Function at 0x1001c159
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10126628
push fcn.10062700
mov eax, dword fs:[0]
push eax
push ecx
push ecx
mov eax, 0x226c
call fcn.1005e2a0
mov eax, dword [0x10130aa4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2274], edi
xor esi, esi
mov ebx, esi
mov dword [ebp - 0x2270], ebx
xor eax, eax
mov word [ebp - 0x101c], ax
push edi
push 0x800
lea eax, [ebp - 0x101c]
push eax
call fcn.1008aa23
add esp, 0xc
xor eax, eax
cmp dword [ebp + 0x10], ebx
je 0x1001c1d0
inc eax
jmp 0x1001c1d9
cmp dword [ebp + 0x14], eax
setne al
add eax, 2
mov dword [ebp - 0x227c], eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x2278], esi
cmp esi, eax
jge 0x1001c374
xor eax, eax
mov word [ebp - 0x201c], ax
push edi
push 0x800
lea eax, [ebp - 0x201c]
push eax
call fcn.1008aa23
imul eax, esi, 0x1e
add eax, str.npoji.dll
push eax
push 0x800
lea eax, [ebp - 0x201c]
push eax
call fcn.1008aa23
add esp, 0x18
lea eax, [ebp - 0x226c]
push eax
lea eax, [ebp - 0x201c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2280], eax
cmp eax, 0xffffffff
je 0x1001c368
lea eax, [ebp - 0x2240]
push eax
push 0x800
lea eax, [ebp - 0x101c]
push eax
call fcn.1008aa23
add esp, 0xc
cmp dword [ebp + 0x10], 0
je 0x1001c297
lea eax, [ebp - 0x101c]
push eax
call fcn.100341af
pop ecx
test eax, eax
je 0x1001c297
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x10130aa4
call fcn.100662f0
add esp, 0xc
xor eax, eax
jmp 0x1001c3c5
cmp dword [ebp + 0xc], 0
je 0x1001c2bd
lea eax, [ebp - 0x2240]
push eax
push edi
push dword [ebp + 0xc]
call fcn.1001ad07
add esp, 0xc
test eax, eax
jne 0x1001c2bd
mov word [ebp - 0x101c], ax
jmp 0x1001c332
push 0x804
call fcn.1005e144
pop ecx
mov ecx, eax
mov dword [ebp - 0x2284], ecx
test ecx, ecx
je 0x1001c27d
xor eax, eax
mov word [ecx], ax
lea edx, [ebp - 0x101c]
mov esi, edx
xor edi, edi
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x1001c2e3
sub edx, esi
lea edi, [ecx - 2]
xor ecx, ecx
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x1001c2f5
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x2284]
mov dword [eax + 0x800], ebx
mov ebx, eax
mov dword [ebp - 0x2270], ebx
xor eax, eax
mov word [ebp - 0x101c], ax
mov edi, dword [ebp - 0x2274]
push edi
push 0x800
lea eax, [ebp - 0x101c]
push eax
call fcn.1008aa23
add esp, 0xc
lea eax, [ebp - 0x226c]
push eax
push dword [ebp - 0x2280]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1001c24b
mov esi, dword [ebp - 0x2278]
inc esi
mov eax, dword [ebp - 0x227c]
jmp 0x1001c1e2
test ebx, ebx
je 0x1001c3b6
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1001c399
push ebx
call fcn.100341af
pop ecx
test eax, eax
je 0x1001c399
xor eax, eax
push eax
push ebx
call fcn.1001af5d
pop ecx
pop ecx
mov esi, dword [ebx + 0x800]
push 0x804
push ebx
call fcn.1005e174
pop ecx
pop ecx
mov ebx, esi
mov dword [ebp - 0x2270], ebx
jmp 0x1001c374
mov dword [ebp - 4], 0xfffffffe
call fcn.1001c3e5
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005e187
leave
ret