Function at 0x1000a5d0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fb85f
mov eax, dword fs:[0]
push eax
sub esp, 0x368
mov eax, dword [0x1013f030]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2b4], eax
xor eax, eax
mov dword [ebp - 0x288], eax
mov edi, 7
xor edx, edx
mov dword [ebp - 0x290], ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x2c], dx
mov dword [ebp - 4], eax
mov esi, vtable.ProtocolFilters::IOB.0
mov edx, 0x6400000
mov ebx, 1
mov dword [ebp - 0x308], esi
mov dword [ebp - 0x304], eax
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x2fc], eax
mov dword [ebp - 0x2f8], edx
mov dword [ebp - 0x2f4], ebx
mov dword [ebp - 0x320], esi
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x314], eax
mov dword [ebp - 0x310], edx
mov dword [ebp - 0x30c], ebx
push ecx
mov ebx, 0x101386e8
lea esi, [ebp - 0x358]
mov byte [ebp - 4], 2
call fcn.10008980
mov ebx, 8
add esp, 4
cmp dword [eax + 0x18], ebx
jb 0x1000a6a7
mov eax, dword [eax + 4]
jmp 0x1000a6aa
add eax, 4
lea ecx, [ebp - 0x284]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x2b0], esi
cmp dword [ebp - 0x340], ebx
jb 0x1000a6d7
mov edx, dword [ebp - 0x354]
push edx
call fcn.10031f94
add esp, 4
xor eax, eax
mov dword [ebp - 0x340], edi
mov dword [ebp - 0x344], 0
mov word [ebp - 0x354], ax
cmp esi, 0xffffffff
jne 0x1000a70d
cmp dword [ebp - 0x18], ebx
jb 0x1000a706
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.10031f94
add esp, 4
xor al, al
jmp 0x1000acaf
test byte [ebp - 0x284], 0x10
jne 0x1000ac4b
mov ecx, 0x10138554
lea eax, [ebp - 0x258]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000a74b
test dx, dx
je 0x1000a747
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000a74b
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000a725
xor eax, eax
jmp 0x1000a750
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000ac4b
mov ecx, 0x10138638
lea eax, [ebp - 0x258]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000a789
test dx, dx
je 0x1000a785
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000a789
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000a763
xor eax, eax
jmp 0x1000a78e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000ac4b
lea eax, [ebp - 0x258]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000a7a0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x258]
lea esi, [ebp - 0x30]
call fcn.100081f0
lea edx, [ebp - 0x2b8]
push edx
mov eax, esi
push eax
mov edi, 1
mov dword [ebp - 0x2b8], 0x2e
call fcn.10007f70
cmp eax, 0xffffffff
je 0x1000a81e
mov ecx, esi
push ecx
mov ecx, eax
xor edx, edx
lea esi, [ebp - 0x2ac]
call fcn.10007d00
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.10007e10
mov byte [ebp - 4], 2
cmp dword [ebp - 0x294], ebx
jb 0x1000a81e
mov edx, dword [ebp - 0x2a8]
push edx
call fcn.10031f94
add esp, 4
mov edi, dword [ebp - 0x290]
push edi
mov ebx, 0x10138550
lea esi, [ebp - 0x33c]
call fcn.10008980
add esp, 4
mov byte [ebp - 4], 4
or dword [ebp - 0x288], 1
push eax
lea ebx, [ebp - 0x258]
lea esi, [ebp - 0x2ac]
call fcn.10008980
add esp, 4
mov dword [ebp - 4], 5
mov ebx, dword [ebp - 0x288]
or ebx, 2
push eax
lea ecx, [ebp - 0x308]
mov dword [ebp - 0x288], ebx
call fcn.1000a470
test al, al
je 0x1000a904
push edi
mov ebx, 0x10138550
lea esi, [ebp - 0x2f0]
call fcn.10008980
add esp, 4
lea ecx, [ebp - 0x30]
push ecx
mov dword [ebp - 4], 6
or dword [ebp - 0x288], 4
push eax
lea edi, [ebp - 0x374]
call fcn.10008a30
mov dword [ebp - 4], 7
or dword [ebp - 0x288], 8
push eax
mov ebx, str..pvk
lea esi, [ebp - 0x2d4]
call fcn.10008980
add esp, 0xc
mov edi, 8
mov dword [ebp - 4], edi
or dword [ebp - 0x288], 0x10
push eax
lea ecx, [ebp - 0x320]
call fcn.1000a470
mov ebx, dword [ebp - 0x288]
test al, al
je 0x1000a909
mov byte [ebp - 0x289], 1
jmp 0x1000a910
mov edi, 8
mov byte [ebp - 0x289], 0
test bl, 0x10
je 0x1000a952
and ebx, 0xffffffef
mov dword [ebp - 0x288], ebx
cmp dword [ebp - 0x2bc], edi
jb 0x1000a935
mov edx, dword [ebp - 0x2d0]
push edx
call fcn.10031f94
add esp, 4
xor esi, esi
xor eax, eax
mov dword [ebp - 0x2bc], 7
mov dword [ebp - 0x2c0], esi
mov word [ebp - 0x2d0], ax
jmp 0x1000a954
xor esi, esi
test bl, 8
je 0x1000a992
and ebx, 0xfffffff7
mov dword [ebp - 0x288], ebx
cmp dword [ebp - 0x35c], edi
jb 0x1000a979
mov ecx, dword [ebp - 0x370]
push ecx
call fcn.10031f94
add esp, 4
xor edx, edx
mov dword [ebp - 0x35c], 7
mov dword [ebp - 0x360], esi
mov word [ebp - 0x370], dx
test bl, 4
je 0x1000a9d0
and ebx, 0xfffffffb
mov dword [ebp - 0x288], ebx
cmp dword [ebp - 0x2d8], edi
jb 0x1000a9b7
mov eax, dword [ebp - 0x2ec]
push eax
call fcn.10031f94
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x2d8], 7
mov dword [ebp - 0x2dc], esi
mov word [ebp - 0x2ec], cx
test bl, 2
je 0x1000aa0e
and ebx, 0xfffffffd
mov dword [ebp - 0x288], ebx
cmp dword [ebp - 0x294], edi
jb 0x1000a9f5
mov edx, dword [ebp - 0x2a8]
push edx
call fcn.10031f94
add esp, 4
xor eax, eax
mov dword [ebp - 0x294], 7
mov dword [ebp - 0x298], esi
mov word [ebp - 0x2a8], ax
mov dword [ebp - 4], 2
test bl, 1
je 0x1000aa3a
and ebx, 0xfffffffe
mov dword [ebp - 0x288], ebx
cmp dword [ebp - 0x324], edi
jb 0x1000aa3a
mov ecx, dword [ebp - 0x338]
push ecx
call fcn.10031f94
add esp, 4
cmp byte [ebp - 0x289], 0
je 0x1000ac46
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x1000aa53
lea eax, [ebp - 0x2c]
push eax
call fcn.1003fd40
xor ebx, ebx
mov esi, eax
mov dword [ebp - 0x2bc], 0xf
mov dword [ebp - 0x2c0], ebx
mov byte [ebp - 0x2d0], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1000aa76
sub eax, edx
push eax
push esi
lea ecx, [ebp - 0x2d4]
call fcn.10008e50
lea edx, [ebp - 0x308]
push edx
mov edx, dword [ebp - 0x2b4]
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x320]
mov byte [ebp - 4], 9
call fcn.10009df0
mov byte [ebp - 4], 2
cmp dword [ebp - 0x2bc], 0x10
jb 0x1000aacb
mov ecx, dword [ebp - 0x2d0]
push ecx
call fcn.10031f94
add esp, 4
push esi
call fcn.10031ffc
mov edi, dword [ebp - 0x290]
add esp, 4
push edi
mov ebx, 0x10138550
lea esi, [ebp - 0x33c]
call fcn.10008980
add esp, 4
push eax
lea ebx, [ebp - 0x258]
lea esi, [ebp - 0x2ac]
mov byte [ebp - 4], 0xa
call fcn.10008980
mov esi, 8
add esp, 4
cmp dword [eax + 0x18], esi
jb 0x1000ab16
mov eax, dword [eax + 4]
jmp 0x1000ab19
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x294], esi
jb 0x1000ab37
mov edx, dword [ebp - 0x2a8]
push edx
call fcn.10031f94
add esp, 4
xor eax, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x294], 7
mov dword [ebp - 0x298], 0
mov word [ebp - 0x2a8], ax
cmp dword [ebp - 0x324], esi
jb 0x1000ab6f
mov ecx, dword [ebp - 0x338]
push ecx
call fcn.10031f94
add esp, 4
push edi
mov ebx, 0x10138550
lea esi, [ebp - 0x33c]
call fcn.10008980
add esp, 4
lea edx, [ebp - 0x30]
push edx
push eax
lea edi, [ebp - 0x2f0]
mov byte [ebp - 4], 0xb
call fcn.10008a30
push eax
mov ebx, str..pvk
lea esi, [ebp - 0x2ac]
mov byte [ebp - 4], 0xc
call fcn.10008980
mov esi, 8
add esp, 0xc
cmp dword [eax + 0x18], esi
jb 0x1000abbe
mov eax, dword [eax + 4]
jmp 0x1000abc1
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x294], esi
jb 0x1000abdf
mov eax, dword [ebp - 0x2a8]
push eax
call fcn.10031f94
add esp, 4
xor edi, edi
xor ecx, ecx
mov ebx, 7
mov dword [ebp - 0x294], ebx
mov dword [ebp - 0x298], edi
mov word [ebp - 0x2a8], cx
cmp dword [ebp - 0x2d8], esi
jb 0x1000ac12
mov edx, dword [ebp - 0x2ec]
push edx
call fcn.10031f94
add esp, 4
xor eax, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2dc], edi
mov word [ebp - 0x2ec], ax
cmp dword [ebp - 0x324], esi
jb 0x1000ac46
mov ecx, dword [ebp - 0x338]
push ecx
call fcn.10031f94
add esp, 4
mov ebx, esi
jmp 0x1000ac4b
mov ebx, 8
mov esi, dword [ebp - 0x2b0]
lea edx, [ebp - 0x284]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000a70d
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x31c]
test eax, eax
je 0x1000ac85
push eax
call fcn.10030c8f
add esp, 4
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x304]
test eax, eax
je 0x1000ac9c
push eax
call fcn.10030c8f
add esp, 4
cmp dword [ebp - 0x18], ebx
jb 0x1000acad
mov eax, dword [ebp - 0x2c]
push eax
call fcn.10031f94
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10030c80
mov esp, ebp
pop ebp
ret 4