Function at 0x1006f9c0
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Get file attributes
Resolve function by parsing pe exports
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x1013c071
mov eax, dword fs:[0]
push eax
sub esp, 0x734
mov eax, dword [0x10170024]
xor eax, esp
mov dword [esp + 0x730], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10170024]
xor eax, esp
push eax
lea eax, [esp + 0x748]
mov dword fs:[0], eax
mov eax, dword [esp + 0x758]
mov dword [esp + 0x18], eax
mov dword [esp + 0x750], 0
cmp dword [esp + 0x770], 2
lea ecx, [esp + 0x75c]
jb 0x1006fc43
push ecx
lea ecx, [esp + 0x90]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov byte [esp + 0x750], 1
mov edx, dword [esp + 0x770]
push 1
add edx, 0xffffffff
push edx
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x768]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::substr_unsigned_int__unsigned_int_]
lea ecx, [esp + 0x70]
mov byte [esp + 0x750], 2
mov ebp, dword [sym.imp.MSVCP80.dll_bool___cdecl_std::operator__wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___wchar_t_const__]
push 0x1014bdb4
push ecx
call ebp
add esp, 8
test al, al
je 0x1006faa1
lea edx, [esp + 0x70]
push 0x101522ec
push edx
call ebp
add esp, 8
test al, al
je 0x1006faa1
push 0x1014bdb4
lea ecx, [esp + 0x760]
call dword [0x101464cc]
push 0x1014bda0
lea ecx, [esp + 0x760]
call dword [0x101464cc]
cmp dword [esp + 0x774], 8
mov eax, dword [esp + 0x760]
jae 0x1006facb
lea eax, [esp + 0x760]
lea ecx, [esp + 0xc4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x14], esi
jne 0x1006faf0
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1006fc15
lea edx, [esp + 0xc4]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1006fc0e
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x20]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov byte [esp + 0x750], 3
mov ecx, 0x1014bdac
lea eax, [esp + 0xf0]
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1006fb56
test dx, dx
je 0x1006fb52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1006fb56
add eax, 4
add ecx, 4
test dx, dx
jne 0x1006fb30
xor eax, eax
jmp 0x1006fb5b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1006fbe5
mov ecx, 0x1014bda8
lea eax, [esp + 0xf0]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1006fb96
test dx, dx
je 0x1006fb92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1006fb96
add eax, 4
add ecx, 4
test dx, dx
jne 0x1006fb70
xor eax, eax
jmp 0x1006fb9b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1006fbe5
test byte [esp + 0xc4], 0x10
jne 0x1006fbe5
lea ecx, [esp + 0xf0]
push ecx
lea ecx, [esp + 0x3c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov ebx, 4
mov byte [esp + 0x750], bl
mov eax, dword [esp + 0x4c]
cmp eax, ebx
lea ecx, [esp + 0x38]
jae 0x1006fc7e
mov byte [esp + 0x750], 3
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x750], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea edx, [esp + 0xc4]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1006fb07
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x70]
mov byte [esp + 0x750], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x8c]
mov byte [esp + 0x750], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x75c]
mov dword [esp + 0x750], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x748]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x730]
xor ecx, esp
call fcn.1012d370
add esp, 0x740
ret 0x20
push ebx
add eax, 0xfffffffc
push eax
lea edx, [esp + 0x5c]
push edx
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::substr_unsigned_int__unsigned_int_]
lea eax, [esp + 0x54]
push str..adi
push eax
mov byte [esp + 0x758], 5
call ebp
add esp, 8
test al, al
je 0x1006fcde
lea ecx, [esp + 0x54]
push str..afi
push ecx
call ebp
add esp, 8
test al, al
je 0x1006fcde
lea ecx, [esp + 0x54]
mov byte [esp + 0x750], bl
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov byte [esp + 0x750], 3
lea ecx, [esp + 0x38]
jmp 0x1006fbdf
mov edx, dword [esp + 0x30]
push 1
add edx, 0xffffffff
push edx
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::substr_unsigned_int__unsigned_int_]
lea ecx, [esp + 0xa8]
push 0x1014bdb4
push ecx
mov byte [esp + 0x758], 6
call ebp
add esp, 8
test al, al
je 0x1006fd3d
lea edx, [esp + 0xa8]
push 0x101522ec
push edx
call ebp
add esp, 8
test al, al
je 0x1006fd3d
push 0x1014bdb4
lea ecx, [esp + 0x20]
call dword [0x101464cc]
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x20]
call dword [0x101464c8]
mov eax, dword [esp + 0x30]
xor ecx, ecx
add eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR80.dll_void____cdecl_operator_new___unsigned_int_
mov esi, eax
mov eax, dword [esp + 0x34]
lea ecx, [eax + eax + 2]
push ecx
push 0
push esi
call sub.MSVCR80.dll_memset
mov eax, dword [esp + 0x40]
xor ecx, ecx
add eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR80.dll_void____cdecl_operator_new___unsigned_int_
mov edi, eax
mov eax, dword [esp + 0x44]
lea ecx, [eax + eax + 2]
push ecx
push 0
push edi
call sub.MSVCR80.dll_memset
mov edx, dword [esp + 0x40]
add esp, 0x20
cmp dword [esp + 0x34], 8
jae 0x1006fdbe
lea edx, [esp + 0x20]
mov ecx, edi
movzx eax, word [edx]
mov word [ecx], ax
add edx, 2
add ecx, 2
test ax, ax
jne 0x1006fdc0
mov ebx, dword [esp + 0x30]
add ebx, 1
mov edx, edi
mov eax, esi
call fcn.10001650
mov edx, dword [esp + 0x18]
mov ecx, dword [edx + 0x1c]
mov eax, dword [ecx]
mov eax, dword [eax + 0xe8]
lea edx, [esp + 0x314]
push edx
push esi
call eax
push esi
mov ebx, eax
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
movzx ecx, bx
add esp, 8
cmp ecx, 0x1008
jne 0x1006fe64
mov eax, dword [esp + 0x20]
mov esi, 8
cmp dword [esp + 0x34], esi
jae 0x1006fe2a
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1006fe4f
mov ecx, dword [esp + 0x20]
and eax, 0xfffffffe
cmp dword [esp + 0x34], esi
jae 0x1006fe47
lea ecx, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [esp + 0x34], esi
mov eax, dword [esp + 0x20]
jae 0x1006fe5d
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0xa8]
mov byte [esp + 0x750], 5
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x54]
mov byte [esp + 0x750], 4
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x38]
mov byte [esp + 0x750], 3
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x750], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov esi, dword [esp + 0x14]
jmp 0x1006fbf7