Function at 0x1070daf
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xca8
mov eax, dword [0x10d0640]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 0x24c
lea eax, [ebp - 0xc84]
push ebx
push eax
mov dword [ebp - 0xc9c], esi
mov dword [ebp - 0xc8c], edi
mov dword [ebp - 0xc88], ebx
call sub.msvcrt.dll_memset
push 0x106ed5c
push 4
push dword [ebp + 0x10]
mov dword [ebp - 0xc90], ebx
push edi
mov dword [ebp - 0xc94], ebx
call dword [sym.imp.msvcrt.dll_qsort]
add esp, 0x1c
push esi
xor eax, eax
mov word [ebp - 0x61c], ax
mov esi, 0x104
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.0102dff2
mov edi, eax
test edi, edi
je 0x1070e3d
push edi
push 0x10d9013b
jmp 0x1070e76
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.0107043d
mov edi, eax
test edi, edi
je 0x1070e58
push edi
push 0x10dc013b
jmp 0x1070e76
push 0x1013bb8
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.0102e02c
mov edi, eax
test edi, edi
je 0x1070e8f
push edi
push 0x10df013b
call fcn.0108c503
test edi, edi
je 0x1070e8f
push edi
push 0x1329013b
call fcn.0108c503
jmp 0x1071342
lea eax, [ebp - 0xc88]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xc98], eax
cmp eax, 0xffffffff
jne 0x1070ed6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x107130e
cmp eax, 2
je 0x107130e
push eax
call fcn.01091ee9
mov edi, eax
push edi
push 0x1338013b
jmp 0x1070e85
test dword [ebp - 0xc88], 0x10
jne 0x1070fd7
xor eax, eax
cmp ax, word [ebp - 0xc5c]
je 0x1070fd7
push 0x106ed5c
push 4
push dword [ebp + 0x10]
lea eax, [ebp - 0xc5c]
push dword [ebp - 0xc8c]
mov dword [ebp - 0xca0], eax
lea eax, [ebp - 0xca0]
push eax
call dword [sym.imp.msvcrt.dll_bsearch]
add esp, 0x14
test eax, eax
jne 0x1070fd7
lea eax, [ebp - 0xc5c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1070f32
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
test ebx, ebx
jne 0x1070f6b
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xc90], eax
test eax, eax
jne 0x1070f9b
mov edi, 0x8007000e
push edi
push 0x1355013b
jmp 0x1071328
cmp ebx, 0xf4240
jae 0x10710a6
push 0x42
lea eax, [ebx*4 + 4]
push eax
push dword [ebp - 0xc90]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
test eax, eax
je 0x107107b
mov dword [ebp - 0xc90], eax
lea eax, [esi + esi]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp - 0xc90]
mov dword [ecx + ebx*4], eax
test eax, eax
je 0x107108b
lea ecx, [ebp - 0xc5c]
push ecx
push esi
push eax
call fcn.0102dff2
mov edi, eax
inc ebx
mov dword [ebp - 0xc94], ebx
test edi, edi
jne 0x107109b
lea eax, [ebp - 0xc88]
push eax
push dword [ebp - 0xc98]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1070ed6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x107131a
test ebx, ebx
je 0x107130e
mov esi, 0x10042f8
push esi
call fcn.0109c1c3
cmp dword [0x10d22a0], 1
pop ecx
jle 0x1071204
and dword [ebp - 0xc8c], 0
test ebx, ebx
jbe 0x1071307
mov esi, 0x208
mov ecx, dword [ebp - 0xc8c]
push dword [ebp - 0xc9c]
lea eax, [ebp - 0x414]
mov dword [ebp - 0xca8], eax
mov eax, dword [ebp - 0xc90]
mov ebx, dword [eax + ecx*4]
xor eax, eax
mov word [ebp - 0x414], ax
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0102dff2
mov edi, eax
test edi, edi
je 0x10710b6
push edi
push 0x10d9013b
jmp 0x10710eb
mov edi, 0x8007000e
push edi
push 0x1364013b
jmp 0x1071328
mov edi, 0x8007000e
push edi
push 0x1375013b
jmp 0x1071328
push edi
push 0x137f013b
jmp 0x1071328
mov edi, 0x80070216
push edi
push 0x136c013b
jmp 0x1071328
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0107043d
mov edi, eax
test edi, edi
je 0x10710d1
push edi
push 0x10dc013b
jmp 0x10710eb
push ebx
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0102e02c
mov edi, eax
test edi, edi
je 0x10710f8
push edi
push 0x10df013b
call fcn.0108c503
test edi, edi
jne 0x10711b5
lea eax, [ebp - 0x414]
push eax
push 0x30c
call fcn.0108bbbd
push eax
push 0x100cfd4
call fcn.0109c1c3
add esp, 0xc
lea eax, [ebp - 0xca4]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0102ebba
mov edi, eax
test edi, edi
jne 0x10711c0
mov eax, dword [ebp - 0xca4]
inc eax
cmp eax, 0x104
jbe 0x1071182
push 0x1013bac
mov ebx, 0x20d
push ebx
lea eax, [ebp - 0xa38]
push eax
call fcn.0102dff2
mov edi, eax
test edi, edi
jne 0x10711cb
lea eax, [ebp - 0x414]
push eax
push ebx
lea eax, [ebp - 0xa38]
push eax
call fcn.0102e02c
mov edi, eax
test edi, edi
jne 0x10711d6
lea ebx, [ebp - 0xa38]
jmp 0x1071188
mov ebx, dword [ebp - 0xca8]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10711e1
inc dword [ebp - 0xc8c]
mov eax, dword [ebp - 0xc8c]
cmp eax, dword [ebp - 0xc94]
jb 0x1071036
mov esi, 0x10042f8
jmp 0x1071307
push edi
push 0x13a4013b
jmp 0x1071328
push edi
push 0x13ac013b
jmp 0x1071328
push edi
push 0x13b4013b
jmp 0x1071328
push edi
push 0x13b7013b
jmp 0x1071328
call fcn.01091f1e
push ebx
mov edi, eax
push edi
push 0
push 0
call fcn.0108bc9c
push edi
push 0x13bf013b
push ebx
call fcn.0108c53e
jmp 0x107132d
push 0xb08
call fcn.0108bbbd
push eax
call fcn.0109c1c3
push esi
call fcn.0109c1c3
and dword [ebp - 0xc8c], 0
pop ecx
pop ecx
test ebx, ebx
jbe 0x10712d7
mov esi, 0x208
mov eax, dword [ebp - 0xc90]
mov ecx, dword [ebp - 0xc8c]
mov ebx, dword [eax + ecx*4]
push dword [ebp - 0xc9c]
xor eax, eax
mov word [ebp - 0x414], ax
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0102dff2
mov edi, eax
test edi, edi
je 0x1071269
push edi
push 0x10d9013b
jmp 0x107129e
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0107043d
mov edi, eax
test edi, edi
je 0x1071284
push edi
push 0x10dc013b
jmp 0x107129e
push ebx
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0102e02c
mov edi, eax
test edi, edi
je 0x10712a7
push edi
push 0x10df013b
call fcn.0108c503
test edi, edi
jne 0x1071312
lea eax, [ebp - 0x414]
push eax
push 0x1001d58
call fcn.0109c1c3
inc dword [ebp - 0xc8c]
mov eax, dword [ebp - 0xc8c]
pop ecx
pop ecx
cmp eax, dword [ebp - 0xc94]
jb 0x1071230
mov esi, 0x10042f8
push esi
call fcn.0109c1c3
mov dword [esp], 0x1004084
push 0x1007380
push 0x1013ba0
push 0xb09
call fcn.0108bbbd
push eax
call fcn.0109c1c3
push esi
call fcn.0109c1c3
add esp, 0x14
push esi
call fcn.0109c1c3
pop ecx
xor edi, edi
jmp 0x107132d
push edi
push 0x13d3013b
jmp 0x1071328
push eax
call fcn.01091ee9
mov edi, eax
push edi
push 0x138d013b
call fcn.0108c503
cmp dword [ebp - 0xc98], 0xffffffff
je 0x1071342
push dword [ebp - 0xc98]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
xor ebx, ebx
cmp dword [ebp - 0xc94], ebx
jbe 0x1071366
mov eax, dword [ebp - 0xc90]
push dword [eax + ebx*4]
call esi
inc ebx
cmp ebx, dword [ebp - 0xc94]
jb 0x1071352
push dword [ebp - 0xc90]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01077d0b
leave
ret 0xc