Function at 0x100f8c6c
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x274], eax
mov edi, edx
xor eax, eax
mov dword [ebp - 0x26c], ecx
push 0x250
mov esi, eax
mov dword [ebp - 0xc], eax
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x264]
push eax
mov dword [ebp - 0x268], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor ebx, ebx
add esp, 0xc
inc ebx
test edi, edi
jne 0x100f8cd8
push 0x10020554
mov edx, 0x15e9
mov ecx, 0x10035994
call fcn.100e970f
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
call fcn.10129ce2
mov edi, eax
test edi, edi
jns 0x100f8cf3
push 0x10039e10
jmp 0x100f8e78
lea ecx, [ebp - 0xc]
call fcn.100b15f5
mov edi, eax
test edi, edi
jns 0x100f8d0b
push 0x10039e40
jmp 0x100f8e78
push dword [ebp - 0xc]
lea eax, [ebp - 0x14]
push 0x10039e78
push eax
call fcn.100a6b40
mov edi, eax
add esp, 0xc
test edi, edi
jns 0x100f8d2f
push 0x10039e8c
jmp 0x100f8e78
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
push eax
lea ecx, [ebp - 0x268]
call fcn.100e899b
mov esi, dword [ebp - 0x268]
mov ecx, esi
call fcn.10094ff1
test al, al
jne 0x100f8e53
test byte [ebp - 0x264], 0x10
jne 0x100f8e3d
lea eax, [ebp - 0x238]
push 0x10039ee4
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x100f8e3d
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push 0x10039f00
push eax
call fcn.100a6b40
mov edi, eax
add esp, 0x10
test edi, edi
js 0x100f8ecf
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x26c]
test eax, eax
je 0x100f8dce
mov ecx, eax
call fcn.101410db
cmp eax, ebx
je 0x100f8ecb
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov dword [ebp - 0x270], eax
test eax, eax
jne 0x100f8e04
mov eax, dword [ebp - 0x268]
cmp eax, 3
jae 0x100f8e1a
inc eax
push 0x3e8
mov dword [ebp - 0x268], eax
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0x268], 3
jae 0x100f8e11
test eax, eax
je 0x100f8db5
test eax, eax
mov eax, 0x10039f44
jne 0x100f8e1f
mov eax, 0x10039f4c
lea ecx, [ebp - 0x238]
push ecx
push eax
push 0x10039f60
push 0
push 0
push 0x4000000
call fcn.100ab973
add esp, 0x18
lea eax, [ebp - 0x264]
push eax
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
jne 0x100f8d60
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x100f8e65
movzx eax, ax
or eax, 0x80070000
lea edi, [eax + 0x7ff8ffee]
neg edi
sbb edi, edi
and edi, eax
jge 0x100f8e87
push 0x10039ec0
push ebx
push edi
push 0x4000000
call fcn.100ab973
add esp, 0x10
mov eax, dword [ebp - 0x274]
mov ecx, esi
mov dword [eax], ebx
call fcn.10094ff1
test al, al
jne 0x100f8ea0
push esi
call fcn.100e815b
lea ecx, [ebp - 0x10]
call fcn.100b61be
lea ecx, [ebp - 0x14]
call fcn.100b61be
lea ecx, [ebp - 0xc]
call fcn.100b61be
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 4
xor ebx, ebx
jmp 0x100f8e87
push 0x10039f10
jmp 0x100f8e78