Function at 0x10300c0
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Move file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x1530
call fcn.0105ee40
sub rsp, rax
mov rax, qword [0x010657f0]
xor rax, rsp
mov qword [rsp + 0x1520], rax
movzx eax, word [0x01001c38]
mov word [rsp + 0x10e0], ax
lea rax, [rsp + 0x10e2]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0x12f0], ax
lea rax, [rsp + 0x12f2]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0xa90], ax
lea rax, [rsp + 0xa92]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0xcb0], ax
lea rax, [rsp + 0xcb2]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0xed0], ax
lea rax, [rsp + 0xed2]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0x690], ax
lea rax, [rsp + 0x692]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0x40], ax
lea rax, [rsp + 0x42]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
mov dword [rsp + 0x1508], 0
mov dword [rsp + 0x1504], 0
mov qword [rsp + 0x1510], 0
mov dword [rsp + 0xec0], 0
mov dword [rsp + 0x1500], 0
mov dword [rsp + 0xca0], 0
movzx eax, word [0x01065f10]
test eax, eax
je 0x10305e5
lea r8, [0x01065f10]
mov edx, 0x106
lea rcx, [rsp + 0x10e0]
call fcn.01013c30
mov dx, 0x2e
lea rcx, [rsp + 0x10e0]
call fcn.010285d0
test rax, rax
je 0x103032a
lea rcx, [rsp + 0x10e0]
call qword [sym.imp.MSVCR80.dll__wcsrev]
mov dword [rsp + 0xca0], 0
movsxd rax, dword [rsp + 0xca0]
cmp rax, 0x105
jae 0x10302cf
movsxd rax, dword [rsp + 0xca0]
movzx eax, word [rsp + rax*2 + 0x10e0]
cmp eax, 0x2e
je 0x10302cf
movsxd rax, dword [rsp + 0xca0]
movsxd rcx, dword [rsp + 0xca0]
movzx eax, word [rsp + rax*2 + 0x10e0]
mov word [rsp + rcx*2 + 0xed0], ax
mov eax, dword [rsp + 0xca0]
add eax, 1
mov dword [rsp + 0xca0], eax
jmp 0x1030277
lea rcx, [rsp + 0xed0]
call qword [sym.imp.MSVCR80.dll__wcsrev]
mov dx, 0x2e
lea rcx, [rsp + 0x10e0]
call fcn.010285d0
add rax, 2
mov r8, rax
mov edx, 0x104
lea rcx, [rsp + 0x12f0]
call fcn.01013c30
lea rcx, [rsp + 0x12f0]
call qword [sym.imp.MSVCR80.dll__wcsrev]
mov r8, rax
mov edx, 0x106
lea rcx, [rsp + 0x10e0]
call fcn.01013c30
lea r9, [rsp + 0x10e0]
lea r8, [0x01007a70]
mov edx, 0x106
lea rcx, [rsp + 0xcb0]
call fcn.01015ef0
lea rcx, [rsp + 0xcb0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10303d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1504], eax
cmp dword [rsp + 0x1504], 2
je 0x10303d0
cmp dword [rsp + 0x1504], 3
je 0x10303d0
mov r9d, 0x200
lea r8, [rsp + 0x40]
mov edx, 0xf5
mov rcx, qword [0x01068158]
call qword [sym.imp.USER32.dll_LoadStringW]
mov r8d, 0x400
lea rdx, [rsp + 0x690]
mov ecx, dword [rsp + 0x1504]
call fcn.010529a0
lea r8, [rsp + 0x690]
lea rdx, [rsp + 0xcb0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR80.dll_wprintf]
mov dword [rsp + 0x1500], 0x38
jmp 0x10303ee
mov eax, dword [rsp + 0x1500]
sub eax, 1
mov dword [rsp + 0x1500], eax
cmp dword [rsp + 0x1500], 0x30
jle 0x10304fe
mov eax, dword [rsp + 0x1500]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x10e0]
lea r8, [0x01007a60]
mov edx, 0x106
lea rcx, [rsp + 0xcb0]
call fcn.01015ef0
mov eax, dword [rsp + 0x1500]
add eax, 1
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x10e0]
lea r8, [0x01007a60]
mov edx, 0x106
lea rcx, [rsp + 0xa90]
call fcn.01015ef0
lea rdx, [rsp + 0xa90]
lea rcx, [rsp + 0xcb0]
call qword [sym.imp.MSVCR80.dll__wrename]
mov dword [rsp + 0xec0], eax
cmp dword [rsp + 0xec0], 0
je 0x10304f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1504], eax
cmp dword [rsp + 0x1504], 2
je 0x10304f9
cmp dword [rsp + 0x1504], 3
je 0x10304f9
mov r9d, 0x200
lea r8, [rsp + 0x40]
mov edx, 0xf4
mov rcx, qword [0x01068158]
call qword [sym.imp.USER32.dll_LoadStringW]
mov r8d, 0x400
lea rdx, [rsp + 0x690]
mov ecx, dword [rsp + 0x1504]
call fcn.010529a0
lea r9, [rsp + 0x690]
lea r8, [rsp + 0xa90]
lea rdx, [rsp + 0xcb0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR80.dll_wprintf]
jmp 0x10303dd
lea rax, [rsp + 0xed0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x10e0]
lea r8, [0x01007a50]
mov edx, 0x106
lea rcx, [rsp + 0xcb0]
call fcn.01015ef0
lea r9, [rsp + 0x10e0]
lea r8, [0x01007a40]
mov edx, 0x106
lea rcx, [rsp + 0xa90]
call fcn.01015ef0
lea rdx, [rsp + 0xa90]
lea rcx, [rsp + 0xcb0]
call qword [sym.imp.MSVCR80.dll__wrename]
mov dword [rsp + 0xec0], eax
cmp dword [rsp + 0xec0], 0
je 0x10305e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1504], eax
cmp dword [rsp + 0x1504], 2
je 0x10305e5
mov r9d, 0x200
lea r8, [rsp + 0x40]
mov edx, 0xf4
mov rcx, qword [0x01068158]
call qword [sym.imp.USER32.dll_LoadStringW]
mov r8d, 0x400
lea rdx, [rsp + 0x690]
mov ecx, dword [rsp + 0x1504]
call fcn.010529a0
lea r9, [rsp + 0x690]
lea r8, [rsp + 0xa90]
lea rdx, [rsp + 0xcb0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR80.dll_wprintf]
lea rax, [0x01007a3c]
mov qword [rsp + 0x20], rax
lea r9, [0x01067274]
lea r8, [0x01007a10]
mov edx, 0x106
lea rcx, [rsp + 0xcb0]
call fcn.01015ef0
mov word [rsp + 0xeba], 0
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0xcb0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x1510], rax
cmp qword [rsp + 0x1510], 0xffffffffffffffff
je 0x10306a7
lea rax, [rsp + 0x46c]
mov qword [rsp + 0x20], rax
lea r9, [0x01067274]
lea r8, [0x01007a00]
mov edx, 0x106
lea rcx, [rsp + 0xcb0]
call fcn.01015ef0
lea rcx, [rsp + 0xcb0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x440]
mov rcx, qword [rsp + 0x1510]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1030644
mov rcx, qword [rsp + 0x1510]
call qword [sym.imp.KERNEL32.dll_FindClose]
movzx eax, word [0x01065f10]
test eax, eax
je 0x10306ec
lea rcx, [rsp + 0x1504]
call fcn.01030fe0
mov dword [rsp + 0x1508], eax
cmp dword [rsp + 0x1508], 0
jne 0x10306ea
mov r8d, 0x400
lea rdx, [rsp + 0x690]
mov ecx, dword [rsp + 0x1504]
call fcn.010529a0
jmp 0x10306f7
mov dword [rsp + 0x1508], 1
lea rcx, [0x010079e8]
call fcn.0103e2a0
test eax, eax
je 0x1030750
lea rdx, [0x01067e30]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov qword [0x010679b8], rax
cmp qword [0x010679b8], 0
jne 0x103074e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1504], eax
mov r8d, 0x400
lea rdx, [rsp + 0x690]
mov ecx, dword [rsp + 0x1504]
call fcn.010529a0
jmp 0x103078b
mov r9d, 0x200
lea r8, [rsp + 0x40]
mov edx, 0x174
mov rcx, qword [0x01068158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea r9, [0x010079e8]
lea r8, [rsp + 0x40]
mov edx, 0x200
lea rcx, [rsp + 0x690]
call fcn.01015ef0
xor r8d, r8d
lea rdx, [0x010079c8]
xor ecx, ecx
call fcn.01010910
mov qword [0x01065df8], rax
cmp qword [0x01065df8], 0
jne 0x103081f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1504], eax
mov r8d, 0x400
lea rdx, [rsp + 0x690]
mov ecx, dword [rsp + 0x1504]
call fcn.010529a0
lea r8, [0x010079bc]
mov edx, 0x200
lea rcx, [rsp + 0x690]
call fcn.01015be0
lea r8, [0x010079c8]
mov edx, 0x200
lea rcx, [rsp + 0x690]
call fcn.01015be0
lea r8, [0x01007504]
mov edx, 0x200
lea rcx, [rsp + 0x690]
call fcn.01015be0
cmp qword [rsp + 0x1540], 0
je 0x1030853
movzx eax, word [rsp + 0x690]
test eax, eax
je 0x1030853
lea r8, [rsp + 0x690]
mov rdx, qword [rsp + 0x1548]
mov rcx, qword [rsp + 0x1540]
call fcn.01013c30
cmp qword [0x010679b8], 0
je 0x103087e
cmp qword [0x01065df8], 0
je 0x103087e
cmp dword [rsp + 0x1508], 0
je 0x103087e
mov dword [rsp + 0x1518], 1
jmp 0x1030889
mov dword [rsp + 0x1518], 0
mov eax, dword [rsp + 0x1518]
mov rcx, qword [rsp + 0x1520]
xor rcx, rsp
call fcn.010588f0
add rsp, 0x1530
pop rdi
ret