Function at 0x1030be0
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Move file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x1530
call fcn.0105fe80
sub rsp, rax
mov rax, qword [0x010667f0]
xor rax, rsp
mov qword [rsp + 0x1520], rax
movzx eax, word [0x01001c50]
mov word [rsp + 0x10e0], ax
lea rax, [rsp + 0x10e2]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x12f0], ax
lea rax, [rsp + 0x12f2]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0xa90], ax
lea rax, [rsp + 0xa92]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0xcb0], ax
lea rax, [rsp + 0xcb2]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0xed0], ax
lea rax, [rsp + 0xed2]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x690], ax
lea rax, [rsp + 0x692]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x40], ax
lea rax, [rsp + 0x42]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
mov dword [rsp + 0x1508], 0
mov dword [rsp + 0x1504], 0
mov qword [rsp + 0x1510], 0
mov dword [rsp + 0xec0], 0
mov dword [rsp + 0x1500], 0
mov dword [rsp + 0xca0], 0
movzx eax, word [0x01066f10]
test eax, eax
je 0x1031105
lea r8, [0x01066f10]
mov edx, 0x106
lea rcx, [rsp + 0x10e0]
call fcn.0105ab90
mov dx, 0x2e
lea rcx, [rsp + 0x10e0]
call fcn.01029070
test rax, rax
je 0x1030e4a
lea rcx, [rsp + 0x10e0]
call qword [sym.imp.MSVCR80.dll__wcsrev]
mov dword [rsp + 0xca0], 0
movsxd rax, dword [rsp + 0xca0]
cmp rax, 0x105
jae 0x1030def
movsxd rax, dword [rsp + 0xca0]
movzx eax, word [rsp + rax*2 + 0x10e0]
cmp eax, 0x2e
je 0x1030def
movsxd rax, dword [rsp + 0xca0]
movsxd rcx, dword [rsp + 0xca0]
movzx eax, word [rsp + rax*2 + 0x10e0]
mov word [rsp + rcx*2 + 0xed0], ax
mov eax, dword [rsp + 0xca0]
add eax, 1
mov dword [rsp + 0xca0], eax
jmp 0x1030d97
lea rcx, [rsp + 0xed0]
call qword [sym.imp.MSVCR80.dll__wcsrev]
mov dx, 0x2e
lea rcx, [rsp + 0x10e0]
call fcn.01029070
add rax, 2
mov r8, rax
mov edx, 0x104
lea rcx, [rsp + 0x12f0]
call fcn.0105ab90
lea rcx, [rsp + 0x12f0]
call qword [sym.imp.MSVCR80.dll__wcsrev]
mov r8, rax
mov edx, 0x106
lea rcx, [rsp + 0x10e0]
call fcn.0105ab90
lea r9, [rsp + 0x10e0]
lea r8, [0x01007d00]
mov edx, 0x106
lea rcx, [rsp + 0xcb0]
call fcn.01016110
lea rcx, [rsp + 0xcb0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1030ef0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1504], eax
cmp dword [rsp + 0x1504], 2
je 0x1030ef0
cmp dword [rsp + 0x1504], 3
je 0x1030ef0
mov r9d, 0x200
lea r8, [rsp + 0x40]
mov edx, 0xf5
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
mov r8d, 0x400
lea rdx, [rsp + 0x690]
mov ecx, dword [rsp + 0x1504]
call fcn.01053650
lea r8, [rsp + 0x690]
lea rdx, [rsp + 0xcb0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR80.dll_wprintf]
mov dword [rsp + 0x1500], 0x38
jmp 0x1030f0e
mov eax, dword [rsp + 0x1500]
sub eax, 1
mov dword [rsp + 0x1500], eax
cmp dword [rsp + 0x1500], 0x30
jle 0x103101e
mov eax, dword [rsp + 0x1500]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x10e0]
lea r8, [0x01007cf0]
mov edx, 0x106
lea rcx, [rsp + 0xcb0]
call fcn.01016110
mov eax, dword [rsp + 0x1500]
add eax, 1
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x10e0]
lea r8, [0x01007cf0]
mov edx, 0x106
lea rcx, [rsp + 0xa90]
call fcn.01016110
lea rdx, [rsp + 0xa90]
lea rcx, [rsp + 0xcb0]
call qword [sym.imp.MSVCR80.dll__wrename]
mov dword [rsp + 0xec0], eax
cmp dword [rsp + 0xec0], 0
je 0x1031019
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1504], eax
cmp dword [rsp + 0x1504], 2
je 0x1031019
cmp dword [rsp + 0x1504], 3
je 0x1031019
mov r9d, 0x200
lea r8, [rsp + 0x40]
mov edx, 0xf4
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
mov r8d, 0x400
lea rdx, [rsp + 0x690]
mov ecx, dword [rsp + 0x1504]
call fcn.01053650
lea r9, [rsp + 0x690]
lea r8, [rsp + 0xa90]
lea rdx, [rsp + 0xcb0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR80.dll_wprintf]
jmp 0x1030efd
lea rax, [rsp + 0xed0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x10e0]
lea r8, [0x01007ce0]
mov edx, 0x106
lea rcx, [rsp + 0xcb0]
call fcn.01016110
lea r9, [rsp + 0x10e0]
lea r8, [0x01007cd0]
mov edx, 0x106
lea rcx, [rsp + 0xa90]
call fcn.01016110
lea rdx, [rsp + 0xa90]
lea rcx, [rsp + 0xcb0]
call qword [sym.imp.MSVCR80.dll__wrename]
mov dword [rsp + 0xec0], eax
cmp dword [rsp + 0xec0], 0
je 0x1031105
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1504], eax
cmp dword [rsp + 0x1504], 2
je 0x1031105
mov r9d, 0x200
lea r8, [rsp + 0x40]
mov edx, 0xf4
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
mov r8d, 0x400
lea rdx, [rsp + 0x690]
mov ecx, dword [rsp + 0x1504]
call fcn.01053650
lea r9, [rsp + 0x690]
lea r8, [rsp + 0xa90]
lea rdx, [rsp + 0xcb0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR80.dll_wprintf]
lea rax, [0x01007ccc]
mov qword [rsp + 0x20], rax
lea r9, [0x01068274]
lea r8, [0x01007ca0]
mov edx, 0x106
lea rcx, [rsp + 0xcb0]
call fcn.01016110
mov word [rsp + 0xeba], 0
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0xcb0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x1510], rax
cmp qword [rsp + 0x1510], 0xffffffffffffffff
je 0x10311c7
lea rax, [rsp + 0x46c]
mov qword [rsp + 0x20], rax
lea r9, [0x01068274]
lea r8, [0x01007c90]
mov edx, 0x106
lea rcx, [rsp + 0xcb0]
call fcn.01016110
lea rcx, [rsp + 0xcb0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x440]
mov rcx, qword [rsp + 0x1510]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1031164
mov rcx, qword [rsp + 0x1510]
call qword [sym.imp.KERNEL32.dll_FindClose]
movzx eax, word [0x01066f10]
test eax, eax
je 0x103120c
lea rcx, [rsp + 0x1504]
call fcn.01031b00
mov dword [rsp + 0x1508], eax
cmp dword [rsp + 0x1508], 0
jne 0x103120a
mov r8d, 0x400
lea rdx, [rsp + 0x690]
mov ecx, dword [rsp + 0x1504]
call fcn.01053650
jmp 0x1031217
mov dword [rsp + 0x1508], 1
lea rcx, [0x01007c78]
call fcn.0103ed90
test eax, eax
je 0x1031270
lea rdx, [0x01068e30]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov qword [0x010689b8], rax
cmp qword [0x010689b8], 0
jne 0x103126e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1504], eax
mov r8d, 0x400
lea rdx, [rsp + 0x690]
mov ecx, dword [rsp + 0x1504]
call fcn.01053650
jmp 0x10312ab
mov r9d, 0x200
lea r8, [rsp + 0x40]
mov edx, 0x174
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea r9, [0x01007c78]
lea r8, [rsp + 0x40]
mov edx, 0x200
lea rcx, [rsp + 0x690]
call fcn.01016110
xor r8d, r8d
lea rdx, [0x01007c58]
xor ecx, ecx
call fcn.01010bb0
mov qword [0x01066df8], rax
cmp qword [0x01066df8], 0
jne 0x103133f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1504], eax
mov r8d, 0x400
lea rdx, [rsp + 0x690]
mov ecx, dword [rsp + 0x1504]
call fcn.01053650
lea r8, [0x01007c4c]
mov edx, 0x200
lea rcx, [rsp + 0x690]
call fcn.01015bf0
lea r8, [0x01007c58]
mov edx, 0x200
lea rcx, [rsp + 0x690]
call fcn.01015bf0
lea r8, [0x010077b4]
mov edx, 0x200
lea rcx, [rsp + 0x690]
call fcn.01015bf0
cmp qword [rsp + 0x1540], 0
je 0x1031373
movzx eax, word [rsp + 0x690]
test eax, eax
je 0x1031373
lea r8, [rsp + 0x690]
mov rdx, qword [rsp + 0x1548]
mov rcx, qword [rsp + 0x1540]
call fcn.0105ab90
cmp qword [0x010689b8], 0
je 0x103139e
cmp qword [0x01066df8], 0
je 0x103139e
cmp dword [rsp + 0x1508], 0
je 0x103139e
mov dword [rsp + 0x1518], 1
jmp 0x10313a9
mov dword [rsp + 0x1518], 0
mov eax, dword [rsp + 0x1518]
mov rcx, qword [rsp + 0x1520]
xor rcx, rsp
call fcn.01059ab0
add rsp, 0x1530
pop rdi
ret