Function at 0x1009810
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Get file size
Print debug messages
Read file on windows
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x86c
mov eax, dword [0x100e6d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x103
push esi
xor edi, edi
lea eax, [ebp - 0x20b]
push edi
push eax
mov byte [ebp - 0x20c], 0
call fcn.0100b214
push esi
lea eax, [ebp - 0x517]
push edi
push eax
mov byte [ebp - 0x518], 0
call fcn.0100b214
push esi
lea eax, [ebp - 0x61b]
push edi
push eax
mov byte [ebp - 0x61c], 0
call fcn.0100b214
push esi
lea eax, [ebp - 0x107]
push edi
push eax
mov byte [ebp - 0x108], 0
call fcn.0100b214
add esp, 0x30
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
mov cl, byte [ebp + eax - 0x20c]
mov byte [ebp + eax - 0x518], cl
inc eax
test cl, cl
jne 0x100989a
mov esi, dword [sym.imp.msvcrt.dll__mbstok]
mov ebx, 0x1006468
lea eax, [ebp - 0x518]
push ebx
push eax
call esi
pop ecx
pop ecx
lea edx, [ebp - 0x20c]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x10098ca
push ebx
push edi
call esi
cmp eax, edi
jmp 0x1009924
lea edi, [ebp - 0x20c]
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10098e3
mov esi, ebx
movsw word es:[edi], word [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10098f1
lea edi, [ebp - 0x20c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1009901
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebx
push 0
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.msvcrt.dll__mbstok]
test eax, eax
pop ecx
pop ecx
jne 0x10098dc
xor eax, eax
mov cl, byte [ebp + eax - 0x20c]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x100992a
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1009944
mov esi, 0x1006934
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100995d
mov esi, 0x1006928
movsd dword es:[edi], dword [esi]
push 0x103
movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x310], al
lea eax, [ebp - 0x30f]
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.0100b214
add esp, 0xc
mov ebx, str.lgusbbus.sys
mov dword [ebp - 0x864], 0x19
xor eax, eax
mov cl, byte [ebp + eax - 0x108]
mov byte [ebp + eax - 0x310], cl
inc eax
test cl, cl
jne 0x100999a
mov eax, ebx
mov esi, ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10099b1
lea edi, [ebp - 0x310]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10099c1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x80
lea eax, [ebp - 0x310]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add ebx, 0x19
dec dword [ebp - 0x864]
jne 0x1009998
lea edi, [ebp - 0x20c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1009a08
mov esi, 0x1006920
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x20c]
movsw word es:[edi], word [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009a20
lea edi, [ebp - 0x61c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1009a30
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x20c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1009a4f
and dword [ebp - 0x868], 0
mov esi, 0x1006914
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x860]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x20c]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x864], eax
jne 0x1009a8c
xor al, al
jmp 0x1009c42
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x413]
push ebx
push eax
mov dword [ebp - 0x86c], ebx
mov byte [ebp - 0x414], bl
call fcn.0100b214
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax - 0x61c]
mov byte [ebp + eax - 0x414], cl
inc eax
test cl, cl
jne 0x1009ab1
lea eax, [ebp - 0x834]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009acc
lea edi, [ebp - 0x414]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1009adc
mov ecx, eax
shr ecx, 2
push ebx
rep movsd dword es:[edi], dword [esi]
push 0x80
push 3
push ebx
push 1
mov ecx, eax
push 0x80000000
lea eax, [ebp - 0x414]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1009a85
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea eax, [esi + 1]
push eax
call dword [sym.imp.msvcrt.dll_malloc]
mov ebx, eax
test ebx, ebx
pop ecx
je 0x1009c51
push 0
lea eax, [ebp - 0x86c]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1009c5d
push edi
mov byte [ebx + esi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, str.USBVID_1004PID_61A1
xor edi, edi
push esi
push ebx
call fcn.010081f1
test eax, eax
jne 0x1009b81
add edi, 0x64
add esi, 0x64
cmp edi, 0x834
jb 0x1009b66
jmp 0x1009bfe
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.0100b214
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax - 0x834]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x1009ba0
push 0x80
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x108]
push eax
call fcn.0100975b
test eax, eax
je 0x1009bfe
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x720]
push 0x1006908
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
lea eax, [ebp - 0x860]
push eax
push dword [ebp - 0x864]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1009c33
push dword [ebp - 0x864]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x868], 1
cmp dword [ebp - 0x868], 0
je 0x1009a8c
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100b1ff
leave
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1009a85
push ebx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x1009c51