Function at 0x4ad0daaa
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
test ah, 4
jne 0x4ad0dba9
mov esi, dword [sym.imp.msvcrt.dll_wcscmp]
lea eax, [ebp - 0x438]
push 0x4ad0b9f0
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x4ad0dbce
lea eax, [ebp - 0x438]
push 0x4ad0b9e8
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x4ad0dbce
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.4ad0daaa
cmp dword [0x4ad289e8], 0
jne 0x4ad0dbe6
xor esi, esi
cmp eax, esi
je 0x4ad0dbce
cmp eax, 0x91
mov ecx, dword [ebp + 0xc]
mov dword [ecx], esi
jne 0x4ad1411d
cmp dword [ebp - 0xc], esi
je 0x4ad0dbce
jmp 0x4ad1411d
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
mov dword [eax], 1
call dword [sym.imp.msvcrt.dll_wcslen]
mov ebx, eax
test ebx, ebx
pop ecx
je 0x4ad1410d
lea eax, [ebx + 3]
cmp eax, 0x104
push esi
jg 0x4ad0dc00
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov ax, word [esi + ebx*2 - 2]
cmp ax, 0x3a
pop ecx
pop ecx
je 0x4ad0db17
cmp ax, 0x5c
je 0x4ad0db17
lea eax, [ebp - 0x214]
push 0x4ad0b9f4
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
inc ebx
lea eax, [ebp - 0x214]
push 0x4ad0e1ac
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x4ad14117
push edi
cmp dword [0x4ad289e8], 0
jne 0x4ad0dbe6
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [ebp - 0x230]
push eax
lea edi, [ebp - 0x230]
call esi
test eax, eax
pop ecx
je 0x4ad0dc0b
add eax, ebx
cmp eax, 0x104
jge 0x4ad1420b
lea esi, [ebp + ebx*2 - 0x214]
push edi
push esi
call dword [sym.imp.msvcrt.dll_wcscpy]
mov eax, dword [ebp - 0x464]
mov edi, eax
and edi, 0x10
pop ecx
pop ecx
mov dword [ebp - 4], eax
jne 0x4ad0da26
test al, 1
jne 0x4ad14147
test edi, edi
jne 0x4ad1415d
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4ad0e129
lea eax, [ebp - 0x464]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4ad0db4c
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [0x4ad289e8], 0
pop edi
jne 0x4ad1422c
push dword [ebp + 8]
call fcn.4ad0dd6f
pop esi
pop ebx
leave
ret 8
lea eax, [ebp - 0x438]
push eax
lea edi, [ebp - 0x438]
call esi
pop ecx
jmp 0x4ad0db77
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4d3
je 0x4ad0dbe6
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [ebp - 0x230]
push eax
call edi
test eax, eax
pop ecx
jne 0x4ad14180
lea eax, [ebp - 0x214]
push eax
push 1
push 0x271b
call fcn.4ad0b54d
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.4ad0b54d
pop ecx
pop ecx
push dword [ebp - 4]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp + 0xc]
and dword [eax], 0
jmp 0x4ad0dbce
test edi, edi
jne 0x4ad0dbce
jmp 0x4ad0dbb9
mov eax, 0xa1
jmp 0x4ad0dc05
push esi
jmp 0x4ad0dc00
lea eax, [ebp - 0x214]
push eax
push 1
push 0x271b
call fcn.4ad0b54d
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.4ad0b54d
pop ecx
pop ecx
jmp 0x4ad0dbce
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x4ad0dbb1
test byte [ebp - 3], 4
je 0x4ad0e193
lea eax, [ebp - 0x214]
push eax
call fcn.4ad0dd6f
test eax, eax
jne 0x4ad0e129
jmp 0x4ad0e193
and word [esi], 0
lea eax, [ebp - 0x438]
push eax
call edi
add eax, ebx
cmp eax, 0x104
pop ecx
jb 0x4ad141c6
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x214]
push eax
push 1
push 0x271b
call fcn.4ad0b54d
add esp, 0x14
jmp 0x4ad0e168
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x214]
push eax
call edi
lea eax, [ebp - 0x214]
push eax
push 1
push 0x271b
call fcn.4ad0b54d
and word [esi], 0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x214]
push eax
call edi
add esp, 0x1c
jmp 0x4ad0e168
mov eax, dword [ebp + 0xc]
and dword [eax], 0
lea eax, [ebp - 0x214]
push eax
push 1
push 0x2724
call fcn.4ad0b54d
add esp, 0xc
jmp 0x4ad0dbe6
xor eax, eax
jmp 0x4ad0dc05