Function at 0x71e22981
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Get file attributes

Disassembly:
push 0x498
push 0x71e21480
call fcn.71e25664
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
or dword [ebp - 0x24], 0xffffffff
cmp dword [ebp + 8], edi
je 0x71e22c42
cmp dword [ebp + 0xc], edi
je 0x71e22c42
mov eax, dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jb 0x71e22c42
mov dword [ebp - 4], edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call fcn.71e228b5
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x71e22c16
mov esi, 0x104
push esi
push dword [ebp - 0x20]
lea eax, [ebp - 0x134]
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
call ebx
push dword [ebp - 0x20]
call sym.ntdsbcli.dll_DsBackupFree
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x134]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x71e22a00
sub eax, edi
mov dword [ebp - 0x138], eax
cmp byte [ebp + eax - 0x135], 0x5c
je 0x71e22a3b
lea edi, [ebp - 0x134]
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x71e22a20
mov esi, 0x71e2147c
movsw word es:[edi], word [esi]
inc eax
mov dword [ebp - 0x138], eax
mov esi, 0x104
mov ecx, dword [0x71e21474]
mov dword [ebp + eax - 0x134], ecx
mov ecx, dword [0x71e21478]
mov dword [ebp + eax - 0x130], ecx
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x71e22a89
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x71e22a89
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x13c], eax
jmp 0x71e22bff
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
call fcn.71e228b5
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x71e22c16
push esi
push dword [ebp - 0x20]
lea eax, [ebp - 0x24c]
push eax
call ebx
push esi
push dword [ebp - 0x20]
lea eax, [ebp - 0x35c]
push eax
call ebx
lea eax, [ebp - 0x24c]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x71e22ac3
sub eax, ecx
lea edi, [ebp - 0x24c]
dec edi
cmp byte [ebp + eax - 0x24d], 0x5c
jne 0x71e22aed
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x71e22add
mov esi, 0x71e2146c
movsd dword es:[edi], dword [esi]
jmp 0x71e22b12
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x71e22aed
mov esi, 0x71e21464
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x35c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x71e22b05
mov esi, 0x71e2147c
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x35c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x71e22b1d
sub eax, edx
lea esi, [ebp + eax - 0x35c]
mov dword [ebp - 0x360], esi
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
je 0x71e22c12
xor edi, edi
inc edi
mov dword [ebp - 0x4a4], edi
push 3
push 0x71e21460
lea eax, [ebp - 0x474]
push eax
call dword [sym.imp.msvcrt.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x71e22ba6
push 0x10
push eax
lea eax, [ebp - 0x471]
push eax
call dword [sym.imp.msvcrt.dll_strtoul]
add esp, 0xc
mov dword [ebp - 0x4a8], eax
cmp eax, dword [ebp + 0x10]
jb 0x71e22b9e
cmp eax, dword [ebp + 0x14]
ja 0x71e22b9e
xor eax, eax
jmp 0x71e22ba0
mov eax, edi
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 0
je 0x71e22bd6
lea ecx, [ebp - 0x474]
mov edx, esi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x71e22bb7
lea eax, [ebp - 0x35c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x71e22a78
lea eax, [ebp - 0x4a0]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x71e22b56
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x13c], eax
cmp eax, 0x12
je 0x71e22c12
test eax, eax
jle 0x71e22c0d
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x1c], eax
jmp 0x71e22c16
and dword [ebp - 0x1c], 0
or dword [ebp - 4], 0xffffffff
call fcn.71e22c24
mov eax, dword [ebp - 0x1c]
jmp 0x71e22c45
push 0x57
pop eax
call fcn.71e2569d
ret 0x10