Function at 0x102f6a9
Capabilities:
Delete file
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x46c
mov eax, dword [0x104e070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push 0x24c
lea eax, [ebp - 0x458]
push esi
push eax
mov dword [ebp - 0x45c], esi
call sub.msvcrt.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add esp, 0xc
mov edi, 0x208
push edi
push esi
mov dword [ebp - 0x464], esi
mov dword [ebp - 0x468], esi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call esi
mov dword [ebp - 0x460], eax
test eax, eax
jne 0x102f71e
mov eax, 0x8007000e
push eax
mov ebx, eax
push 0x463
jmp 0x102f9d8
push edi
push 0
call ebx
push eax
call esi
mov dword [ebp - 0x464], eax
test eax, eax
jne 0x102f742
mov eax, 0x8007000e
push eax
mov ebx, eax
push 0x464
jmp 0x102f9d8
push edi
push 0
call ebx
push eax
call esi
mov edi, eax
mov dword [ebp - 0x468], edi
test edi, edi
jne 0x102f768
mov eax, 0x8007000e
push eax
mov ebx, eax
push 0x465
jmp 0x102f9d8
mov eax, dword [0x104e190]
test eax, eax
je 0x102f784
cmp eax, 0xffffffff
je 0x102f784
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [0x104e190], 0
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0102ece2
mov ebx, eax
test ebx, ebx
jge 0x102f7a7
push ebx
push 0x46f
jmp 0x102f9d8
lea eax, [ebp - 0x20c]
push eax
push 0x10087a0
push esi
push edi
call fcn.0100dd8e
mov ebx, eax
add esp, 0x10
test ebx, ebx
jge 0x102f7ce
push ebx
push 0x472
jmp 0x102f9d8
lea eax, [ebp - 0x45c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x46c], eax
test eax, eax
je 0x102f9bc
cmp eax, 0xffffffff
je 0x102f9bc
mov esi, 0x1008790
mov edi, 0x1006604
test byte [ebp - 0x45c], 0x10
je 0x102f993
lea eax, [ebp - 0x430]
push 0x1008118
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x102f993
lea eax, [ebp - 0x430]
push 0x1008110
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x102f993
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x1004424
mov ebx, 0x104
push ebx
push dword [ebp - 0x460]
call fcn.0100dd8e
add esp, 0x14
test eax, eax
jge 0x102f878
push eax
push 0x488
jmp 0x102f985
push dword [ebp - 0x460]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x102f8cb
push 0x80
push dword [ebp - 0x460]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x102f8cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102f8b3
and eax, 0xffff
or eax, 0x80070000
test eax, eax
jge 0x102f8cb
push eax
push 0x48f
push esi
push 0x1002028
push 1
call fcn.01014247
add esp, 0x14
push 0x1008784
push dword [ebp - 0x460]
push 0x1005adc
push ebx
mov ebx, dword [ebp - 0x464]
push ebx
call fcn.0100dd8e
add esp, 0x14
test eax, eax
jge 0x102f8fa
push eax
push 0x493
jmp 0x102f985
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x102f943
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x102f943
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102f92b
and eax, 0xffff
or eax, 0x80070000
test eax, eax
jge 0x102f943
push eax
push 0x49a
push esi
push 0x1002028
push 1
call fcn.01014247
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x102f96e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102f964
and eax, 0xffff
or eax, 0x80070000
test eax, eax
jge 0x102f96e
push eax
push 0x4a2
jmp 0x102f985
push dword [ebp - 0x460]
call fcn.0102f068
mov ebx, eax
test ebx, ebx
jge 0x102f993
push ebx
push 0x4a5
push esi
push edi
push 1
call fcn.01014247
add esp, 0x14
xor ebx, ebx
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x46c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x102f7fd
push dword [ebp - 0x46c]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x102f9ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102f9d0
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
push ebx
push 0x475
push 0x1008790
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
mov eax, dword [0x104e18c]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x102fa10
push eax
push 0
call edi
push eax
call esi
and dword [0x104e18c], 0
mov eax, dword [0x104e198]
test eax, eax
je 0x102fa28
push eax
push 0
call edi
push eax
call esi
and dword [0x104e198], 0
mov eax, dword [0x104e19c]
test eax, eax
je 0x102fa3e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [0x104e19c], 0
mov eax, dword [0x104e190]
test eax, eax
je 0x102fa5a
cmp eax, 0xffffffff
je 0x102fa5a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [0x104e190], 0
cmp dword [ebp - 0x464], 0
je 0x102fa70
push dword [ebp - 0x464]
push 0
call edi
push eax
call esi
cmp dword [ebp - 0x460], 0
je 0x102fa86
push dword [ebp - 0x460]
push 0
call edi
push eax
call esi
cmp dword [ebp - 0x468], 0
je 0x102fa9c
push dword [ebp - 0x468]
push 0
call edi
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01036539
leave
ret