Function at 0x4eb560
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4fc2fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xcb0
mov ax, word [0x52a480]
push ebp
push esi
push edi
mov word [esp + 0x8ac], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x8ae]
mov ebp, dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x51169c
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xcd0]
lea edx, [esp + 0x8b0]
push ecx
push 0x50f5ec
mov esi, 1
push 0x103
push edx
mov dword [esp + 0x20], esi
stosw word es:[edi], ax
call ebp
add esp, 0x14
lea eax, [esp + 0x24c]
lea ecx, [esp + 0x8ac]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x34], eax
jne 0x4eb5f7
xor eax, eax
jmp 0x4eb9dc
push ebx
lea ecx, [esp + 0x3c]
call fcn.004eb390
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x6aa]
mov dword [esp + 0xcc8], eax
mov word [esp + 0x6a8], ax
mov ebx, dword [esp + 0xcdc]
rep stosd dword es:[edi], eax
mov dword [esp + 0x34], esi
stosw word es:[edi], ax
mov eax, dword [0x6cf2e8]
mov ecx, 0x32
inc eax
mov dword [0x6cf2e8], eax
cdq
idiv ecx
test edx, edx
jne 0x4eb649
call fcn.004eb320
mov esi, dword [sym.imp.MSVCRT.dll_wcscmp]
lea edx, [esp + 0x27c]
push 0x511698
push edx
call esi
add esp, 8
test eax, eax
je 0x4eb7e5
lea eax, [esp + 0x27c]
push 0x511690
push eax
call esi
add esp, 8
test eax, eax
je 0x4eb7e5
test byte [esp + 0x250], 0x10
je 0x4eb6fa
mov cx, word [0x52a480]
xor eax, eax
mov word [esp + 0xab8], cx
mov ecx, 0x81
lea edi, [esp + 0xaba]
lea edx, [esp + 0x27c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0xcd0]
push edx
push eax
push 0x50fa9c
lea ecx, [esp + 0xac4]
push 0x103
push ecx
call ebp
mov edx, dword [esp + 0xcec]
mov eax, dword [esp + 0xce8]
push 1
push ebx
push edx
lea ecx, [esp + 0xad8]
push eax
push ecx
call fcn.004eb560
add esp, 0x28
jmp 0x4eb7e1
mov dx, word [0x52a480]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x4a]
mov word [esp + 0x48], dx
lea edx, [esp + 0x48]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xcd0]
stosw word es:[edi], ax
lea eax, [esp + 0x27c]
push eax
push ecx
push 0x50f5ec
push 0x103
push edx
call ebp
mov eax, dword [esp + 0xce8]
add esp, 0x14
test eax, eax
je 0x4eb74d
cmp eax, 1
jne 0x4eb7e5
mov eax, dword [esp + 0xcd8]
test eax, eax
je 0x4eb7b5
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov esi, eax
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x6a8]
rep stosd dword es:[edi], eax
push esi
push str._s
lea ecx, [esp + 0x6b0]
push 0x103
push ecx
call ebp
add esp, 0x10
test esi, esi
je 0x4eb7ab
mov eax, dword [esp + 0xcd8]
lea edx, [esp + 0x6a8]
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x4eb7b5
mov dword [esp + 0x34], 0
jmp 0x4eb7e5
lea ecx, [esp + 0x48]
push 0x20
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test ebx, ebx
je 0x4eb7d6
lea edx, [esp + 0x48]
lea ecx, [esp + 0x3c]
push edx
call fcn.004eb510
jmp 0x4eb7e5
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x250]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4eb62d
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x3c]
call fcn.004485e0
test ebx, ebx
mov esi, eax
je 0x4eb870
test esi, esi
je 0x4eb870
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
jbe 0x4eb870
call fcn.004eb320
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x14]
xor eax, eax
push ecx
mov dword [esp + 0x2e], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], esi
mov word [esp + 0x28], 0x454
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0xcd0]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x4a2]
mov word [esp + 0x4a0], 0
push edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str._sfavorder3.dat
lea eax, [esp + 0x4a8]
push 0x103
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x4a0]
push 0x20
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor esi, esi
cmp ebx, esi
je 0x4eb905
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x4a0]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
mov dword [esp + 0x2a], esi
push eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x32], esi
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], edx
mov word [esp + 0x28], 0x454
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xcd4]
cmp eax, esi
je 0x4eb919
cmp eax, 2
jne 0x4eb9c3
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x4a]
mov word [esp + 0x48], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [esp + 0xcd0]
lea ecx, [esp + 0x48]
push edi
push 0x50f4e4
push 0x103
push ecx
call ebp
lea edx, [esp + 0x58]
push edx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0x14
mov word [esp + eax*2 + 0x46], si
lea eax, [esp + 0x48]
push 0x20
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp ebx, esi
je 0x4eb9b8
cmp dword [esp + 0xce0], esi
je 0x4eb9b8
cmp dword [esp + 0x34], esi
je 0x4eb9b8
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x48]
push edx
stosw word es:[edi], ax
mov dword [esp + 0x2e], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x32], esi
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], ecx
mov word [esp + 0x28], 0x454
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
jmp 0x4eb9bf
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0xcc8], 0xffffffff
call fcn.004eb3a0
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [esp + 0xcbc]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0xcbc
ret