Function at 0x100efce9
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Create directory
Delete file
Enumerate files on windows
Get common file path
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10122abf
mov eax, dword fs:[0]
push eax
mov eax, 0x1b30
call fcn.10039990
mov eax, dword [0x10188074]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x1b38], eax
mov eax, ebx
mov dword [ebp - 0x1ad4], eax
mov dword [ebp - 0x1ae8], eax
call fcn.10081159
mov ecx, eax
call fcn.10080d2f
test eax, eax
jne 0x100efd4b
xor eax, eax
jmp 0x100f05d0
call fcn.1007100a
lea edi, [eax + 4]
mov ecx, edi
call fcn.10089b09
test eax, eax
je 0x100efd44
push ebx
call fcn.1008a345
mov esi, 0x410
lea eax, [ebp - 0x1054]
push esi
push ebx
push eax
call fcn.1003e610
add esp, 0xc
lea eax, [ebp - 0x1464]
push esi
push ebx
push eax
call fcn.1003e610
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x100efd44
call fcn.100029f0
push eax
lea ecx, [ebp - 0x1b04]
call fcn.1000281b
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x1013b678
lea eax, [ebp - 0x1b04]
push str._s__d
push eax
call fcn.10008c51
mov esi, dword [ebp - 0x1b04]
lea eax, [ebp - 0x424]
add esp, 0x10
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100f05c6
push ebx
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x100f05c6
lea eax, [ebp - 0x1b08]
mov ecx, edi
push eax
call fcn.100896a4
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov edi, dword [ebp - 0x1b08]
push edi
mov dword [ebp - 0x1af0], eax
lea eax, [ebp - 0xc44]
push 0x208
push eax
call fcn.1004c044
add esp, 0xc
lea eax, [ebp - 0xc44]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100f05be
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0xc44]
push 0x10133a14
push eax
call esi
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebp - 0x1874]
push 0x208
push eax
call fcn.1004c044
add esp, 0xc
lea eax, [ebp - 0xc44]
push 0x10135cbc
push eax
call esi
lea eax, [ebp - 0x1ac4]
push eax
lea eax, [ebp - 0xc44]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [ebp - 0x1b24], ebx
mov ecx, ebx
mov dword [ebp - 0x1adc], esi
mov eax, ebx
mov dword [ebp - 0x1b2c], ecx
mov dword [ebp - 0x1b28], eax
push 2
pop edx
mov byte [ebp - 4], dl
cmp esi, 0xffffffff
je 0x100f0091
test byte [ebp - 0x1ac4], 0x10
jne 0x100f0062
lea eax, [ebp - 0x1a98]
push eax
lea ecx, [ebp - 0x1ac8]
call fcn.100026e3
mov byte [ebp - 4], 3
push 0x2e
push dword [ebp - 0x1ac8]
call fcn.1003f13a
pop ecx
pop ecx
mov ecx, eax
mov eax, dword [ebp - 0x1ac8]
test ecx, ecx
je 0x100f0054
sub ecx, eax
sar ecx, 1
cmp ecx, 0xffffffff
je 0x100f0054
mov eax, dword [eax - 0xc]
sub eax, ecx
push eax
push ecx
lea eax, [ebp - 0x1ae4]
push eax
lea ecx, [ebp - 0x1ac8]
call fcn.10004d85
mov edi, dword [ebp - 0x1ad4]
push 2
pop eax
or edi, eax
mov dword [ebp - 0x1ad4], edi
push 4
pop edx
mov byte [ebp - 4], dl
mov esi, dword [ebp - 0x1ae4]
push str..txt
push esi
call fcn.10043f14
pop ecx
pop ecx
test eax, eax
jne 0x100effa7
push 8
lea eax, [ebp - 0x1ae0]
push eax
lea ecx, [ebp - 0x1ac8]
call fcn.10004d45
push str.scanlog_
push dword [eax]
or edi, 1
mov dword [ebp - 0x1ad4], edi
call fcn.10043f14
mov byte [ebp - 0x1acd], bl
pop ecx
pop ecx
test eax, eax
je 0x100effae
mov byte [ebp - 0x1acd], 1
push 4
pop eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1ad4]
test al, 1
je 0x100effd5
mov ecx, dword [ebp - 0x1ae0]
and eax, 0xfffffffe
mov dword [ebp - 0x1ad4], eax
lea ecx, [ecx - 0x10]
call fcn.10002a86
cmp byte [ebp - 0x1acd], 0
je 0x100f0002
lea ecx, [esi - 0x10]
call fcn.10002a86
push 2
pop eax
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0x1ac8]
lea ecx, [ecx - 0x10]
call fcn.10002a86
mov esi, dword [ebp - 0x1adc]
jmp 0x100f0062
push dword [ebp - 0x1ac8]
lea eax, [ebp - 0x1874]
push eax
lea eax, [ebp - 0x834]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x834]
push eax
lea ecx, [ebp - 0x1acc]
call fcn.100026e3
lea eax, [ebp - 0x1acc]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x1b2c]
call fcn.10007bda
mov ecx, dword [ebp - 0x1acc]
lea ecx, [ecx - 0x10]
call fcn.10002a86
jmp 0x100effde
push 2
pop ecx
mov byte [ebp - 4], cl
lea ecx, [eax - 0x10]
call fcn.10002a86
lea eax, [ebp - 0x1ac4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100efedc
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x1b28]
mov ecx, dword [ebp - 0x1b2c]
mov edi, dword [ebp - 0x1b08]
sub eax, ecx
sar eax, 2
mov dword [ebp - 0x1afc], eax
test eax, eax
je 0x100f05ad
mov dword [ebp - 0x1b20], ebx
mov dword [ebp - 0x1b1c], ebx
mov dword [ebp - 0x1b18], ebx
mov byte [ebp - 4], 7
mov edx, ebx
mov dword [ebp - 0x1adc], ebx
mov dword [ebp - 0x1acc], ebx
mov dword [ebp - 0x1ad4], ebx
mov dword [ebp - 0x1aec], ebx
mov dword [ebp - 0x1ae0], edx
mov ecx, dword [ecx + edx*4]
sub ecx, 0x10
call fcn.10001ef7
mov dword [ebp - 0x1ae4], eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x1b3c], esi
push esi
mov byte [ebp - 4], 8
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x1ad8]
call fcn.100026e3
mov byte [ebp - 4], 9
lea eax, [ebp - 0x424]
push dword [ebp - 0x1ad8]
push eax
lea eax, [ebp - 0x834]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 1
lea eax, [ebp - 0x834]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x1ae8], eax
test eax, eax
je 0x100f032d
mov eax, dword [ebp - 0x1ad8]
lea ecx, [ebp - 0x1ad8]
mov eax, dword [eax - 0xc]
add eax, 0xfffffffc
push eax
push ebx
lea eax, [ebp - 0x1ac8]
push eax
call fcn.10004d85
push 8
push ebx
lea ecx, [ebp - 0x1ac8]
mov byte [ebp - 4], 0xa
call fcn.100051dc
mov esi, dword [ebp - 0x1ac8]
mov dword [ebp - 0x1b10], ebx
cmp dword [esi - 0xc], 0
jle 0x100f01cf
push ebx
lea ecx, [ebp - 0x1ac8]
call fcn.10008889
push 0x2d
pop ecx
cmp cx, ax
je 0x100f01b3
push ebx
lea ecx, [ebp - 0x1ac8]
call fcn.10008889
push 0x5f
pop ecx
cmp cx, ax
jne 0x100f01c7
push 1
push ebx
lea ecx, [ebp - 0x1ac8]
call fcn.100051dc
mov esi, dword [ebp - 0x1ac8]
inc ebx
cmp ebx, dword [esi - 0xc]
jl 0x100f018b
xor ebx, ebx
push esi
call fcn.1004d515
pop ecx
mov ecx, edx
mov edx, dword [ebp - 0x1aec]
mov dword [ebp - 0x1b10], eax
mov dword [ebp - 0x1af4], ecx
cmp dword [ebp - 0x1ad4], ebx
jne 0x100f0224
cmp edx, ebx
jne 0x100f0224
cmp dword [ebp - 0x1adc], ebx
jne 0x100f0224
cmp dword [ebp - 0x1acc], ebx
jne 0x100f0224
mov dword [ebp - 0x1ad4], eax
mov dword [ebp - 0x1aec], ecx
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x1054]
jmp 0x100f02a4
cmp ecx, edx
jb 0x100f0279
ja 0x100f0232
cmp eax, dword [ebp - 0x1ad4]
jbe 0x100f0279
mov eax, dword [ebp - 0x1ad4]
mov dword [ebp - 0x1adc], eax
lea eax, [ebp - 0x1054]
push eax
lea eax, [ebp - 0x1464]
mov dword [ebp - 0x1acc], edx
push 0x208
push eax
call fcn.1004c044
mov eax, dword [ebp - 0x1b10]
add esp, 0xc
mov dword [ebp - 0x1ad4], eax
mov eax, dword [ebp - 0x1af4]
mov dword [ebp - 0x1aec], eax
jmp 0x100f0212
cmp ecx, dword [ebp - 0x1acc]
jb 0x100f02b2
ja 0x100f028b
cmp eax, dword [ebp - 0x1adc]
jbe 0x100f02b2
mov dword [ebp - 0x1adc], eax
lea eax, [ebp - 0x834]
push eax
mov dword [ebp - 0x1acc], ecx
lea eax, [ebp - 0x1464]
push 0x208
push eax
call fcn.1004c044
add esp, 0xc
lea eax, [ebp - 0x834]
push eax
lea ecx, [ebp - 0x1b0c]
call fcn.100026e3
lea eax, [ebp - 0x1b0c]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x1b20]
call fcn.10007bda
mov ecx, dword [ebp - 0x1b0c]
lea ecx, [ecx - 0x10]
call fcn.10002a86
lea ecx, [esi - 0x10]
call fcn.10002a86
mov ecx, dword [ebp - 0x1ad8]
lea ecx, [ecx - 0x10]
call fcn.10002a86
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x1ae4]
call fcn.10002a86
mov edx, dword [ebp - 0x1ae0]
inc edx
mov dword [ebp - 0x1ae0], edx
cmp edx, dword [ebp - 0x1afc]
jae 0x100f0350
mov ecx, dword [ebp - 0x1b2c]
jmp 0x100f00da
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x1ad8]
lea ecx, [ecx - 0x10]
call fcn.10002a86
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x1ae4]
call fcn.10002a86
cmp dword [ebp - 0x1ae8], 0
je 0x100f05a2
call fcn.100029f0
push eax
lea ecx, [ebp - 0x1ae4]
call fcn.1000281b
mov byte [ebp - 4], 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x1ae4]
push str.slc__d.zip
push eax
call fcn.10008c51
mov esi, dword [ebp - 0x1ae4]
lea eax, [ebp - 0x424]
add esp, 0xc
push esi
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100f03c0
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x1b1c]
sub eax, dword [ebp - 0x1b20]
sar eax, 2
mov dword [ebp - 0x1ad8], eax
test eax, eax
je 0x100f059a
push 0x10190228
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10038dc0
pop ecx
pop ecx
mov ecx, eax
mov dword [ebp - 0x1af8], ecx
mov byte [ebp - 4], 0xd
test ecx, ecx
je 0x100f0593
mov eax, dword [ebp - 0x1ad8]
shl eax, 2
push eax
push ebx
push ecx
call fcn.1003e610
mov eax, dword [ebp - 0x1af8]
add esp, 0xc
mov dword [ebp - 0x1b10], eax
mov eax, dword [ebp - 0x1ad8]
mov dword [ebp - 0x1b14], eax
mov byte [ebp - 4], 0xe
mov ecx, ebx
mov dword [ebp - 0x1acc], ecx
test eax, eax
je 0x100f04df
mov eax, dword [ebp - 0x1b20]
push 0x10190228
push 2
pop edx
mov eax, dword [eax + ecx*4]
xor ecx, ecx
mov eax, dword [eax - 0xc]
inc eax
mov dword [ebp - 0x1ae8], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10038dc0
mov edx, eax
mov dword [ebp - 0x1afc], edx
pop ecx
pop ecx
test edx, edx
je 0x100f05ec
mov eax, dword [ebp - 0x1b20]
mov ecx, dword [ebp - 0x1acc]
push dword [eax + ecx*4]
push dword [ebp - 0x1ae8]
push edx
call fcn.1004c044
mov eax, dword [ebp - 0x1af8]
add esp, 0xc
mov ecx, dword [ebp - 0x1acc]
mov edx, dword [ebp - 0x1afc]
push ebx
mov dword [eax + ecx*4], edx
call fcn.10038d3b
mov eax, dword [ebp - 0x1ad8]
pop ecx
mov ecx, dword [ebp - 0x1acc]
inc ecx
mov dword [ebp - 0x1acc], ecx
cmp ecx, eax
jb 0x100f044c
lea ecx, [ebp - 0x424]
push ecx
push eax
push dword [ebp - 0x1af8]
push ecx
call fcn.10081159
pop ecx
mov ecx, eax
call fcn.10080d10
test eax, eax
je 0x100f0553
push ebx
push 0x80
push 3
xor eax, eax
mov dword [ebp - 0x1b34], ebx
push ebx
inc eax
mov dword [ebp - 0x1b30], ebx
push eax
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1ae0], eax
cmp eax, 0xffffffff
je 0x100f0553
lea ecx, [ebp - 0x1b34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push dword [ebp - 0x1ae0]
test eax, eax
jne 0x100f05f8
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1af0], ebx
mov eax, dword [ebp - 0x1ad8]
mov ecx, dword [ebp - 0x1af8]
test eax, eax
je 0x100f058d
mov edx, dword [ecx + ebx*4]
test edx, edx
je 0x100f0588
push 2
pop eax
push eax
push edx
call fcn.10038d2d
mov eax, dword [ebp - 0x1ad8]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1af8]
inc ebx
cmp ebx, eax
jb 0x100f0569
mov ebx, dword [ebp - 0x1af0]
push ecx
call fcn.10038d3b
pop ecx
lea ecx, [esi - 0x10]
call fcn.10002a86
lea ecx, [ebp - 0x1b20]
call fcn.1000835e
lea ecx, [ebp - 0x1b2c]
call fcn.1000835e
mov esi, dword [ebp - 0x1b04]
lea ecx, [edi - 0x10]
call fcn.10002a86
lea ecx, [esi - 0x10]
call fcn.10002a86
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10038cf9
leave
ret 4
push ebx
call fcn.10038d3b
pop ecx
jmp 0x100f0553
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1b30], ebx
jl 0x100f06c1
jg 0x100f061c
cmp dword [ebp - 0x1b34], 0x500000
jb 0x100f06c1
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x100f0553
lea ecx, [ebp - 0x1054]
mov dword [ebp - 0x1b00], ebx
mov dword [ebp - 0x1afc], ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x100f0646
sub ecx, edx
sar ecx, 1
je 0x100f0663
lea eax, [ebp - 0x1054]
mov dword [ebp - 0x1b00], eax
xor eax, eax
cmp eax, ecx
lea ecx, [ebp - 0x1464]
lea eax, [ecx + 2]
sbb edx, edx
mov dword [ebp - 0x1ae8], eax
neg edx
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x100f067a
sub ecx, dword [ebp - 0x1ae8]
sar ecx, 1
je 0x100f069c
lea eax, [ebp - 0x1464]
inc edx
mov dword [ebp - 0x1afc], eax
lea eax, [ebp - 0x424]
push eax
push edx
lea eax, [ebp - 0x1b00]
push eax
push ecx
call fcn.10081159
pop ecx
mov ecx, eax
call fcn.10080d10
test eax, eax
je 0x100f0553
lea edx, [ebp - 0x424]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x100f06ca
sub edx, ecx
lea eax, [ebp - 0x424]
mov ecx, dword [ebp - 0x1b38]
sar edx, 1
push edx
push eax
call fcn.1000262a
jmp 0x100f0559