Function at 0x10035149
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov eax, 0x10054bcc
call fcn.10053340
sub esp, 0x94
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], ebx
push esi
mov dword [ebp - 0x24], 0x3e95
cmp dword [ebp - 0x24], 0x40df
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x40], ecx
jle 0x100351fe
push 0x14f
call dword [sym.imp.GDI32.dll_GetStockObject]
mov esi, ebx
xor edi, edi
mov dword [ebp - 0x18], esi
inc edi
mov eax, ebx
mov dword [ebp - 0x14], ebx
mov edx, esi
mov ecx, eax
shl edx, cl
mov esi, ebx
mov dword [ebp - 0x28], edx
mov eax, edx
mov ecx, esi
shl eax, cl
lea ecx, [ebp - 0x84]
cdq
push edx
push eax
call fcn.10002543
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100351bf
mov eax, dword [eax]
push eax
call fcn.1003de4c
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x84]
call fcn.1000c586
mov edx, dword [ebp - 0x28]
inc esi
cmp esi, 0x17d
jl 0x100351a1
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x15ea
jl 0x10035196
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0xf9
jl 0x10035191
jmp 0x10035201
xor edi, edi
inc edi
mov dword [ebp - 0x14], 0xc69aed23
cmp dword [ebp - 0x24], 0x3e2f
jge 0x1003521c
push str.edywmqfle_yvvtqqco_buclspz_mjixx_uhx_ufbenjgl_uab_qcyxvewc
call fcn.1003de4c
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], 0x205b2906
mov dword [ebp - 0x24], 0x53b1
cmp dword [ebp - 0x24], 0x56c3
jle 0x1003526f
mov esi, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebx + esi]
mov ecx, 0x1006de98
cdq
push edx
push eax
call fcn.1000bb28
inc ebx
cmp ebx, 0xc62
jl 0x10035243
inc esi
push 0
pop ebx
cmp esi, 0x6924
jl 0x10035240
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x18], 5
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x512c
jge 0x10035295
mov edx, str.teqqlego_dbhygp_ydswl_qigqpzmxn_hwsup_rqzmwqxb_gncxlnut_vlmyv_nyts_whppu_imflo_qsxor_mqv
mov ecx, 0x1006de98
call fcn.100102b0
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x24], 0xfffffffc
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x100352c4
push ebx
push 0x200c
push ebx
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x100352ef
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x28], 0x6b17
cmp eax, dword [ebp - 0x1c]
mov eax, edi
jne 0x100352f1
mov eax, ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, 0x7cce3a79
imul eax, dword [ebp - 0x14]
cmp eax, 0xdd77
jge 0x1003530e
mov eax, ebx
cmp dword [ebp - 0x14], ebx
je 0x10035310
mov eax, edi
mov dword [ebp - 0x24], eax
call fcn.10031a02
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.100356ef
mov dword [ebp - 4], 4
mov edx, dword [ebp - 0x3c]
mov ecx, edx
mov esi, dword [ebp - 0x2c]
add esi, 0xffffbddf
mov eax, dword [edx + 4]
cmp byte [eax + 0xd], 0
jne 0x1003538d
cmp dword [eax + 0x10], esi
jge 0x10035372
mov eax, dword [eax + 8]
jmp 0x10035376
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x10035340
cmp ecx, edx
je 0x1003538d
cmp esi, dword [ecx + 0x10]
jl 0x1003538d
mov dword [ebp - 0x34], ecx
lea esi, [ebp - 0x34]
jmp 0x10035393
mov dword [ebp - 0x48], edx
lea esi, [ebp - 0x48]
mov esi, dword [esi]
lea ecx, [ebp - 0x54]
push 4
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
call fcn.10001b7c
mov byte [ebp - 4], 5
mov dword [ebp - 0x14], 0xfffffff7
push 4
mov dword [ebp - 0x1c], 0xe90a624c
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x100353cb
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x54]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100353bf
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x100353ec
push 0x2d9
push ebx
push ebx
push 0x11cb
push ebx
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 3
jg 0x100354aa
mov dword [ebp - 0x1c], 0x2781
cmp dword [ebp - 0x1c], 0x2792
jle 0x10035446
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x1006de98
or eax, esi
cdq
push edx
push eax
call fcn.1000bb28
inc edi
cmp edi, 0x6b0
jl 0x10035415
inc esi
cmp esi, 0x2ccc
jl 0x10035413
mov esi, dword [ebp - 0x28]
xor edi, edi
push ebx
push ebx
inc edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x54]
cmp dword [eax + ecx*4], ebx
jne 0x100354aa
mov byte [ebp - 4], 6
cmp dword [ebp - 0x1c], 0x23c5
jge 0x1003546d
mov edx, str.psdnunoda_qrju_hmkm_jsso
mov ecx, 0x1006de98
call fcn.100102b0
mov dword [ebp - 4], 5
inc dword [ebp - 0x14]
jmp 0x100353ef
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 4
call fcn.10001bd9
mov eax, dword [0x10070d28]
test al, 1
jne 0x100354e9
or eax, edi
mov dword [0x10070d44], 7
mov dword [0x10070d28], eax
xor eax, eax
push 0x10054e78
mov dword [0x10070d40], ebx
mov word [0x10070d30], ax
call fcn.1003dc2b
pop ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x10035502
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x44], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100354f8
mov dword [ebp - 0x18], ebx
jmp 0x10035567
mov dword [ebp - 0x14], 0x7d27
mov dword [ebp - 0x1c], 0xd8bc0d13
mov dword [ebp - 0x2c], 5
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
inc eax
je 0x1003552d
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], ebx
je 0x1003553c
mov eax, edi
cmp dword [ebp - 0x18], ebx
jne 0x1003553e
mov eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x18], ebx
jne 0x10035556
mov eax, ebx
cmp dword [ebp - 0x14], ebx
je 0x10035558
mov eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x14
jl 0x1003550c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
cmp esi, dword [ebp - 0x3c]
je 0x1003559b
push dword [esi + 0x18]
mov edx, dword [esi + 0x14]
lea ecx, [ebp - 0x9c]
call fcn.1002d83b
pop ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x30]
or ecx, edi
jmp 0x100355b5
push 0x10070d30
lea ecx, [ebp - 0x6c]
call fcn.1000bc3d
mov dword [ebp - 4], 9
mov ecx, dword [ebp - 0x30]
or ecx, 2
mov esi, dword [ebp - 0x40]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x14], ecx
mov ecx, esi
push eax
call fcn.1000bc3d
mov eax, dword [ebp - 0x14]
or eax, 4
test al, 2
je 0x100355e3
push ebx
and eax, 0xfffffffd
lea ecx, [ebp - 0x6c]
push edi
mov dword [ebp - 0x14], eax
call fcn.1000c8be
mov eax, dword [ebp - 0x14]
test al, 1
je 0x100355f4
push ebx
push edi
lea ecx, [ebp - 0x9c]
call fcn.1000c8be
lea ecx, [ebp - 0x3c]
call fcn.100356bd
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret