Function at 0x20016852
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, 0x2009c205
call fcn.2007d394
sub esp, 0x1d0
mov eax, dword [0x200cc84c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
xor eax, ebp
mov edi, ecx
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x194], ebx
mov dword [ebp - 0x30], 0xf
call fcn.20001bc0
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x20016ad3
push esi
lea ecx, [ebp - 0x2c]
call fcn.20003c27
mov byte [ebp - 4], 1
xor esi, esi
inc esi
push esi
push ebx
lea eax, [ebp - 0x18c]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x18c], 0x2a
call fcn.200017e0
push esi
mov dword [ebp - 0x190], eax
push ebx
lea eax, [ebp - 0x18c]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x18c], 0x3f
call fcn.200017e0
cmp dword [ebp - 0x190], ebx
jge 0x20016952
cmp eax, ebx
jge 0x20016952
push esi
push ebx
lea eax, [ebp - 0x18c]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x18c], 0x5c
call fcn.200017e0
cmp eax, ebx
jge 0x2001693e
push 0x200a6718
add edi, 4
lea eax, [ebp - 0x1c0]
push edi
push eax
call fcn.20014e68
add esp, 0xc
mov byte [ebp - 4], 6
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x48]
call fcn.20002fc3
mov byte [ebp - 4], 1
push ebx
push esi
lea ecx, [ebp - 0x1c0]
call fcn.2000275e
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x48]
call fcn.20008e33
jmp 0x20016ac4
push 0x200a6718
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0x1dc]
push eax
call fcn.20014e68
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
push ecx
push eax
lea eax, [ebp - 0x1c0]
push eax
call fcn.2001626b
add esp, 0x18
mov byte [ebp - 4], 3
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2c]
call fcn.20002fc3
mov byte [ebp - 4], 2
push ebx
push esi
lea ecx, [ebp - 0x1c0]
call fcn.2000275e
mov byte [ebp - 4], 1
push ebx
push esi
lea ecx, [ebp - 0x1dc]
call fcn.2000275e
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x198], ebx
jae 0x200169c3
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x188]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x190], eax
jne 0x200169f0
mov byte [ebp - 4], bl
push ebx
push esi
lea ecx, [ebp - 0x2c]
call fcn.2000275e
xor edi, edi
jmp 0x20016b10
lea ecx, [ebp - 0x1a4]
call fcn.20001fcb
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], ebx
mov byte [ebp - 4], 4
lea eax, [ebp - 0x15c]
push eax
lea ecx, [ebp - 0x1c0]
call fcn.20003c27
mov byte [ebp - 4], 5
lea eax, [ebp - 0x1c0]
push eax
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0x1a4]
call fcn.20006211
mov byte [ebp - 4], 4
push ebx
push esi
lea ecx, [ebp - 0x1c0]
call fcn.2000275e
lea eax, [ebp - 0x188]
push eax
push dword [ebp - 0x190]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x20016a72
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x20016a7a
mov dword [ebp - 0x198], esi
cmp dword [ebp - 0x198], ebx
je 0x20016a0b
push dword [ebp - 0x190]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x1a0]
mov esi, dword [eax]
cmp esi, eax
je 0x20016ab2
cmp dword [esi + 0x20], 0x10
jb 0x20016a9d
mov eax, dword [esi + 0xc]
jmp 0x20016aa0
lea eax, [esi + 0xc]
push eax
mov ecx, edi
call fcn.20016852
mov esi, dword [esi]
cmp esi, dword [ebp - 0x1a0]
jne 0x20016a92
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1a4]
call fcn.2000447d
xor esi, esi
inc esi
mov byte [ebp - 4], bl
push ebx
push esi
lea ecx, [ebp - 0x2c]
call fcn.2000275e
jmp 0x20016aec
push 0xffffffffffffffff
push ebx
lea eax, [edi + 0x20]
push eax
lea ecx, [ebp - 0x48]
call fcn.20002fc3
mov ecx, edi
call fcn.200164a6
xor esi, esi
inc esi
cmp dword [ebp - 0x34], ebx
je 0x20016b0a
cmp dword [ebp - 0x30], 0x10
mov eax, dword [ebp - 0x44]
jae 0x20016afd
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x194], eax
mov edi, dword [ebp - 0x194]
or dword [ebp - 4], 0xffffffff
push ebx
push esi
lea ecx, [ebp - 0x48]
call fcn.2000275e
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.2007c9ae
leave
ret 4