Function at 0x100ae8b
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Get file size
Read file on windows
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x86c
mov eax, dword [0x100fcc8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x103
push esi
xor edi, edi
lea eax, [ebp - 0x107]
push edi
push eax
mov byte [ebp - 0x108], 0
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x61b]
push edi
push eax
mov byte [ebp - 0x61c], 0
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x71f]
push edi
push eax
mov byte [ebp - 0x720], 0
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x30f]
push edi
push eax
mov byte [ebp - 0x310], 0
call sub.msvcrt.dll_memset
add esp, 0x30
push 0x104
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x864], edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
mov cl, byte [ebp + eax - 0x108]
mov byte [ebp + eax - 0x61c], cl
inc eax
test cl, cl
jne 0x100af1b
mov ebx, dword [sym.imp.msvcrt.dll__mbstok]
mov esi, 0x1004794
lea eax, [ebp - 0x61c]
push esi
push eax
call ebx
pop ecx
pop ecx
lea edx, [ebp - 0x108]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x100af4b
push esi
push edi
call ebx
cmp eax, edi
jmp 0x100afa9
lea edi, [ebp - 0x108]
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100af64
mov esi, 0x1004868
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100af76
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100af86
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x1004794
push 0
rep movsb byte es:[edi], byte [esi]
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x100af5d
xor eax, eax
mov cl, byte [ebp + eax - 0x108]
mov byte [ebp + eax - 0x310], cl
inc eax
test cl, cl
jne 0x100afaf
lea edi, [ebp - 0x310]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100afc9
mov esi, 0x100485c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x310]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100afe0
mov esi, 0x1004850
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100aff9
mov esi, 0x1004848
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x108]
movsd dword es:[edi], dword [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100b010
lea edi, [ebp - 0x720]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100b020
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100b03f
mov esi, 0x100483c
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x860]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x108]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x86c], eax
jne 0x100b075
xor al, al
jmp 0x100b281
and dword [ebp - 0x868], 0
push 0x103
lea eax, [ebp - 0x413]
push 0
push eax
mov byte [ebp - 0x414], 0
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax - 0x720]
mov byte [ebp + eax - 0x414], cl
inc eax
test cl, cl
jne 0x100b09b
lea eax, [ebp - 0x834]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100b0b6
lea edi, [ebp - 0x414]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100b0c6
mov ecx, eax
shr ecx, 2
push 0
rep movsd dword es:[edi], dword [esi]
push 0x80
push 3
push 0
push 1
mov ecx, eax
push 0x80000000
lea eax, [ebp - 0x414]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea eax, [esi + 1]
push eax
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
test edi, edi
pop ecx
je 0x100b290
push 0
lea eax, [ebp - 0x868]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100b29c
push ebx
mov byte [edi + esi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, str.USBVID_1004PID_6000
xor ebx, ebx
push esi
push edi
call fcn.0100a0c1
test eax, eax
jne 0x100b164
add ebx, 0x64
add esi, 0x64
cmp ebx, 0x834
jb 0x100b149
jmp 0x100b1b4
push 0x103
lea eax, [ebp - 0x517]
push 0
push eax
mov byte [ebp - 0x518], 0
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax - 0x834]
mov byte [ebp + eax - 0x518], cl
inc eax
test cl, cl
jne 0x100b183
push 0x80
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x518]
push eax
call fcn.0100add6
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
lea eax, [ebp - 0x860]
push eax
push dword [ebp - 0x86c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100b1dd
mov dword [ebp - 0x864], 1
cmp dword [ebp - 0x864], 0
je 0x100b075
push 0x103
lea eax, [ebp - 0x20b]
push 0
push eax
mov byte [ebp - 0x20c], 0
call sub.msvcrt.dll_memset
add esp, 0xc
mov ebx, str.lgusbbus.sys
mov dword [ebp - 0x864], 0x10
xor eax, eax
mov cl, byte [ebp + eax - 0x310]
mov byte [ebp + eax - 0x20c], cl
inc eax
test cl, cl
jne 0x100b218
mov eax, ebx
mov esi, ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100b22f
lea edi, [ebp - 0x20c]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100b23f
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x80
lea eax, [ebp - 0x20c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add ebx, 0x19
dec dword [ebp - 0x864]
jne 0x100b216
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100d57f
leave
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100b06e
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x100b290