Function at 0x11de1330
Capabilities:
Delete file
Enumerate files on windows
Move file
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11fb697b
push eax
mov dword fs:[0], esp
sub esp, 0x87c
push ebx
mov ebx, dword [esp + 0x890]
push ebp
xor ebp, ebp
cmp ebx, ebp
push esi
je 0x11de17ab
push ebx
call fcn.11e67d05
mov esi, eax
add esp, 4
cmp esi, ebp
je 0x11de17ab
cmp esi, 0x104
jae 0x11de17ab
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x22e]
mov word [esp + 0x22c], bp
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x230]
push ebx
push eax
call fcn.11e674bf
lea eax, [esp + esi*2 + 0x238]
add esp, 0xc
cmp word [eax - 2], 0x5c
je 0x11de13be
mov word [eax], 0x5c
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x686]
mov word [esp + 0x684], bp
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x22c]
push 0x104
lea edx, [esp + 0x688]
push ecx
push edx
stosw word es:[edi], ax
call fcn.11e674bf
lea eax, [esp + 0x690]
push str.Delete_
push eax
call fcn.11e67470
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x44c]
mov dword [esp + 0x448], ebp
rep stosd dword es:[edi], eax
add esp, 0x14
lea ecx, [esp + 0x434]
lea edx, [esp + 0x684]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x14], ebx
je 0x11de17a3
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x26]
mov word [esp + 0x24], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x24]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x230]
lea ecx, [esp + 0x28]
push eax
push ecx
call fcn.11e674bf
lea edx, [esp + 0x46c]
lea eax, [esp + 0x30]
push edx
push eax
call fcn.11e67470
mov eax, dword [esp + 0x448]
add esp, 0x14
xor edi, edi
test al, 0x10
jne 0x11de1785
test al, 1
je 0x11de14b3
and al, 0xfe
lea ecx, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
push 0x1212c930
lea ecx, [esp + 0x20]
call fcn.11e8c590
lea edx, [esp + 0x24]
mov dword [esp + 0x894], ebp
push edx
call fcn.11e84b40
xor edx, edx
div dword [0x1212c91c]
mov eax, dword [0x1212c918]
cmp eax, ebp
je 0x11de150f
mov esi, dword [eax + edx*4]
cmp esi, ebp
je 0x11de150f
mov ecx, dword [esi + 8]
lea eax, [esp + 0x24]
push eax
push ecx
call fcn.11e67e01
add esp, 8
cmp eax, ebp
je 0x11de150b
mov esi, dword [esi]
cmp esi, ebp
jne 0x11de14ec
xor esi, esi
jmp 0x11de1521
cmp esi, ebp
jne 0x11de1513
xor esi, esi
jmp 0x11de1521
mov edx, dword [esi + 0xc]
mov esi, 1
mov dword [esp + 0x10], edx
mov edi, edx
cmp dword [0x12133f80], ebp
je 0x11de154a
mov eax, dword [0x12126854]
push esi
lea ecx, [esp + 0x28]
push edi
push ecx
push eax
push str.__s__CSDGlobalShare::DeleteOcularSDDeleteFile__s___DelFailCount__d___bFound__d__r_n
push str.SDGlobalShare
push 1
call fcn.11ca5810
add esp, 0x1c
cmp edi, 3
jb 0x11de1568
lea ecx, [esp + 0x18]
mov dword [esp + 0x894], 0xffffffff
call fcn.11e8c5f0
jmp 0x11de1785
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x11de1657
lea eax, [esp + 0x24]
inc edi
push eax
mov dword [esp + 0x14], edi
call fcn.11e84b40
xor edx, edx
div dword [0x1212c91c]
mov eax, dword [0x1212c918]
test eax, eax
mov ebp, edx
je 0x11de15ce
mov esi, dword [eax + ebp*4]
test esi, esi
je 0x11de15c5
mov edx, dword [esi + 8]
lea ecx, [esp + 0x24]
push ecx
push edx
call fcn.11e67e01
add esp, 8
test eax, eax
je 0x11de15c1
mov esi, dword [esi]
test esi, esi
jne 0x11de15a4
jmp 0x11de15c5
test esi, esi
jne 0x11de1637
mov eax, dword [0x1212c918]
test eax, eax
jne 0x11de1608
mov esi, dword [0x1212c91c]
lea ebx, [esi*4]
push ebx
call fcn.11e679bc
mov ecx, ebx
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [0x1212c918], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x10]
mov dword [0x1212c91c], esi
mov ecx, 0x1212c918
call fcn.11de70d0
mov esi, eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esi + 8]
mov dword [esi + 4], ebp
call fcn.11e7f500
mov ecx, dword [0x1212c918]
mov edx, dword [ecx + ebp*4]
mov dword [esi], edx
mov eax, dword [0x1212c918]
mov dword [eax + ebp*4], esi
cmp edi, 3
mov dword [esi + 0xc], edi
jb 0x11de176b
push 4
lea ecx, [esp + 0x28]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x11de176b
cmp esi, ebp
je 0x11de176b
cmp dword [0x1212c918], ebp
je 0x11de176b
lea edx, [esp + 0x24]
push edx
call fcn.11e84b40
xor edx, edx
div dword [0x1212c91c]
mov eax, dword [0x1212c918]
mov esi, dword [eax + edx*4]
cmp esi, ebp
lea edi, [eax + edx*4]
je 0x11de176b
mov edx, dword [esi + 8]
lea ecx, [esp + 0x24]
push ecx
push edx
call fcn.11e67e01
add esp, 8
cmp eax, ebp
je 0x11de16b2
mov edi, esi
mov esi, dword [esi]
cmp esi, ebp
jne 0x11de1690
jmp 0x11de176b
mov eax, dword [esi]
xor ebx, ebx
mov dword [edi], eax
lea edi, [esi + 8]
mov ecx, edi
call fcn.11e7f280
add edi, 4
mov ecx, ebx
dec ebx
test ecx, ecx
jne 0x11de16bb
mov edx, dword [0x1212c924]
mov dword [esi], edx
mov eax, dword [0x1212c920]
dec eax
mov dword [0x1212c924], esi
mov dword [0x1212c920], eax
jne 0x11de176b
mov eax, dword [0x1212c918]
xor ebp, ebp
cmp eax, ebp
je 0x11de173f
mov edx, dword [0x1212c91c]
mov dword [esp + 0x10], ecx
cmp edx, ebp
jbe 0x11de173f
mov ebx, dword [eax + ecx*4]
cmp ebx, ebp
je 0x11de1730
lea esi, [ebx + 8]
xor edi, edi
mov ecx, esi
call fcn.11e7f280
add esi, 4
mov eax, edi
dec edi
test eax, eax
jne 0x11de1710
mov ebx, dword [ebx]
cmp ebx, ebp
jne 0x11de170b
mov eax, dword [0x1212c918]
mov ecx, dword [esp + 0x10]
mov edx, dword [0x1212c91c]
inc ecx
cmp ecx, edx
mov dword [esp + 0x10], ecx
jb 0x11de1704
push eax
call fcn.11e679b1
mov ecx, dword [0x1212c928]
add esp, 4
mov dword [0x1212c918], ebp
mov dword [0x1212c920], ebp
mov dword [0x1212c924], ebp
call fcn.11e8aef0
mov dword [0x1212c928], ebp
lea ecx, [esp + 0x18]
mov dword [esp + 0x894], 0xffffffff
call fcn.11e8c5f0
mov ebx, dword [esp + 0x14]
xor ebp, ebp
lea ecx, [esp + 0x434]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x11de1457
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
pop edi
jmp 0x11de17ad
xor eax, eax
mov ecx, dword [esp + 0x888]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x888
ret