Function at 0x100fe55
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa98
mov eax, dword [0x1035030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push 0x24c
mov dword [ebp - 0xa98], eax
lea eax, [ebp - 0xa80]
push ebx
push eax
mov dword [ebp - 0xa8c], ecx
mov dword [ebp - 0xa84], ebx
call sub.msvcrt.dll_memset
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x824], ax
lea eax, [ebp - 0x822]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x834], ebx
lea edi, [ebp - 0x830]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push esi
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push ebx
push eax
mov dword [ebp - 0xa90], ebx
mov dword [ebp - 0xa88], ebx
call sub.msvcrt.dll_memset
add esp, 0x3c
push ebx
push ebx
lea eax, [ebp - 0x61c]
push eax
push 0x10028e0
call fcn.01014d1d
mov edi, eax
cmp edi, ebx
jge 0x100ff62
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010283
test byte [eax + 0x1c], 1
je 0x1010283
push edi
push 0x1002b5c
push 0x21
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004eb4
jmp 0x1010283
push ebx
push ebx
lea eax, [ebp - 0x824]
push eax
push 0x10022ac
call fcn.01014d1d
mov edi, eax
cmp edi, ebx
jge 0x100ff9f
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010283
test byte [eax + 0x1c], 1
je 0x1010283
push edi
push 0x1002b5c
push 0x22
jmp 0x100ff52
push 0x1003320
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x100ffe3
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010283
test byte [eax + 0x1c], 1
je 0x1010283
push edi
push 0x1002b5c
push 0x23
jmp 0x100ff52
lea eax, [ebp - 0xa84]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xa94], eax
cmp eax, 0xffffffff
jne 0x1010034
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x101002d
test byte [eax + 0x1c], 4
je 0x101002d
lea ecx, [ebp - 0x414]
push ecx
push 0x1002b5c
push 0x24
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004ee0
xor edi, edi
jmp 0x1010283
cmp dword [ebp - 0xa84], 0x10
je 0x101022c
lea eax, [ebp - 0xa58]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x1010091
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010215
test byte [eax + 0x1c], 1
je 0x1010215
push 0x1002b5c
push 0x25
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004e8e
jmp 0x1010215
push 0x844
call fcn.01011b9e
pop ecx
cmp eax, ebx
je 0x10100ad
push 1
mov ecx, eax
call fcn.0100bcee
mov esi, eax
jmp 0x10100af
xor esi, esi
mov dword [ebp - 0xa88], esi
cmp esi, ebx
je 0x1010249
mov eax, dword [ebp - 0xa8c]
push dword [eax + 0x194]
lea eax, [ebp - 0x20c]
push eax
push ebx
mov ecx, esi
call fcn.0101cc02
mov edi, eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1010116
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x101011b
test byte [eax + 0x1c], 1
je 0x101011b
lea ecx, [ebp - 0x20c]
push ecx
push 0x1002b5c
push 0x27
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004ee0
mov eax, dword [0x1035014]
cmp edi, ebx
jge 0x1010152
cmp eax, 0x1035014
je 0x1010215
test byte [eax + 0x1c], 2
je 0x1010215
lea ecx, [ebp - 0x20c]
push ecx
push 0x1002b5c
push 0x28
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004ee0
jmp 0x1010215
push 0x40
mov ecx, esi
call fcn.0101a614
mov edi, eax
cmp edi, ebx
jge 0x1010188
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010215
test byte [eax + 0x1c], 1
je 0x1010215
push edi
push 0x1002b5c
push 0x29
jmp 0x101020a
mov ecx, dword [ebp - 0xa8c]
lea eax, [ebp - 0xa90]
push eax
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0100cd7f
mov edi, eax
cmp edi, ebx
jge 0x10101ca
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010215
test byte [eax + 0x1c], 1
je 0x1010215
push edi
push 0x1002b5c
push 0x2a
jmp 0x101020a
mov ecx, dword [ebp - 0xa8c]
push ebx
push dword [ebp - 0xa98]
lea eax, [ebp - 0x834]
push dword [ebp - 0xa90]
push eax
push esi
call fcn.0100f95a
mov edi, eax
cmp edi, ebx
jge 0x1010215
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010215
test byte [eax + 0x1c], 1
je 0x1010215
push edi
push 0x1002b5c
push 0x2b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004eb4
mov ecx, dword [ebp - 0xa88]
cmp ecx, ebx
je 0x101022c
push 1
call fcn.0100bfb1
mov dword [ebp - 0xa88], ebx
lea eax, [ebp - 0xa84]
push eax
push dword [ebp - 0xa94]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1010034
jmp 0x1010277
mov edi, 0x8007000e
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1010277
test byte [eax + 0x1c], 1
je 0x1010277
push 0x844
push 0x1002b5c
push 0x26
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004eb4
push dword [ebp - 0xa94]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01011f27
leave
ret 4