Function at 0x494ff1
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xcb4
mov eax, dword [0x5184d0]
xor eax, esp
mov dword [esp + 0xcb0], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x250
mov dword [esp + 0x24], eax
xor ebx, ebx
lea eax, [esp + 0x34]
mov dword [esp + 0x28], ecx
mov esi, edx
push ebx
push eax
mov dword [esp + 0x24], esi
call sub.msvcrt.dll_memset
push 0x494fd0
push 4
push dword [esp + 0x34]
mov dword [esp + 0x34], ebx
mov edi, ebx
push esi
call dword [sym.imp.msvcrt.dll_qsort]
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0xacc]
add esp, 0x1c
mov edx, 0x41f26c
push 0x104
push eax
call fcn.0049472e
mov esi, eax
test esi, esi
je 0x495080
push esi
push 0x267e013b
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x4954c8
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0xab4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, 0xffffffff
jne 0x4950c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x495364
cmp eax, 2
je 0x495364
mov ecx, eax
call fcn.004c738c
mov esi, eax
push esi
push 0x268d013b
jmp 0x495075
test dword [esp + 0x30], 0x10
jne 0x4951c0
xor eax, eax
cmp ax, word [esp + 0x5c]
je 0x4951c0
push 0x494fd0
push 4
push dword [esp + 0x28]
lea eax, [esp + 0x68]
push dword [esp + 0x24]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.msvcrt.dll_bsearch]
add esp, 0x14
test eax, eax
jne 0x4951c0
lea ecx, [esp + 0x5c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x495116
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov dword [esp + 0x10], eax
test edi, edi
jne 0x495156
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [esp + 0x1c], esi
test esi, esi
jne 0x495184
mov eax, 0x8007000e
push eax
mov esi, eax
push 0x26aa013b
jmp 0x495499
cmp edi, 0xf4240
jae 0x495328
push 0x42
lea eax, [edi*4 + 4]
push eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
test eax, eax
je 0x495316
mov esi, eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
add eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esi + edi*4], eax
test eax, eax
je 0x495304
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, eax
call fcn.0043eb7d
mov esi, eax
inc edi
mov dword [esp + 0x10], esi
test esi, esi
jne 0x4952f9
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4950c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x49548a
test edi, edi
je 0x495364
mov esi, 0x406520
push esi
call fcn.004c5942
cmp dword [0x518ddc], 1
pop ecx
jle 0x4953de
mov ecx, ebx
mov dword [esp + 0x18], ecx
test edi, edi
je 0x49535d
lea eax, [esp + 0x280]
push 0x208
mov dword [esp + 0x24], eax
push eax
mov eax, dword [esp + 0x24]
mov edx, dword [eax + ecx*4]
mov ecx, dword [esp + 0x2c]
call fcn.0049472e
mov esi, eax
mov dword [esp + 0x10], esi
test esi, esi
jne 0x4953d3
lea eax, [esp + 0x280]
mov ecx, 0x30c
push eax
call fcn.004cf8b9
push eax
push 0x4056b0
call fcn.004c5942
add esp, 0xc
lea eax, [esp + 0x2c]
mov edx, 0x208
lea ecx, [esp + 0x280]
push eax
call fcn.0043ea90
mov esi, eax
mov dword [esp + 0x10], esi
test eax, eax
js 0x4953c8
mov dword [esp + 0x10], eax
jne 0x4953c8
mov eax, dword [esp + 0x2c]
inc eax
cmp eax, 0x104
jbe 0x495338
push ecx
push 0x41f278
push ecx
mov edx, 0x20d
lea ecx, [esp + 0x69c]
call fcn.0043eb27
mov esi, eax
mov dword [esp + 0x10], esi
test esi, esi
jne 0x49538f
lea eax, [esp + 0x280]
mov edx, 0x20d
push eax
lea ecx, [esp + 0x694]
call fcn.0043eadb
mov esi, eax
mov dword [esp + 0x10], esi
test esi, esi
jne 0x495384
lea eax, [esp + 0x690]
mov dword [esp + 0x20], eax
jmp 0x49533c
push esi
push 0x26d4013b
jmp 0x49549d
mov eax, 0x8007000e
push eax
mov esi, eax
push 0x26ca013b
jmp 0x495499
mov eax, 0x8007000e
push eax
mov esi, eax
push 0x26b9013b
jmp 0x495499
mov esi, 0x80070216
push esi
push 0x26c1013b
jmp 0x495499
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x49539a
mov ecx, dword [esp + 0x18]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, edi
jb 0x495212
mov esi, 0x406520
push esi
call fcn.004c5942
pop ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
mov esi, ebx
mov dword [esp + 0x10], esi
cmp eax, 0xffffffff
je 0x4954ae
jmp 0x4954a7
push esi
push 0x270c013b
jmp 0x49549d
push esi
push 0x2709013b
jmp 0x49549d
call fcn.004c73cc
push dword [esp + 0x20]
mov esi, eax
xor edx, edx
push esi
xor ecx, ecx
mov dword [esp + 0x18], esi
call fcn.004cfab1
push esi
push 0x2714013b
push dword [esp + 0x28]
call dword [sym.imp.certcli.dll_Ordinal_359]
jmp 0x4954a3
push eax
push 0x2701013b
jmp 0x49549d
push esi
push 0x26f9013b
jmp 0x49549d
mov ecx, 0xb08
call fcn.004cf8b9
push eax
call fcn.004c5942
push esi
call fcn.004c5942
pop ecx
pop ecx
mov ecx, ebx
mov dword [esp + 0x18], ecx
test edi, edi
je 0x49544d
push 0x208
lea eax, [esp + 0x694]
push eax
mov eax, dword [esp + 0x24]
mov edx, dword [eax + ecx*4]
mov ecx, dword [esp + 0x2c]
call fcn.0049472e
mov esi, eax
mov dword [esp + 0x10], esi
test esi, esi
jne 0x495482
lea eax, [esp + 0x690]
push eax
push 0x4056e4
call fcn.004c5942
pop ecx
pop ecx
mov ecx, dword [esp + 0x18]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, edi
jb 0x495400
mov esi, 0x406520
push esi
call fcn.004c5942
mov dword [esp], 0x406844
mov ecx, 0xb09
push 0x40ee10
push 0x41f284
call fcn.004cf8b9
push eax
call fcn.004c5942
push esi
call fcn.004c5942
add esp, 0x14
jmp 0x49535d
push esi
push 0x2728013b
jmp 0x49549d
mov ecx, eax
call fcn.004c738c
mov esi, eax
push esi
push 0x26e2013b
mov dword [esp + 0x18], esi
call dword [sym.imp.certcli.dll_Ordinal_357]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test edi, edi
je 0x4954c8
mov esi, dword [esp + 0x1c]
push dword [esi + ebx*4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc ebx
cmp ebx, edi
jb 0x4954b6
mov esi, dword [esp + 0x10]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0xcbc]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005036b0
mov esp, ebp
pop ebp
ret 4