Function at 0x10008e858
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xcf0
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0xce0], rax
mov r14, rcx
mov qword [rsp + 0x38], rcx
mov edi, r8d
mov rsi, rdx
lea rcx, [rsp + 0x54]
xor ebx, ebx
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0x50], ebx
call sub.msvcrt.dll_memset
lea r9, [0x10008e844]
lea r8d, [rbx + 8]
mov rdx, rdi
mov rcx, rsi
mov r15, rbx
mov r13d, ebx
mov rbp, rdi
call qword [sym.imp.msvcrt.dll_qsort]
mov r12d, reloc.certcli.dll_Ordinal_260
lea rcx, [rsp + 0x6b0]
mov r8, r14
mov rdx, r12
mov word [rsp + 0x6b0], bx
call fcn.100038b1c
mov edi, eax
cmp eax, ebx
je 0x10008e8f5
mov edx, 0x10d9013b
jmp 0x10008e934
lea rcx, [rsp + 0x6b0]
mov edx, r12d
call fcn.10008cfac
mov edi, eax
cmp eax, ebx
je 0x10008e912
mov edx, 0x10dc013b
jmp 0x10008e934
lea r8, [0x10001f450]
lea rcx, [rsp + 0x6b0]
mov rdx, r12
call fcn.100038a50
mov edi, eax
cmp eax, ebx
je 0x10008e941
mov edx, 0x10df013b
xor r9d, r9d
mov r8d, eax
xor ecx, ecx
call fcn.1000b51b8
cmp edi, ebx
je 0x10008e95c
xor r9d, r9d
mov r8d, edi
mov edx, 0x1329013b
xor ecx, ecx
call fcn.1000b51b8
jmp 0x10008eeca
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x6b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
mov qword [rsp + 0x30], rax
cmp rax, 0xffffffffffffffff
jne 0x10008e9a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x10008ee8e
cmp eax, 2
je 0x10008ee8e
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x1338013b
mov edi, eax
jmp 0x10008ed08
xor edi, edi
mov eax, dword [rsp + 0x50]
and eax, 0x10
cmp al, dil
jne 0x10008eab2
cmp di, word [rsp + 0x7c]
je 0x10008eab2
lea rax, [rsp + 0x7c]
lea rcx, [rsp + 0x40]
mov r9d, 8
mov qword [rsp + 0x40], rax
lea rax, [0x10008e844]
mov r8, rbp
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll_bsearch]
cmp rax, rdi
jne 0x10008eab2
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x7c]
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
cmp r13d, eax
jne 0x10008ea3e
lea edx, [rax + 8]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r15, rax
xor eax, eax
cmp r15, rax
jne 0x10008ea70
mov r8d, 0x8007000e
mov edx, 0x1355013b
mov edi, r8d
jmp 0x10008eead
cmp r13d, 0xf4240
jae 0x10008eb7b
lea edx, [r13 + 1]
mov r8d, 0x42
mov rcx, r15
shl rdx, 3
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
xor ecx, ecx
cmp rax, rcx
je 0x10008eb68
mov r15, rax
lea rdx, [rdi + rdi + 2]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
xor ecx, ecx
mov qword [rbx + r15], rax
cmp rax, rcx
je 0x10008eb55
lea r8, [rsp + 0x7c]
lea rdx, [rdi + 1]
mov rcx, rax
call fcn.100038b1c
inc r13d
add rbx, 8
mov edi, eax
xor eax, eax
cmp edi, eax
jne 0x10008eb48
xor edi, edi
lea rdx, [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, edi
jne 0x10008e9aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x10008ee9c
xor ebx, ebx
cmp r13d, ebx
je 0x10008ee8e
lea rcx, [0x10000c564]
call fcn.1000b99b0
cmp dword [0x10011bd00], 1
jle 0x10008ed6b
mov r12d, ebx
cmp r13d, ebx
jbe 0x10008ee80
mov r14, r15
mov ebp, 0x208
mov r8, qword [rsp + 0x38]
mov rsi, qword [r14]
xor eax, eax
lea rcx, [rsp + 0x2a0]
mov rdx, rbp
lea rbx, [rsp + 0x2a0]
mov word [rsp + 0x2a0], ax
call fcn.100038b1c
mov edi, eax
xor eax, eax
cmp edi, eax
je 0x10008eb8d
mov edx, 0x10d9013b
jmp 0x10008eba9
mov r8d, edi
mov edx, 0x137f013b
jmp 0x10008eead
mov r8d, 0x8007000e
mov edx, 0x1375013b
mov edi, r8d
jmp 0x10008eeaf
mov r8d, 0x8007000e
mov edx, 0x1364013b
mov edi, r8d
jmp 0x10008eeaf
mov edi, 0x80070216
mov edx, 0x136c013b
mov r8d, edi
jmp 0x10008eead
lea rcx, [rsp + 0x2a0]
mov edx, ebp
call fcn.10008cfac
mov edi, eax
xor eax, eax
cmp edi, eax
je 0x10008ebba
mov edx, 0x10dc013b
mov r8d, edi
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
xor esi, esi
jmp 0x10008ebe7
lea rcx, [rsp + 0x2a0]
mov r8, rsi
mov rdx, rbp
call fcn.100038a50
xor esi, esi
mov edi, eax
cmp eax, esi
je 0x10008ebe7
xor r9d, r9d
mov r8d, eax
mov edx, 0x10df013b
xor ecx, ecx
call fcn.1000b51b8
cmp edi, esi
jne 0x10008ed5e
mov ecx, 0x30c
call fcn.1000ba420
lea r8, [rsp + 0x2a0]
lea rcx, [0x1000184c0]
mov rdx, rax
call fcn.1000b99b0
xor ecx, ecx
mov r11, rbp
mov edi, ecx
lea rax, [rsp + 0x2a0]
cmp word [rax], cx
je 0x10008ec2e
add rax, 2
sub r11, 1
jne 0x10008ec1f
cmp r11, rcx
jne 0x10008ec3d
mov edi, 0x80070057
mov rax, rcx
jmp 0x10008ec43
mov rax, rbp
sub rax, r11
cmp edi, ecx
jne 0x10008ed51
inc rax
cmp rax, reloc.certcli.dll_Ordinal_260
jbe 0x10008ecdf
xor ebx, ebx
lea r8, [0x10001f460]
lea rax, [rsp + 0x8c0]
mov r9d, 0x20d
lea rcx, [rsp + 0x8c0]
sub r8, rax
mov rdx, r9
mov edi, ebx
lea rax, [rdx + 0x7ffffdf1]
cmp rax, rbx
je 0x10008eca4
movzx eax, word [r8 + rcx]
cmp ax, bx
je 0x10008eca4
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10008ec81
cmp rdx, rbx
jne 0x10008ecb2
sub rcx, 2
mov edi, 0x8007007a
mov word [rcx], bx
cmp edi, ebx
jne 0x10008ed1a
lea r8, [rsp + 0x2a0]
lea rcx, [rsp + 0x8c0]
mov rdx, r9
call fcn.100038a50
mov edi, eax
cmp eax, ebx
jne 0x10008ed03
lea rbx, [rsp + 0x8c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
cmp eax, ecx
je 0x10008ed24
inc r12d
add r14, 8
cmp r12d, r13d
jae 0x10008ee80
jmp 0x10008eb0f
mov edx, 0x13b7013b
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x10008eeb9
mov r8d, edi
mov edx, 0x13b4013b
jmp 0x10008ed0b
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov r9, rbx
xor edx, edx
mov r8d, eax
xor ecx, ecx
mov edi, eax
call fcn.1000ba5ac
mov r8d, edi
mov edx, 0x13bf013b
mov rcx, rbx
jmp 0x10008eeaf
mov r8d, edi
mov edx, 0x13ac013b
jmp 0x10008eeaf
mov r8d, edi
mov edx, 0x13a4013b
jmp 0x10008eead
mov ecx, 0xb08
call fcn.1000ba420
mov rcx, rax
call fcn.1000b99b0
lea rcx, [0x10000c564]
call fcn.1000b99b0
mov esi, ebx
cmp r13d, ebx
jbe 0x10008ee41
mov rbx, r15
mov ebp, 0x208
mov r12, qword [rbx]
xor eax, eax
lea rcx, [rsp + 0x2a0]
mov r8, r14
mov rdx, rbp
mov word [rsp + 0x2a0], ax
call fcn.100038b1c
mov edi, eax
xor eax, eax
cmp edi, eax
je 0x10008edce
mov r8d, edi
mov edx, 0x10d9013b
jmp 0x10008ee10
lea rcx, [rsp + 0x2a0]
mov edx, ebp
call fcn.10008cfac
mov edi, eax
xor eax, eax
cmp edi, eax
je 0x10008edef
mov r8d, edi
mov edx, 0x10dc013b
jmp 0x10008ee10
lea rcx, [rsp + 0x2a0]
mov r8, r12
mov rdx, rbp
call fcn.100038a50
mov edi, eax
test eax, eax
je 0x10008ee1a
mov r8d, eax
mov edx, 0x10df013b
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
test edi, edi
jne 0x10008ee92
lea rdx, [rsp + 0x2a0]
lea rcx, [0x100004a90]
call fcn.1000b99b0
inc esi
add rbx, 8
cmp esi, r13d
jb 0x10008ed9c
lea rcx, [0x10000c564]
call fcn.1000b99b0
mov ecx, 0xb09
call fcn.1000ba420
lea r9, [0x10000f250]
lea r8, [0x100012378]
lea rdx, [0x10001f470]
mov rcx, rax
call fcn.1000b99b0
lea rcx, [0x10000c564]
call fcn.1000b99b0
lea rcx, [0x10000c564]
call fcn.1000b99b0
xor ebx, ebx
mov edi, ebx
jmp 0x10008eeb9
mov r8d, edi
mov edx, 0x13d3013b
jmp 0x10008eead
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x138d013b
mov edi, eax
mov r8d, eax
xor ecx, ecx
xor r9d, r9d
call fcn.1000b51b8
xor ebx, ebx
mov rcx, qword [rsp + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x10008eeca
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp r13d, ebx
jbe 0x10008eee8
mov rbx, r15
mov esi, r13d
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
add rbx, 8
sub rsi, 1
jne 0x10008eed5
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov rcx, qword [rsp + 0xce0]
xor rcx, rsp
call fcn.1000ef870
mov rbx, qword [rsp + 0xd48]
add rsp, 0xcf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret