Function at 0x1025940
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x16d8
call fcn.01047580
mov eax, dword [0x104c68c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x10015d4]
mov word [ebp - 0x12a8], ax
push 0x20a
push 0
lea ecx, [ebp - 0x12a6]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dx, word [0x10015d4]
mov word [ebp - 0x14b0], dx
push 0x206
push 0
lea eax, [ebp - 0x14ae]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov cx, word [0x10015d4]
mov word [ebp - 0xc68], cx
push 0x20a
push 0
lea edx, [ebp - 0xc66]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov ax, word [0x10015d4]
mov word [ebp - 0xe80], ax
push 0x20a
push 0
lea ecx, [ebp - 0xe7e]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dx, word [0x10015d4]
mov word [ebp - 0x1098], dx
push 0x208
push 0
lea eax, [ebp - 0x1096]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov cx, word [0x10015d4]
mov word [ebp - 0xa58], cx
push 0x3fe
push 0
lea edx, [ebp - 0xa56]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov ax, word [0x10015d4]
mov word [ebp - 0x408], ax
push 0x3fe
push 0
lea ecx, [ebp - 0x406]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dx, word [0x10015d4]
mov word [ebp - 0x16d0], dx
push 0x20a
push 0
lea eax, [ebp - 0x16ce]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x14bc], 0
mov dword [ebp - 0x14b8], 0
mov dword [ebp - 0x16d4], 0
mov dword [ebp - 0xe84], 0
mov dword [ebp - 0x14b4], 0
mov dword [ebp - 0xc6c], 0
movzx ecx, word [0x104cb5c]
test ecx, ecx
je 0x1025e46
push 0x104cb5c
push 0x106
lea edx, [ebp - 0x12a8]
push edx
call fcn.01010390
push 0x2e
lea eax, [ebp - 0x12a8]
push eax
call fcn.010203d0
add esp, 8
test eax, eax
je 0x1025ba2
lea ecx, [ebp - 0x12a8]
push ecx
call dword [sym.imp.MSVCR80.dll__wcsrev]
add esp, 4
mov dword [ebp - 0xc6c], 0
mov edx, dword [ebp - 0xc6c]
movzx eax, word [ebp + edx*2 - 0x12a8]
cmp eax, 0x2e
je 0x1025b4a
mov ecx, dword [ebp - 0xc6c]
mov edx, dword [ebp - 0xc6c]
mov ax, word [ebp + edx*2 - 0x12a8]
mov word [ebp + ecx*2 - 0x1098], ax
mov ecx, dword [ebp - 0xc6c]
add ecx, 1
mov dword [ebp - 0xc6c], ecx
jmp 0x1025b0a
lea edx, [ebp - 0x1098]
push edx
call dword [sym.imp.MSVCR80.dll__wcsrev]
add esp, 4
push 0x2e
lea eax, [ebp - 0x12a8]
push eax
call fcn.010203d0
add esp, 8
add eax, 2
push eax
push 0x104
lea ecx, [ebp - 0x14b0]
push ecx
call fcn.01010390
lea edx, [ebp - 0x14b0]
push edx
call dword [sym.imp.MSVCR80.dll__wcsrev]
add esp, 4
push eax
push 0x106
lea eax, [ebp - 0x12a8]
push eax
call fcn.01010390
lea ecx, [ebp - 0x12a8]
push ecx
push 0x1006820
push 0x106
lea edx, [ebp - 0xe80]
push edx
call fcn.01011d00
add esp, 0x10
lea eax, [ebp - 0xe80]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1025c48
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14b8], eax
cmp dword [ebp - 0x14b8], 2
je 0x1025c48
cmp dword [ebp - 0x14b8], 3
je 0x1025c48
push 0x200
lea ecx, [ebp - 0x408]
push ecx
push 0xf5
mov edx, dword [0x104ef34]
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x400
lea eax, [ebp - 0xa58]
push eax
mov ecx, dword [ebp - 0x14b8]
push ecx
call fcn.010425e0
add esp, 0xc
lea edx, [ebp - 0xa58]
push edx
lea eax, [ebp - 0xe80]
push eax
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCR80.dll_wprintf]
add esp, 0xc
mov dword [ebp - 0x14b4], 0x38
jmp 0x1025c63
mov edx, dword [ebp - 0x14b4]
sub edx, 1
mov dword [ebp - 0x14b4], edx
cmp dword [ebp - 0x14b4], 0x30
jle 0x1025d67
mov eax, dword [ebp - 0x14b4]
push eax
lea ecx, [ebp - 0x12a8]
push ecx
push 0x1006814
push 0x106
lea edx, [ebp - 0xe80]
push edx
call fcn.01011d00
add esp, 0x14
mov eax, dword [ebp - 0x14b4]
add eax, 1
push eax
lea ecx, [ebp - 0x12a8]
push ecx
push 0x1006814
push 0x106
lea edx, [ebp - 0xc68]
push edx
call fcn.01011d00
add esp, 0x14
lea eax, [ebp - 0xc68]
push eax
lea ecx, [ebp - 0xe80]
push ecx
call dword [sym.imp.MSVCR80.dll__wrename]
add esp, 8
mov dword [ebp - 0xe84], eax
cmp dword [ebp - 0xe84], 0
je 0x1025d62
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14b8], eax
cmp dword [ebp - 0x14b8], 2
je 0x1025d62
cmp dword [ebp - 0x14b8], 3
je 0x1025d62
push 0x200
lea edx, [ebp - 0x408]
push edx
push 0xf4
mov eax, dword [0x104ef34]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x400
lea ecx, [ebp - 0xa58]
push ecx
mov edx, dword [ebp - 0x14b8]
push edx
call fcn.010425e0
add esp, 0xc
lea eax, [ebp - 0xa58]
push eax
lea ecx, [ebp - 0xc68]
push ecx
lea edx, [ebp - 0xe80]
push edx
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR80.dll_wprintf]
add esp, 0x10
jmp 0x1025c54
lea ecx, [ebp - 0x1098]
push ecx
lea edx, [ebp - 0x12a8]
push edx
push 0x1006808
push 0x106
lea eax, [ebp - 0xe80]
push eax
call fcn.01011d00
add esp, 0x14
lea ecx, [ebp - 0x12a8]
push ecx
push 0x10067fc
push 0x106
lea edx, [ebp - 0xc68]
push edx
call fcn.01011d00
add esp, 0x10
lea eax, [ebp - 0xc68]
push eax
lea ecx, [ebp - 0xe80]
push ecx
call dword [sym.imp.MSVCR80.dll__wrename]
add esp, 8
mov dword [ebp - 0xe84], eax
cmp dword [ebp - 0xe84], 0
je 0x1025e46
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14b8], eax
cmp dword [ebp - 0x14b8], 2
je 0x1025e46
push 0x200
lea edx, [ebp - 0x408]
push edx
push 0xf4
mov eax, dword [0x104ef34]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x400
lea ecx, [ebp - 0xa58]
push ecx
mov edx, dword [ebp - 0x14b8]
push edx
call fcn.010425e0
add esp, 0xc
lea eax, [ebp - 0xa58]
push eax
lea ecx, [ebp - 0xc68]
push ecx
lea edx, [ebp - 0xe80]
push edx
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR80.dll_wprintf]
add esp, 0x10
push 0x10067f8
push 0x104debc
push 0x10067cc
push 0x106
lea ecx, [ebp - 0xe80]
push ecx
call fcn.01011d00
add esp, 0x14
mov word [ebp - 0xc76], 0
lea edx, [ebp - 0x658]
push edx
lea eax, [ebp - 0xe80]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x16d4], eax
cmp dword [ebp - 0x16d4], 0xffffffff
je 0x1025eec
lea ecx, [ebp - 0x62c]
push ecx
push 0x104debc
push 0x10067c0
push 0x106
lea edx, [ebp - 0xe80]
push edx
call fcn.01011d00
add esp, 0x14
lea eax, [ebp - 0xe80]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x658]
push ecx
mov edx, dword [ebp - 0x16d4]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1025e95
mov eax, dword [ebp - 0x16d4]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
movzx ecx, word [0x104cb5c]
test ecx, ecx
je 0x1025f32
lea edx, [ebp - 0x14b8]
push edx
call fcn.010267b0
add esp, 4
mov dword [ebp - 0x14bc], eax
cmp dword [ebp - 0x14bc], 0
jne 0x1025f30
push 0x400
lea eax, [ebp - 0xa58]
push eax
mov ecx, dword [ebp - 0x14b8]
push ecx
call fcn.010425e0
add esp, 0xc
jmp 0x1025f3c
mov dword [ebp - 0x14bc], 1
push 0x10067ac
call fcn.01031c00
add esp, 4
test eax, eax
je 0x1025f91
push 0x104ec10
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [0x104e7a4], eax
cmp dword [0x104e7a4], 0
jne 0x1025f8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14b8], eax
push 0x400
lea edx, [ebp - 0xa58]
push edx
mov eax, dword [ebp - 0x14b8]
push eax
call fcn.010425e0
add esp, 0xc
jmp 0x1025fcf
push 0x200
lea ecx, [ebp - 0x408]
push ecx
push 0x174
mov edx, dword [0x104ef34]
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10067ac
lea eax, [ebp - 0x408]
push eax
push 0x200
lea ecx, [ebp - 0xa58]
push ecx
call fcn.01011d00
add esp, 0x10
push 0
push 0x1006788
push 0
call fcn.0100de70
add esp, 0xc
mov dword [0x104ca4c], eax
cmp dword [0x104ca4c], 0
jne 0x1026057
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14b8], eax
push 0x400
lea edx, [ebp - 0xa58]
push edx
mov eax, dword [ebp - 0x14b8]
push eax
call fcn.010425e0
add esp, 0xc
push 0x1006780
push 0x200
lea ecx, [ebp - 0xa58]
push ecx
call fcn.01010ee0
push 0x1006788
push 0x200
lea edx, [ebp - 0xa58]
push edx
call fcn.01010ee0
push 0x10063e4
push 0x200
lea eax, [ebp - 0xa58]
push eax
call fcn.01010ee0
cmp dword [ebp + 8], 0
je 0x102607c
movzx ecx, word [ebp - 0xa58]
test ecx, ecx
je 0x102607c
lea edx, [ebp - 0xa58]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.01010390
cmp dword [0x104e7a4], 0
je 0x10260a3
cmp dword [0x104ca4c], 0
je 0x10260a3
cmp dword [ebp - 0x14bc], 0
je 0x10260a3
mov dword [ebp - 0x16d8], 1
jmp 0x10260ad
mov dword [ebp - 0x16d8], 0
mov eax, dword [ebp - 0x16d8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010471ba
mov esp, ebp
pop ebp
ret