Function at 0x1001993c
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100b5ea8
push 0x1003f150
mov eax, dword fs:[0]
push eax
push ecx
push ecx
mov eax, 0x226c
call fcn.1003b1e0
mov eax, dword [0x100be114]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2274], edi
xor esi, esi
mov ebx, esi
mov dword [ebp - 0x2270], ebx
xor eax, eax
mov word [ebp - 0x101c], ax
push edi
push 0x800
lea eax, [ebp - 0x101c]
push eax
call fcn.1004aa73
add esp, 0xc
xor eax, eax
cmp dword [ebp + 0x10], ebx
je 0x100199b3
inc eax
jmp 0x100199bc
cmp dword [ebp + 0x14], eax
setne al
add eax, 2
mov dword [ebp - 0x227c], eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x2278], esi
cmp esi, eax
jge 0x10019b57
xor eax, eax
mov word [ebp - 0x201c], ax
push edi
push 0x800
lea eax, [ebp - 0x201c]
push eax
call fcn.1004aa73
imul eax, esi, 0x1e
add eax, str.npoji.dll
push eax
push 0x800
lea eax, [ebp - 0x201c]
push eax
call fcn.1004aa73
add esp, 0x18
lea eax, [ebp - 0x226c]
push eax
lea eax, [ebp - 0x201c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2280], eax
cmp eax, 0xffffffff
je 0x10019b4b
lea eax, [ebp - 0x2240]
push eax
push 0x800
lea eax, [ebp - 0x101c]
push eax
call fcn.1004aa73
add esp, 0xc
cmp dword [ebp + 0x10], 0
je 0x10019a7a
lea eax, [ebp - 0x101c]
push eax
call fcn.1002f483
pop ecx
test eax, eax
je 0x10019a7a
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x100be114
call fcn.1003f960
add esp, 0xc
xor eax, eax
jmp 0x10019ba8
cmp dword [ebp + 0xc], 0
je 0x10019aa0
lea eax, [ebp - 0x2240]
push eax
push edi
push dword [ebp + 0xc]
call fcn.10019485
add esp, 0xc
test eax, eax
jne 0x10019aa0
mov word [ebp - 0x101c], ax
jmp 0x10019b15
push 0x804
call fcn.1003b0c2
pop ecx
mov ecx, eax
mov dword [ebp - 0x2284], ecx
test ecx, ecx
je 0x10019a60
xor eax, eax
mov word [ecx], ax
lea edx, [ebp - 0x101c]
mov esi, edx
xor edi, edi
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x10019ac6
sub edx, esi
lea edi, [ecx - 2]
xor ecx, ecx
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x10019ad8
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x2284]
mov dword [eax + 0x800], ebx
mov ebx, eax
mov dword [ebp - 0x2270], ebx
xor eax, eax
mov word [ebp - 0x101c], ax
mov edi, dword [ebp - 0x2274]
push edi
push 0x800
lea eax, [ebp - 0x101c]
push eax
call fcn.1004aa73
add esp, 0xc
lea eax, [ebp - 0x226c]
push eax
push dword [ebp - 0x2280]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10019a2e
mov esi, dword [ebp - 0x2278]
inc esi
mov eax, dword [ebp - 0x227c]
jmp 0x100199c5
test ebx, ebx
je 0x10019b99
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10019b7c
push ebx
call fcn.1002f483
pop ecx
test eax, eax
je 0x10019b7c
xor eax, eax
push eax
push ebx
call fcn.10019e05
pop ecx
pop ecx
mov esi, dword [ebx + 0x800]
push 0x804
push ebx
call fcn.1003b0f2
pop ecx
pop ecx
mov ebx, esi
mov dword [ebp - 0x2270], ebx
jmp 0x10019b57
mov dword [ebp - 4], 0xfffffffe
call fcn.10019bc8
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1003b105
leave
ret