Function at 0x4ec450
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x50c24d
mov eax, dword fs:[0]
push eax
sub esp, 0xa18
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0xa14], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0xa2c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x20], fcn.004ed893
mov dword [esp + 0x24], fcn.004ee443
mov dword [esp + 0x28], fcn.004ed7b6
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0x1fff8
mov dword [esp + 0x1c], vtable.t_heap.0
lea ecx, [esp + 0x180]
mov dword [esp + 0xa34], ebx
call fcn.0041dc00
lea ecx, [esp + 0x2a4]
mov byte [esp + 0xa34], 1
call fcn.0041dc00
lea ecx, [esp + 0x34]
mov byte [esp + 0xa34], 2
call fcn.004131f0
lea ecx, [esp + 0x14]
mov byte [esp + 0xa34], 3
call fcn.004163c0
push str.UserManager
mov byte [esp + 0xa38], 4
call fcn.00405400
add esp, 4
mov esi, eax
call fcn.004a28f0
mov edi, eax
cmp edi, ebx
je 0x4ec7f9
cmp esi, ebx
je 0x4ec7f9
lea eax, [esp + 0xa3c]
push eax
lea ecx, [esp + 0x60]
push ecx
mov ecx, esi
call fcn.004a50b0
push eax
lea ecx, [esp + 0x184]
mov byte [esp + 0xa38], 5
call fcn.0041e350
lea ecx, [esp + 0x5c]
mov byte [esp + 0xa34], 4
call fcn.00417650
lea edx, [esp + 0x180]
push edx
lea ecx, [esp + 0x2a8]
call fcn.0041e350
push ebx
push ebx
push ebx
push ebx
push ebx
push str.AllSkin
lea ecx, [esp + 0x74]
call fcn.0041dc60
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x184]
mov byte [esp + 0xa38], 6
call fcn.0041e2c0
lea ecx, [esp + 0x5c]
mov byte [esp + 0xa34], 4
call fcn.00417650
lea ecx, [esp + 0x180]
call fcn.0041e510
test al, al
je 0x4ec79a
mov ecx, dword [esp + 0xa3c]
push ecx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call fcn.004a2140
test al, al
je 0x4ec79a
push 0x547620
lea ecx, [esp + 0x38]
call fcn.00415430
cmp eax, ebx
je 0x4ec79a
push eax
lea ecx, [esp + 0x824]
push str._s.ssf
push ecx
call fcn.00411b10
add esp, 0xc
lea ecx, [esp + 0x180]
call fcn.00417d60
push eax
lea edx, [esp + 0x61c]
push str._s.
push edx
call fcn.00411b10
add esp, 0xc
lea eax, [esp + 0x3c8]
push eax
lea ecx, [esp + 0x61c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4ec79a
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x4ec670
mov ecx, 0x546720
lea eax, [esp + 0x3f4]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4ec6a6
cmp dx, bx
je 0x4ec6a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4ec6a6
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x4ec680
xor eax, eax
jmp 0x4ec6ab
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4ec780
mov ecx, 0x546724
lea eax, [esp + 0x3f4]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4ec6e6
cmp dx, bx
je 0x4ec6e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4ec6e6
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x4ec6c0
xor eax, eax
jmp 0x4ec6eb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4ec780
lea ecx, [esp + 0x820]
lea eax, [esp + 0x3f4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4ec727
cmp dx, bx
je 0x4ec723
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4ec727
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x4ec701
xor eax, eax
jmp 0x4ec72c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4ec780
lea edx, [esp + 0x3f4]
push edx
lea ecx, [esp + 0x184]
call fcn.00417d60
push eax
lea eax, [esp + 0x620]
push 0x54672c
push eax
call fcn.00411b10
add esp, 0x10
test byte [esp + 0x3c8], 0x10
je 0x4ec776
lea ecx, [esp + 0x618]
push ecx
call fcn.00421720
add esp, 4
jmp 0x4ec780
lea edx, [esp + 0x618]
push edx
call ebp
lea eax, [esp + 0x3c8]
push eax
push esi
call edi
test eax, eax
jne 0x4ec670
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x14]
mov byte [esp + 0xa34], 3
call fcn.004163d0
lea ecx, [esp + 0x34]
mov byte [esp + 0xa34], 2
call fcn.00413260
lea ecx, [esp + 0x2a4]
mov byte [esp + 0xa34], 1
call fcn.00417650
lea ecx, [esp + 0x180]
mov byte [esp + 0xa34], bl
call fcn.00417650
lea ecx, [esp + 0x1c]
mov dword [esp + 0xa34], 0xffffffff
call fcn.00422cf0
jmp 0x4ec850
lea ecx, [esp + 0x14]
mov byte [esp + 0xa34], 3
call fcn.004163d0
lea ecx, [esp + 0x34]
mov byte [esp + 0xa34], 2
call fcn.00413260
lea ecx, [esp + 0x2a4]
mov byte [esp + 0xa34], 1
call fcn.00417650
lea ecx, [esp + 0x180]
mov byte [esp + 0xa34], bl
call fcn.00417650
jmp 0x4ec850
mov ecx, dword [esp + 0xa2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa14]
xor ecx, esp
call fcn.004ecddb
add esp, 0xa24
ret 4