Function at 0x403de9
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get common file path
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x470008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
or dword [ebp - 0x670], 0xffffffff
and eax, 1
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 0x208
xor esi, esi
mov dword [ebp - 0x66c], eax
and dword [ebp - 0x668], esi
lea eax, [ebp - 0x414]
push ebx
push esi
push eax
call fcn.00430b10
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00430b10
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x403e85
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
jne 0x403e5f
push 3
pop esi
test esi, esi
jle 0x403e6e
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x403e85
push esi
push 0xc8
push str.c:_agent_work18_swix_srclibsdutildirutil.cpp
call fcn.00403953
jmp 0x4041e3
test bl, 0x10
je 0x4041cc
test bl, 1
je 0x403ec9
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x403ec9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x403eba
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x403ec1
mov esi, 0x80004005
push esi
push 0xd1
jmp 0x403e76
cmp dword [ebp - 0x66c], 0
jne 0x403edc
test byte [ebp + 0xc], 2
je 0x4040d7
test byte [ebp + 0xc], 4
je 0x403f21
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x403f21
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x403f0f
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x403f16
mov esi, 0x80004005
push esi
push 0xdc
jmp 0x403e76
lea eax, [ebp - 0x668]
push eax
push 0x450cb0
push edi
call fcn.00402ece
mov esi, eax
test esi, esi
js 0x4041e3
lea eax, [ebp - 0x664]
push eax
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [ebp - 0x670], ebx
cmp ebx, 0xffffffff
jne 0x403f86
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x403f74
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x403f7b
mov esi, 0x80004005
push esi
push 0xe7
jmp 0x403e76
push 0x2e
pop ecx
cmp cx, word [ebp - 0x638]
jne 0x403fb7
xor eax, eax
cmp ax, word [ebp - 0x636]
je 0x4040b0
cmp cx, word [ebp - 0x636]
jne 0x403fb7
cmp ax, word [ebp - 0x634]
je 0x4040b0
xor eax, eax
mov word [ebp - 0x432], ax
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x638]
push eax
push edi
call fcn.00402ece
mov esi, eax
test esi, esi
js 0x4041d1
test byte [ebp + 0xc], 2
mov al, byte [ebp - 0x664]
je 0x404017
test al, 0x10
je 0x404017
lea eax, [ebp - 0x668]
push eax
call fcn.00402c77
mov esi, eax
test esi, esi
js 0x4041d1
push dword [ebp + 0xc]
push dword [ebp - 0x668]
call fcn.00403de9
jmp 0x4040b0
cmp dword [ebp - 0x66c], 0
je 0x4040b0
test al, 7
je 0x404041
push 0x80
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40412a
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4040b0
test byte [ebp + 0xc], 4
je 0x404180
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x450cb8
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x40415a
push 1
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 4
push 0
test eax, eax
je 0x4040a4
lea eax, [ebp - 0x20c]
push eax
jmp 0x4040aa
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x664]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x403f86
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4041a6
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4041d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4040fb
movzx esi, si
or esi, 0x80070000
cmp esi, 0x80070020
jne 0x40411a
test byte [ebp + 0xc], 4
je 0x404122
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x404122
xor esi, esi
test esi, esi
jns 0x4041d1
push esi
push 0x141
jmp 0x40414e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x404141
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x404148
mov esi, 0x80004005
push esi
push 0x10b
push str.c:_agent_work18_swix_srclibsdutildirutil.cpp
call fcn.00403953
jmp 0x4041d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x404171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x404178
mov esi, 0x80004005
push esi
push 0x115
jmp 0x40414e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x404197
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40419e
mov esi, 0x80004005
push esi
push 0x125
jmp 0x40414e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4041bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4041c4
mov esi, 0x80004005
push esi
push 0x132
jmp 0x40414e
mov esi, 0x8000ffff
mov eax, dword [ebp - 0x670]
cmp eax, 0xffffffff
je 0x4041e3
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x668], 0
je 0x4041f7
push dword [ebp - 0x668]
call fcn.004027da
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042f1b3
leave
ret 8