Function at 0x1d17b92
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov eax, 0x1d5878e
call fcn.01d55708
sub esp, 0x1a0
and dword [ebp - 0x10], 0
push esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_316]
push 0x7ab7dc6b
lea ecx, [ebp - 0x26]
call fcn.01d2241c
push dword [ebp + 8]
mov esi, dword [sym.imp.mfc100.dll_Ordinal_4283]
push dword [ebp + 0xc]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x18]
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x1ac]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
je 0x1d17e03
push ebx
mov eax, 0x1d65c70
push edi
sub eax, 0x4d5ebf2f
push eax
lea ecx, [ebp - 0x26]
call fcn.01d22457
lea ecx, [ebp - 0x180]
push ecx
push dword [ebp + 0xc]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x14]
push eax
call esi
mov edi, dword [ebp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
add esp, 0x10
mov byte [ebp - 4], 3
test edi, edi
je 0x1d17cce
push 0x12693b6d
lea ecx, [ebp - 0x2d]
call fcn.01d22494
push eax
lea eax, [ebp - 0x180]
push eax
mov dword [ebp - 0x10], 1
call ebx
test eax, eax
je 0x1d17cb4
push 0x4cc9b6b2
lea ecx, [ebp - 0x39]
call fcn.01d224cf
push eax
lea eax, [ebp - 0x180]
push eax
mov dword [ebp - 0x10], 3
call ebx
test eax, eax
je 0x1d17cb4
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
lea ecx, [ebp - 0x6c]
push ecx
push eax
call dword [sym.imp.MSVCR100.dll__stat64i32]
pop ecx
pop ecx
test eax, eax
jne 0x1d17cb4
cmp dword [ebp - 0x58], edi
jne 0x1d17cb4
mov al, 1
jmp 0x1d17cb6
xor al, al
test byte [ebp - 0x10], 2
je 0x1d17cc0
and dword [ebp - 0x10], 0xfffffffd
test byte [ebp - 0x10], 1
je 0x1d17cca
and dword [ebp - 0x10], 0xfffffffe
test al, al
je 0x1d17cde
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x1ac]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1d17df8
mov dword [ebp - 0x1c], str._h_8m
sub dword [ebp - 0x1c], 0x7af9140d
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x26]
call fcn.01d2250a
lea ecx, [ebp - 0x180]
push ecx
push dword [ebp + 0xc]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x14]
push eax
call esi
xor eax, eax
lea edi, [ebp - 0x26]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 0x10]
add esp, 0x10
mov byte [ebp - 4], 3
test edi, edi
je 0x1d17dd0
mov eax, 0x1d65c94
sub eax, 0x20115f6b
push eax
lea ecx, [ebp - 0x2d]
call fcn.01d22545
or dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x180]
push eax
call ebx
test eax, eax
je 0x1d17da5
push 0x42452517
lea ecx, [ebp - 0x39]
call fcn.01d22582
or dword [ebp - 0x10], 8
push eax
lea eax, [ebp - 0x180]
push eax
call ebx
test eax, eax
je 0x1d17da5
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
lea ecx, [ebp - 0x6c]
push ecx
push eax
call dword [sym.imp.MSVCR100.dll__stat64i32]
pop ecx
pop ecx
test eax, eax
jne 0x1d17da5
cmp dword [ebp - 0x58], edi
jne 0x1d17da5
mov cl, 1
jmp 0x1d17da7
xor cl, cl
test byte [ebp - 0x10], 8
je 0x1d17db9
and dword [ebp - 0x10], 0xfffffff7
xor eax, eax
lea edi, [ebp - 0x39]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test byte [ebp - 0x10], 4
je 0x1d17dcc
and dword [ebp - 0x10], 0xfffffffb
xor eax, eax
lea edi, [ebp - 0x2d]
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
test cl, cl
je 0x1d17de0
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x1ac]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1d17d04
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop ebx
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 0xc