Function at 0x401eba
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
or dword [0x4034b9], 0xffffffff
and dword [0x4034b5], 0
inc byte [0x40348c]
push 0x403555
push dword [0x4030cc]
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [0x4034b9], eax
cmp eax, 0xffffffff
jne 0x401f92
mov eax, dword [0x4034b9]
cmp eax, 0xffffffff
je 0x401efc
push eax
call sub.KERNEL32.DLL_FindClose
dec byte [0x40348c]
je 0x401f3d
cmp dword [0x4034b5], 0
jne 0x401f3d
mov esi, dword [0x4030c4]
cmp byte [esi - 1], 0x5c
jne 0x401f1a
dec esi
xor al, al
xchg byte [esi], al
push eax
push 0x403693
push dword [0x4030bc]
call sub.KERNEL32.DLL_FindFirstFileA
pop ecx
mov byte [esi], cl
cmp eax, 0xffffffff
je 0x401f3e
push eax
call sub.KERNEL32.DLL_FindClose
ret
mov ebx, dword [0x4030d4]
mov byte [ebx], 0
call fcn.00401653
push edx
insd dword es:[edi], dx
outsd dx, dword [esi]
jbe 0x401fbb
outsb dx, byte [esi]
mov al, byte [0x358b]
int3
mov ebx, 0x403555
lea esi, [ebx + 0x2c]
cmp byte [esi], 0x2e
je 0x402072
call fcn.00402429
test byte [ebx], 0x10
je 0x402002
pushal
push dword [0x4034b5]
push dword [0x4034b9]
push dword [0x4030c4]
xor eax, 0x4030c4
push dword [0x4030d4]
mov dword [0x4030c4], ebp
mov dword [0x4030d4], edi
mov esi, 0x402547
push esi
dec edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
lea edi, [ebp - 1]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.00401eba
pop dword [0x4030d4]
pop dword [0x4030c4]
pop dword [0x4034b9]
pop eax
add dword [0x4034b5], eax
popal
jmp 0x402072
push 0x403693
push dword [0x4030bc]
call sub.KERNEL32.DLL_FindFirstFileA
cmp eax, 0xffffffff
je 0x40201f
push eax
call sub.KERNEL32.DLL_FindClose
jmp 0x40206c
mov al, 6
call fcn.00401744
call fcn.00401653
inc esp
insb byte es:[edi], dx
je 0x40209a
outsb dx, byte [esi]
mov al, byte [0x358b]
int3
inc dword [0x4034b5]
push 0x403555
push dword [0x4034b9]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jmp 0x401ee6
add al, ch
loop 0x4020a2
add byte [eax], al
mov dword [0x4034b9], eax
cmp eax, 0xffffffff
xor al, 0x40
add byte [ebx + 0x1275fff8], al
jne 0x4020bc
mov eax, dword [0x4034b9]
cmp eax, 0xffffffff
je 0x4020ba
push eax
call sub.KERNEL32.DLL_FindClose
clc
ret
mov ebx, 0x403693
lea esi, [ebx + 0x2c]
cmp byte [esi], 0x2e
je 0x4020d8
test byte [ebx], 0x10
je 0x402130
test dword [0x4030ec], 0x102
je 0x40212b
inc dword [0x4034a1]
call fcn.00402429
pushal
push dword [0x4034b9]
push dword [0x4030c4]
push dword [0x4030d4]
mov dword [0x4030c4], ebp
mov dword [0x4030d4], edi
mov esi, 0x402547
push esi
dec edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
lea edi, [ebp - 1]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.00402089
pop dword [0x4030d4]
pop dword [0x4030c4]
pop dword [0x4034b9]
popal
jmp 0x402359
inc dword [0x40349d]
bt dword [0x4030ec], 0
jae 0x402152
lea eax, [ebx + 0x14]
push 0x403491
push eax
call sub.KERNEL32.DLL_CompareFileTime
test eax, eax
js 0x40212b
mov edi, dword [0x4030c4]
mov ebp, dword [0x4030d4]
lodsb al, byte [esi]
stosb byte es:[edi], al
mov byte [ebp], al
inc ebp
test al, al
jne 0x40215e
call fcn.00402446
jne 0x4021b1
bt dword [0x4030ec], 7
jb 0x40212b
call sub.KERNEL32.DLL_GetLastError
cmp eax, 3
jne 0x4021a8
push esi
mov esi, dword [0x4030cc]
mov edi, 0x4037d1
push edi
lodsb al, byte [esi]
stosb byte es:[edi], al
test al, al
jne 0x402190
dec edi
cmp byte [edi], 0x5c
jne 0x402196
xor al, al
stosb byte es:[edi], al
pop esi
call fcn.00402478
pop esi
jb 0x40212b
xor eax, eax
lea edi, [esi + 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
bt dword [0x4030ec], 6
jae 0x4021f1
push ebx
push esi
call fcn.00401653
dec edi
dec ebx
and byte [edi + ebp*2 + 0x20], dh
arpl word [edi + 0x70], bp
jns 0x40216d
mov esi, dword [0x4030bc]
call fcn.00401672
call fcn.00401658
and byte [eax], ch
jns 0x402210
outsb dx, byte [esi]
sub dword [edi], edi
mov al, byte [0xfff083e8]
call [esi + 0x5b]
cmp ah, 0x15
jne 0x40223a
bt dword [0x4030ec], 0xa
jb 0x40224a
mov eax, dword [ebx + 0x14]
mov edx, dword [ebx + 0x18]
sub eax, dword [esi + 0x14]
sbb edx, dword [esi + 0x18]
jns 0x40223f
not eax
not edx
add eax, 1
adc edx, 0
jne 0x40221c
cmp eax, 0x1312d00
jbe 0x402224
inc dword [0x4034ad]
jmp 0x40223a
mov eax, dword [esi + 0x20]
cmp eax, dword [ebx + 0x20]
jne 0x40224a
mov eax, dword [esi + 0x1c]
cmp eax, dword [ebx + 0x1c]
jne 0x40224a
inc dword [0x4034a9]
jmp 0x402359
test edx, edx
jne 0x40224a
cmp eax, 0x1312d00
jbe 0x402224
mov al, 3
call fcn.00401744
call fcn.00401653
inc ebx
outsd dx, dword [esi]
jo 0x4022d3
imul ebp, dword [esi + 0x67], 0xbc358ba0
xor byte [eax], al
call fcn.00401672
bt dword [0x4030ec], 2
jae 0x402289
push esi
call fcn.00401658
and byte [edi + ebp*2 - 0x60], dh
mov esi, dword [0x4030cc]
call fcn.00401672
pop esi
mov al, byte [0x4030f1]
call fcn.00401761
test dword [0x4030ec], 0x10
je 0x4022a7
inc dword [0x4034a5]
jmp 0x40223a
test byte [0x403555], 7
je 0x4022c0
push 0x80
push dword [0x4030cc]
call sub.KERNEL32.DLL_SetFileAttributesA
call fcn.00402370
jne 0x4022d1
call fcn.00402503
jmp 0x402359
inc dword [0x4034a5]
mov esi, dword [0x4030cc]
mov edi, ebx
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebp, eax
test al, 7
je 0x4022f6
movsd dword es:[edi], dword [esi]
xor al, 0x40
add byte [ebx + 0x4030cc35], cl
add byte [ebx - 0x4417a905], cl
add al, byte [eax]
add byte [ebx + 0x7407a8e8], cl
or ebp, dword [eax - 0x80]
add byte [eax], al
add byte [esi - 0x18], dl
or al, byte [ebx]
add byte [eax], al
push 0x80
push esi
call sub.KERNEL32.DLL_SetFileAttributesA
mov edx, esi
call fcn.004014be
jb 0x4022c7
lea eax, [edi + 0x14]
xor ecx, ecx
bt dword [0x4030ec], 9
jb 0x402310
mov cl, 8
push eax
sub eax, ecx
push eax
sub eax, ecx
push eax
push ebx
call sub.KERNEL32.DLL_SetFileTime
call fcn.00401618
test ebp, 7
je 0x402331
push ebp
push esi
call sub.KERNEL32.DLL_SetFileAttributesA
bt dword [0x4030ec], 3
jae 0x402359
mov esi, dword [0x4030bc]
mov ecx, dword [edi]
test cl, 7
je 0x402353
push 0x80
push esi
call sub.KERNEL32.DLL_SetFileAttributesA
push esi
call sub.KERNEL32.DLL_DeleteFileA
push 0x403693
push dword [0x4034b9]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jmp 0x4020a8