Function at 0x42eab3
Capabilities:
Create process on windows
Delete file
Enumerate files on windows
Get common file path
Move file
Set file attributes

Disassembly:
push 0xa9c
mov eax, 0x47cc69
call fcn.00430026
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x2c]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x7a0], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x794], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x798], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x79c], ecx
mov ecx, dword [ebp + 0x30]
mov dword [ebp - 0x7a8], ecx
lea ecx, [ebp - 0xaa8]
mov dword [ebp - 0x784], eax
mov byte [eax], 0
call fcn.0042e894
and dword [ebp - 4], 0
mov dword [ebp - 0x850], esi
mov esi, dword [ebp - 0x798]
mov dword [ebp - 0x844], ebx
xor ebx, ebx
inc ebx
mov dword [ebp - 0x848], edi
cmp byte [esi + 0x2b], 0
jne 0x42ed05
lea edi, [esi + 0xc]
push edi
lea ecx, [ebp - 0x780]
call fcn.0040a3b9
cmp dword [ebp - 0x77c], 0
mov byte [ebp - 4], bl
jne 0x42eb68
lea eax, [ebp - 0x780]
push eax
call fcn.0040e928
cmp byte [ebp + 0x24], 0
je 0x42ecb6
lea ecx, [ebp - 0x804]
call fcn.0042e7f0
lea ecx, [ebp - 0x790]
mov byte [ebp - 4], 2
call fcn.0040a48f
lea eax, [ebp - 0x790]
mov byte [ebp - 4], 3
push eax
push dword [ebp - 0x780]
call fcn.0040ec1e
test al, al
jne 0x42ebd6
push 0x47ee40
push 0
call fcn.00428445
mov eax, dword [ebp - 0x784]
push dword [ebp - 0x790]
mov byte [eax], bl
call fcn.0042ffa8
pop ecx
lea ecx, [ebp - 0x804]
call fcn.0042e94a
jmp 0x42ecda
lea eax, [ebp - 0x790]
push eax
call fcn.00410c05
lea eax, [ebp - 0x790]
push eax
lea ecx, [ebp - 0x7f4]
call fcn.0040a663
mov eax, dword [esi + 8]
mov dword [ebp - 0x7d4], eax
mov al, byte [esi + 3]
mov byte [ebp - 0x7db], al
mov eax, dword [esi + 4]
mov dword [ebp - 0x7d8], eax
mov al, byte [esi + 2]
mov byte [ebp - 0x7dc], al
mov ax, word [esi]
mov word [ebp - 0x7d0], ax
mov eax, dword [ebp - 0x794]
cmp dword [eax + 4], ebx
jne 0x42ec3c
mov eax, dword [eax]
lea ecx, [ebp - 0x7e8]
push dword [eax]
call fcn.0040a663
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x114]
push eax
push 0
push 0x47ef1c
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x780]
call fcn.0040a6c4
mov ax, word [ebp - 0x7d0]
push dword [ebp - 0x790]
mov dword [esi + 8], ebx
mov dword [esi + 4], 3
mov word [esi], ax
call fcn.0042ffa8
pop ecx
lea ecx, [ebp - 0x804]
mov byte [ebp - 4], bl
call fcn.0042e94a
push edi
push dword [ebp - 0x780]
call fcn.0040ec1e
test al, al
jne 0x42ecef
push 0x47ee40
push 0
call fcn.00428445
mov eax, dword [ebp - 0x784]
mov byte [eax], bl
push dword [ebp - 0x780]
call fcn.0042ffa8
mov esi, 0x80004005
jmp 0x42f061
push edi
call fcn.00410c05
push dword [ebp - 0x780]
mov byte [ebp - 4], 0
call fcn.0042ffa8
pop ecx
cmp byte [esi + 0x2b], 0
mov eax, 0xce4
lea ecx, [eax + 2]
cmovne eax, ecx
push eax
lea eax, [ebp - 0x7c0]
push eax
call fcn.00428429
lea eax, [ebp - 0x7c0]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x82c]
call fcn.0040a663
mov eax, dword [ebp - 0x79c]
lea ecx, [ebp - 0xaa8]
mov dword [ebp - 0x84c], eax
push eax
mov dword [eax + 0x54], ecx
lea ecx, [ebp - 0x830]
call fcn.0042e9ef
mov ecx, dword [ebp - 0x84c]
call fcn.0042a999
mov eax, dword [ebp - 0x7a0]
lea ecx, [ebp - 0xaa8]
push dword [ebp - 0x7a8]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp - 0x7a4]
mov dword [ebp - 0x838], eax
lea eax, [ebp - 0x7c0]
push eax
mov byte [ebp - 0x8a8], 0
mov dword [ebp - 0x834], esi
mov dword [ebp - 0x8a4], ebx
call fcn.0042c17d
mov esi, eax
test esi, esi
jne 0x42f056
cmp byte [ebp - 0x858], al
je 0x42edcc
cmp byte [ebp - 0x8a5], al
jne 0x42edce
xor ebx, ebx
mov eax, dword [ebp - 0x784]
lea ecx, [ebp - 0x7b4]
mov byte [eax], bl
call fcn.0040a48f
lea ecx, [ebp - 0x7cc]
mov byte [ebp - 4], 5
call fcn.0040a48f
lea eax, [ebp - 0x114]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x7b4]
call fcn.0040a6c4
push 0x250
lea eax, [ebp - 0x774]
push 0
push eax
call fcn.004313b0
add esp, 0xc
lea eax, [ebp - 0x7b4]
push 0x47ef20
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.0040a974
lea ecx, [ebp - 0x774]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push dword [ebp - 0x810]
mov esi, eax
call fcn.0042ffa8
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ecx
test dword [ebp - 0x774], 0x10
jne 0x42f01b
lea eax, [ebp - 0x748]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
lea ecx, [ebp - 0x780]
mov edi, eax
call fcn.0040a48f
lea eax, [ebp - 0x7b4]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x780]
call fcn.0040a663
push 0x47ef2c
lea ecx, [ebp - 0x780]
call fcn.0040aaf3
lea eax, [ebp - 0x748]
push eax
lea ecx, [ebp - 0x780]
call fcn.0040aaf3
push 0x47ef30
push edi
call fcn.00442c1b
pop ecx
pop ecx
test eax, eax
jne 0x42eedf
push 5
push eax
push eax
push dword [ebp - 0x780]
push str.open
push eax
jmp 0x42f009
push 0x104
lea eax, [ebp - 0x524]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
lea eax, [ebp - 0x31c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx ecx, word [ebp - 0x31c]
movsx eax, byte [ebp - 0x114]
cmp eax, ecx
jne 0x42ef66
lea ecx, [ebp - 0x790]
call fcn.0040a48f
lea eax, [ebp - 0x114]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x790]
call fcn.0040a6c4
lea eax, [ebp - 0x31c]
push eax
push 3
push 0x47ef48
push dword [ebp - 0x790]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push dword [ebp - 0x790]
mov byte [ebp - 4], 7
call fcn.0042ffa8
pop ecx
jmp 0x42ef8c
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push str.__.tmp
lea eax, [ebp - 0x31c]
push 0x104
push eax
call fcn.0043e366
add esp, 0xc
lea eax, [ebp - 0x31c]
push eax
lea ecx, [ebp - 0x7cc]
call fcn.0040a73e
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x524]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 2
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x524]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push edi
lea eax, [ebp - 0x524]
push 0x104
push eax
call fcn.0043e366
add esp, 0xc
lea eax, [ebp - 0x524]
push eax
push dword [ebp - 0x780]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 5
xor ecx, ecx
lea eax, [ebp - 0x524]
push ecx
push ecx
push eax
push str.open
push ecx
call ebx
push dword [ebp - 0x780]
mov byte [ebp - 4], 6
call fcn.0042ffa8
pop ecx
lea eax, [ebp - 0x774]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x42ee57
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x7cc]
mov esi, dword [ebp - 0x85c]
call fcn.0042ffa8
push dword [ebp - 0x7b4]
call fcn.0042ffa8
pop ecx
pop ecx
push dword [ebp - 0x7c0]
call fcn.0042ffa8
pop ecx
lea ecx, [ebp - 0xaa8]
call fcn.0042e988
mov eax, esi
call fcn.0042ffd0
ret 0x2c