982
movzx eax, word [esi + ecx]
cmp ax, bx
je 0x420982
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x420962
jmp 0x420986
cmp edx, ebx
jne 0x420989
sub ecx, 2
xor edx, edx
mov byte [esp + 0x93c], bl
mov eax, dword [esp + 0x14]
mov word [ecx], dx
lea ecx, [eax - 0xc]
cmp ecx, 0x4674bc
je 0x4209c2
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4209c2
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.0043406a
add esp, 4
cmp dword [esp + 0x47c], ebx
je 0x420a28
mov eax, dword [esp + 0x1c]
shr eax, 4
and eax, 1
cmp eax, ebx
je 0x420a28
push 0x18e
lea ecx, [esp + 0x486]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x48c], ax
call fcn.00437380
lea edx, [esp + 0x61c]
push edx
push edi
push str._s_s
lea eax, [esp + 0x498]
push 0x190
push eax
call fcn.00421740
lea ecx, [esp + 0x4a0]
push ecx
call fcn.004207e0
add esp, 0x24
jmp 0x420a8b
push 0x18e
lea eax, [esp + 0x486]
xor edx, edx
push ebx
push eax
mov word [esp + 0x48c], dx
call fcn.00437380
lea ecx, [esp + 0x61c]
push ecx
push edi
push str._s_s
lea edx, [esp + 0x498]
push 0x190
push edx
call fcn.00421740
add esp, 0x20
lea eax, [esp + 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x420a8b
push 4
push ebx
lea ecx, [esp + 0x488]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp ebp, ebx
jne 0x4208c0
mov eax, dword [esp + 0x478]
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [esp + 0x47c], ebx
cmp eax, ebx
je 0x420aba
cmp eax, 0xffffffff
je 0x420aba
push eax
call esi
mov dword [esp + 0x478], ebx
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [esp + 0x478]
mov dword [esp + 0x47c], ebx
cmp eax, ebx
je 0x420adb
cmp eax, 0xffffffff
je 0x420adb
push eax
call esi
mov eax, 1
jmp 0x420ae4
xor eax, eax
mov ecx, dword [esp + 0x934]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x91c]
xor ecx, esp
call fcn.00433af9
add esp, 0x92c
ret