Function at 0x4face0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
test dword [0x7eeab0], 0xffffff80
jne 0x4fad08
test dword [0x7eeab0], 0xffffffff
jne 0x4fb088
call fcn.006a7fbc
jmp fcn.004face0
push edi
push esi
push ebp
push ebx
sub esp, 0x10
mov ebx, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
cmp eax, 1
je 0x4fb07e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x91
je 0x4fad3b
cmp eax, 5
je 0x4fad3b
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret
lea ecx, [esp + 4]
mov edx, ebx
call fcn.004f60bc
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
test eax, eax
je 0x4fad91
mov esi, 0x700ee0
mov edi, eax
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fad59
mov ecx, dword [esp + 8]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fad7e
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fad69
dec eax
cmp byte [eax + 0x700edf], 0x5c
je 0x4fad93
mov byte [eax + 0x700ee0], 0x5c
inc eax
jmp 0x4fad93
xor eax, eax
lea edx, [eax + 0x700ee0]
mov byte [eax + 0x700ee0], 0
push 0x6d0b38
push 0x6c4adc
push edx
call fcn.00697936
add esp, 0xc
mov ecx, 0x13e
call fcn.004dc218
mov ebp, eax
push ebp
push 0x700ee0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4fb06f
mov ecx, dword [ebp]
and ecx, 0x10
mov eax, 1
mov ecx, 0
cmovne ecx, eax
lea edi, [ebp + 0x2c]
mov dword [esp + 0xc], edi
mov esi, 0x6d0a7c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fae15
test dl, dl
je 0x4fae11
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fae15
add edi, 2
add esi, 2
test dl, dl
jne 0x4fadf5
xor eax, eax
jmp 0x4fae1a
sbb eax, eax
or eax, 1
test eax, eax
je 0x4faf8c
mov edi, dword [esp + 0xc]
mov esi, 0x6d0b3c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fae4b
test dl, dl
je 0x4fae47
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fae4b
add edi, 2
add esi, 2
test dl, dl
jne 0x4fae2b
xor eax, eax
jmp 0x4fae50
sbb eax, eax
or eax, 1
test eax, eax
je 0x4faf8c
test ecx, ecx
jne 0x4faf11
mov eax, 0x700ce0
mov edx, 0x700de0
mov ecx, dword [esp + 8]
cmp ecx, eax
cmove eax, edx
mov dword [esp], eax
test ecx, ecx
je 0x4faeb4
mov esi, eax
mov edi, ecx
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fae7e
mov ecx, dword [esp + 8]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4faea3
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fae8e
dec eax
mov edx, dword [esp]
cmp byte [eax + edx - 1], 0x5c
je 0x4faeb6
mov byte [eax + edx], 0x5c
inc eax
jmp 0x4faeb6
xor eax, eax
mov edx, dword [esp]
lea ecx, [edx + eax]
mov byte [eax + edx], 0
mov eax, dword [esp + 0xc]
push eax
push 0x6c4adc
push ecx
call fcn.00697936
add esp, 0xc
mov eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
je 0x4faf8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4faf8c
push 0x80
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4faf8c
mov eax, 0x700ce0
mov edx, 0x700de0
mov ecx, dword [esp + 8]
cmp ecx, eax
cmove eax, edx
mov dword [esp], eax
test ecx, ecx
je 0x4faf65
mov esi, eax
mov edi, ecx
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4faf2f
mov ecx, dword [esp + 8]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4faf54
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4faf3f
dec eax
mov edx, dword [esp]
cmp byte [eax + edx - 1], 0x5c
je 0x4faf67
mov byte [eax + edx], 0x5c
inc eax
jmp 0x4faf67
xor eax, eax
mov edx, dword [esp]
lea ecx, [edx + eax]
mov byte [eax + edx], 0
mov eax, dword [esp + 0xc]
push eax
push 0x6c4adc
push ecx
call fcn.00697936
add esp, 0xc
mov ecx, dword [esp]
call fcn.004face0
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
jne 0x4fb034
mov edi, dword [esp + 0xc]
mov esi, 0x6d0a7c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fafc6
test dl, dl
je 0x4fafc2
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fafc6
add edi, 2
add esi, 2
test dl, dl
jne 0x4fafa6
xor eax, eax
jmp 0x4fafcb
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fb023
mov edi, dword [esp + 0xc]
mov esi, 0x6d0b3c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4faff8
test dl, dl
je 0x4faff4
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4faff8
add edi, 2
add esi, 2
test dl, dl
jne 0x4fafd8
xor eax, eax
jmp 0x4faffd
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fb023
mov eax, dword [ebp]
xor edx, edx
and eax, 0x10
mov esi, 1
cmovne edx, esi
mov edi, dword [esp + 8]
push edi
mov ecx, dword [esp + 0x10]
call fcn.004fbc8c
test eax, eax
je 0x4fb034
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
je 0x4faf9d
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, ebp
call fcn.004db958
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4fb054
xor ebx, ebx
jmp 0x4fb05c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [esp + 4]
call fcn.004db958
mov eax, ebx
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret
mov ecx, ebp
call fcn.004db958
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4fb042
xor eax, eax
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret
push edi
push esi
push ebp
push ebx
sub esp, 0x10
mov ebx, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
cmp eax, 1
je 0x4fb3ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x91
je 0x4fb0bb
cmp eax, 5
je 0x4fb0bb
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret
lea ecx, [esp]
mov edx, ebx
call fcn.004f60bc
mov eax, dword [esp]
mov dword [esp + 4], eax
test eax, eax
je 0x4fb10f
mov esi, 0x700ee0
mov edi, eax
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fb0d7
mov ecx, dword [esp + 4]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fb0fc
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fb0e7
dec eax
cmp byte [eax + 0x700edf], 0x5c
je 0x4fb111
mov byte [eax + 0x700ee0], 0x5c
inc eax
jmp 0x4fb111
xor eax, eax
lea edx, [eax + 0x700ee0]
mov byte [eax + 0x700ee0], 0
push 0x6d0b38
push 0x6c4adc
push edx
call fcn.00697936
add esp, 0xc
mov ecx, 0x13e
call fcn.004dc218
mov ebx, eax
push ebx
push 0x700ee0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
je 0x4fb3df
mov eax, dword [ebx]
and eax, 0x10
xor ecx, ecx
test eax, eax
setne cl
lea edi, [ebx + 0x2c]
mov dword [esp + 0xc], edi
mov esi, 0x6d0a7c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fb18e
test dl, dl
je 0x4fb18a
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fb18e
add edi, 2
add esi, 2
test dl, dl
jne 0x4fb16e
xor eax, eax
jmp 0x4fb193
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fb2f6
mov edi, dword [esp + 0xc]
mov esi, 0x6d0b3c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fb1c4
test dl, dl
je 0x4fb1c0
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fb1c4
add edi, 2
add esi, 2
test dl, dl
jne 0x4fb1a4
xor eax, eax
jmp 0x4fb1c9
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fb2f6
test ecx, ecx
jne 0x4fb27e
mov edx, 0x700ce0
mov eax, dword [esp + 4]
cmp eax, edx
je 0x4fb1ed
mov ebp, 0x700ce0
jmp 0x4fb1f2
mov ebp, 0x700de0
test eax, eax
je 0x4fb22d
mov esi, ebp
mov edi, eax
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fb1fa
mov ecx, dword [esp + 4]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fb21f
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fb20a
dec eax
cmp byte [eax + ebp - 1], 0x5c
je 0x4fb22f
mov byte [eax + ebp], 0x5c
inc eax
jmp 0x4fb22f
xor eax, eax
lea edx, [ebp + eax]
mov byte [eax + ebp], 0
mov eax, dword [esp + 0xc]
push eax
push 0x6c4adc
push edx
call fcn.00697936
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
je 0x4fb2f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4fb2f6
push 0x80
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4fb2f6
mov edx, 0x700ce0
mov eax, dword [esp + 4]
cmp eax, edx
je 0x4fb292
mov ebp, 0x700ce0
jmp 0x4fb297
mov ebp, 0x700de0
test eax, eax
je 0x4fb2d2
mov esi, ebp
mov edi, eax
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fb29f
mov ecx, dword [esp + 4]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fb2c4
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fb2af
dec eax
cmp byte [eax + ebp - 1], 0x5c
je 0x4fb2d4
mov byte [eax + ebp], 0x5c
inc eax
jmp 0x4fb2d4
xor eax, eax
lea edx, [ebp + eax]
mov byte [eax + ebp], 0
mov eax, dword [esp + 0xc]
push eax
push 0x6c4adc
push edx
call fcn.00697936
add esp, 0xc
mov ecx, ebp
call fcn.004face0
push ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
jne 0x4fb3a2
mov ebp, dword [esp + 8]
mov edi, dword [esp + 0xc]
mov esi, 0x6d0a7c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fb338
test dl, dl
je 0x4fb334
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fb338
add edi, 2
add esi, 2
test dl, dl
jne 0x4fb318
xor eax, eax
jmp 0x4fb33d
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fb391
mov edi, dword [esp + 0xc]
mov esi, 0x6d0b3c
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4fb36a
test dl, dl
je 0x4fb366
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4fb36a
add edi, 2
add esi, 2
test dl, dl
jne 0x4fb34a
xor eax, eax
jmp 0x4fb36f
sbb eax, eax
or eax, 1
test eax, eax
je 0x4fb391
mov eax, dword [ebx]
and eax, 0x10
xor edx, edx
test eax, eax
setne dl
mov esi, dword [esp + 4]
push esi
mov ecx, dword [esp + 0x10]
call fcn.004fbc8c
test eax, eax
je 0x4fb3a2
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
je 0x4fb30f
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, ebx
call fcn.004db958
push dword [esp]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4fb3c5
xor ebx, ebx
jmp 0x4fb3cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [esp]
call fcn.004db958
mov eax, ebx
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret
mov ecx, ebx
call fcn.004db958
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4fb3b4
xor eax, eax
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret