Function at 0x402f70
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0x508
mov eax, 0x422157
call fcn.0042147b
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x4e4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4f8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4cc], eax
mov eax, dword [ebp + 0x1c]
xor edi, edi
mov ebx, 0x4257c8
push ebx
lea ecx, [ebp - 0x4c8]
mov dword [ebp - 0x500], eax
mov dword [ebp - 0x4c0], edi
mov dword [ebp - 0x4e8], edi
call fcn.00401652
mov ecx, dword [ebp - 0x4cc]
push 0x425a34
mov dword [ebp - 4], edi
call fcn.00401530
push str.MiniDumpWriteDump
push str.dbghelp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x4dc], eax
cmp eax, edi
jne 0x403027
mov ecx, dword [ebp - 0x4e4]
push ebx
call fcn.00401652
mov ecx, dword [ebp - 0x4c8]
add ecx, 0xfffffff0
call fcn.00401171
mov eax, dword [ebp - 0x4e4]
jmp 0x4035a0
push edi
push 0x425a04
push dword [ebp - 0x4f8]
lea eax, [ebp - 0x4d8]
push esi
push eax
call fcn.00402b52
add esp, 0x14
push edi
push 0x80
push 2
push edi
push 3
push 0x40000000
push dword [ebp - 0x4d8]
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40308a
mov ecx, dword [ebp - 0x4e4]
push 0x4257c8
call fcn.00401652
mov ecx, dword [ebp - 0x4d8]
add ecx, 0xfffffff0
call fcn.00401171
jmp 0x40300e
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x514], eax
mov eax, dword [esi + 0x34c]
push edi
mov dword [ebp - 0x510], eax
mov dword [ebp - 0x50c], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push edi
lea eax, [ebp - 0x514]
push eax
push 0x20
push ebx
push dword [esi + 0x10]
push dword [ebp - 0x4fc]
call dword [ebp - 0x4dc]
mov dword [ebp - 0x4f0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [ebp - 0x4f4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x436718
lea ecx, [ebp - 0x4d0]
call fcn.004040ca
mov eax, dword [ebp - 0x4d8]
add eax, 0xfffffff0
push eax
mov byte [ebp - 4], 2
call fcn.00401382
lea ebx, [eax + 0x10]
pop ecx
mov dword [ebp - 0x4d4], ebx
mov byte [ebp - 4], 3
cmp dword [ebx - 0xc], edi
je 0x403346
push 0x5c
push ebx
call dword [sym.imp.MSVCR100.dll_wcsrchr]
pop ecx
pop ecx
cmp eax, edi
jne 0x403132
or eax, 0xffffffff
jmp 0x403136
sub eax, ebx
sar eax, 1
inc eax
push eax
push edi
lea eax, [ebp - 0x4e0]
push eax
lea ecx, [ebp - 0x4d4]
call fcn.00402992
push eax
lea ecx, [ebp - 0x4d4]
mov byte [ebp - 4], 4
call fcn.00401d11
mov ecx, dword [ebp - 0x4e0]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.00401171
push 0x425a00
lea ecx, [ebp - 0x4d4]
call fcn.00402f2a
mov ebx, 0x104
push ebx
lea ecx, [ebp - 0x4d0]
call fcn.004013e0
mov dword [ebp - 0x4c4], eax
mov eax, dword [ebp - 0x4d0]
cmp dword [eax - 8], ebx
jge 0x4031a9
push 0x80070057
call fcn.00401000
push ebx
push dword [ebp - 0x4d4]
xor ecx, ecx
push dword [ebp - 0x4c4]
mov dword [eax - 0xc], ebx
mov word [eax + 0x208], cx
call dword [sym.imp.MSVCR100.dll__wfullpath]
add esp, 0xc
push edi
cmp eax, edi
jne 0x4031dd
lea ecx, [ebp - 0x4d0]
call fcn.004011b5
jmp 0x403235
push edi
push edi
push edi
push 0x100
lea eax, [ebp - 0x21c]
push eax
push 3
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x4c4]
call dword [sym.imp.MSVCR100.dll__wsplitpath_s]
push eax
call fcn.00401018
push edi
push edi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp - 0x4c4]
call dword [sym.imp.MSVCR100.dll__wmakepath_s]
add esp, 0x40
push eax
call fcn.00401018
pop ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x4d0]
call fcn.00402904
lea eax, [ebp - 0x4bc]
push eax
push dword [ebp - 0x4d4]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x504], eax
cmp eax, 0xffffffff
je 0x403346
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x504]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x4c4]
call fcn.00401652
push edi
push str.FULL_
lea ecx, [ebp - 0x4c4]
mov byte [ebp - 4], 5
call fcn.00402957
cmp eax, 0xffffffff
je 0x40332b
mov eax, dword [ebp - 0x4d0]
add eax, 0xfffffff0
push eax
call fcn.00401382
add eax, 0x10
pop ecx
mov dword [ebp - 0x4e0], eax
mov ecx, dword [eax - 0xc]
lea ecx, [eax + ecx*2]
cmp eax, ecx
sbb eax, eax
lea edx, [ecx - 2]
and eax, edx
movzx eax, word [eax]
mov byte [ebp - 4], 6
cmp eax, 0x5c
je 0x4032e3
cmp eax, 0x2f
je 0x4032e3
push 0x5c
lea ecx, [ebp - 0x4e0]
call fcn.0040251b
mov eax, dword [ebp - 0x4c4]
push dword [eax - 0xc]
lea ecx, [ebp - 0x4e0]
push eax
call fcn.00401d61
mov eax, dword [ebp - 0x4e0]
add eax, 0xfffffff0
push eax
mov dword [ebp - 0x508], eax
call fcn.00401382
pop ecx
lea ebx, [eax + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebx - 0x10]
call fcn.00401171
mov ecx, dword [ebp - 0x508]
call fcn.00401171
mov ecx, dword [ebp - 0x4c4]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.00401171
cmp dword [ebp - 0x14], edi
jne 0x403257
push str.FULL_
push 0x425a04
push dword [ebp - 0x4f8]
lea eax, [ebp - 0x4ec]
push esi
push eax
call fcn.00402b52
add esp, 0x14
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push dword [ebp - 0x4ec]
mov byte [ebp - 4], 7
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4033f0
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x34c]
push edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
push 2
push ebx
push dword [esi + 0x10]
push dword [ebp - 0x4fc]
call dword [ebp - 0x4dc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [ebp - 0x4e8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, edi
je 0x4033f0
mov ecx, dword [ebp - 0x500]
cmp ecx, edi
je 0x4033f0
lea eax, [ebp - 0x4ec]
push eax
call fcn.00401d11
mov esi, str.0x_08X
cmp dword [ebp - 0x4f4], edi
je 0x403451
cmp dword [ebp - 0x4f4], 0x12
je 0x403451
push dword [ebp - 0x4f4]
lea eax, [ebp - 0x4c8]
push esi
push eax
call fcn.00401557
mov ecx, dword [ebp - 0x4cc]
add esp, 0xc
push str.Create_Mini_Dump_Errcode:
call fcn.004020a5
mov eax, dword [ebp - 0x4c8]
push dword [eax - 0xc]
mov ecx, dword [ebp - 0x4cc]
push eax
call fcn.00401d61
mov ecx, dword [ebp - 0x4cc]
push 0x425a34
call fcn.004020a5
cmp dword [ebp - 0x4e8], edi
je 0x4034ad
cmp dword [ebp - 0x4e8], 0x57
je 0x4034ad
push dword [ebp - 0x4e8]
lea eax, [ebp - 0x4c8]
push esi
push eax
call fcn.00401557
mov ecx, dword [ebp - 0x4cc]
add esp, 0xc
push str.Create_Full_Dump_Errcode:
call fcn.004020a5
mov eax, dword [ebp - 0x4c8]
push dword [eax - 0xc]
mov ecx, dword [ebp - 0x4cc]
push eax
call fcn.00401d61
mov ecx, dword [ebp - 0x4cc]
push 0x425a34
call fcn.004020a5
cmp dword [ebp - 0x4f0], edi
je 0x4034e4
mov eax, dword [ebp - 0x4d8]
add eax, 0xfffffff0
push eax
call fcn.00401382
add eax, 0x10
pop ecx
mov dword [ebp - 0x4dc], eax
lea eax, [ebp - 0x4dc]
mov byte [ebp - 4], 8
mov dword [ebp - 0x4c0], 2
jmp 0x403505
push 0x4257c8
lea ecx, [ebp - 0x4f0]
call fcn.00401652
mov dword [ebp - 4], 9
mov dword [ebp - 0x4c0], 4
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00401382
mov esi, dword [ebp - 0x4e4]
or dword [ebp - 0x4c0], 1
add eax, 0x10
test byte [ebp - 0x4c0], 4
pop ecx
mov dword [esi], eax
je 0x403541
mov ecx, dword [ebp - 0x4f0]
and dword [ebp - 0x4c0], 0xfffffffb
add ecx, 0xfffffff0
call fcn.00401171
test byte [ebp - 0x4c0], 2
je 0x403558
mov ecx, dword [ebp - 0x4dc]
add ecx, 0xfffffff0
call fcn.00401171
mov ecx, dword [ebp - 0x4ec]
add ecx, 0xfffffff0
call fcn.00401171
mov ecx, dword [ebp - 0x4d4]
add ecx, 0xfffffff0
call fcn.00401171
mov ecx, dword [ebp - 0x4d0]
add ecx, 0xfffffff0
call fcn.00401171
mov ecx, dword [ebp - 0x4d8]
add ecx, 0xfffffff0
call fcn.00401171
mov ecx, dword [ebp - 0x4c8]
add ecx, 0xfffffff0
call fcn.00401171
mov eax, esi
call fcn.004214fe
ret