Function at 0x10016610
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ea48
mov eax, dword fs:[0]
push eax
sub esp, 0x824
mov eax, dword [0x10062964]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x53c], 0
xor ecx, ecx
mov edi, 7
xor edx, edx
mov dword [ebp - 0x52c], ecx
mov dword [ebp - 0x528], edi
mov word [ebp - 0x53c], dx
mov edx, dword [eax + 0x10]
mov dword [ebp - 4], 1
test edx, edx
jne 0x1001677d
push str.GLOG_PRODUCT_NAME
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
add esp, 4
test eax, eax
je 0x10016774
push eax
lea ecx, [ebp - 0x56c]
call fcn.10014740
mov esi, eax
lea eax, [ebp - 0x53c]
cmp eax, esi
je 0x10016730
mov edx, dword [ebp - 0x528]
cmp edx, 8
jb 0x100166ea
mov ecx, dword [ebp - 0x53c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100166e0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10016762
push edx
push ecx
call fcn.1003bc00
add esp, 8
mov dword [ebp - 0x52c], 0
xor eax, eax
mov dword [ebp - 0x528], 7
mov word [ebp - 0x53c], ax
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x53c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x52c], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 1
nop
mov edx, dword [ebp - 0x558]
cmp edx, 8
jb 0x1001679c
mov ecx, dword [ebp - 0x56c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10016768
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10016768
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1003bc00
add esp, 8
jmp 0x1001679c
push 0xe
push str.UnknownProduct
jmp 0x10016791
lea esi, [ebp - 0x53c]
cmp esi, eax
je 0x100167a8
cmp dword [eax + 0x14], 8
jb 0x1001678f
mov eax, dword [eax]
push edx
push eax
lea ecx, [ebp - 0x53c]
call fcn.10017ca0
mov ecx, dword [ebp - 0x52c]
mov edi, dword [ebp - 0x528]
mov esi, dword [ebp - 0x53c]
lea eax, [ebp - 0x53c]
cmp edi, 8
cmovae eax, esi
setae byte [ebp - 0x81d]
mov dword [ebp - 0x824], eax
test ecx, ecx
je 0x10016953
mov edx, ecx
mov dword [ebp - 0x82c], eax
xor eax, eax
test edx, edx
je 0x10016815
mov eax, dword [ebp - 0x824]
cmp word [eax], 0x5c
je 0x1001680b
nop dword [eax]
cmp edx, 1
je 0x10016813
mov eax, dword [ebp - 0x82c]
dec edx
add eax, 2
mov dword [ebp - 0x82c], eax
cmp word [eax], 0x5c
jne 0x100167f0
mov eax, dword [ebp - 0x82c]
jmp 0x10016815
xor eax, eax
test eax, eax
je 0x10016953
sub eax, dword [ebp - 0x824]
sar eax, 1
cmp eax, 0xffffffff
je 0x10016953
cmp byte [ebp - 0x81d], 0
lea eax, [ebp - 0x53c]
je 0x1001684e
mov dword [ebp - 0x82c], esi
lea eax, [esi + ecx*2]
mov dword [ebp - 0x824], esi
jmp 0x10016863
lea edx, [ebp - 0x53c]
lea eax, [eax + ecx*2]
mov dword [ebp - 0x82c], edx
mov dword [ebp - 0x824], edx
test ecx, ecx
je 0x10016899
dec ecx
or edx, 0xffffffff
cmp ecx, edx
cmovb edx, ecx
mov ecx, dword [ebp - 0x82c]
cmp word [ecx + edx*2], 0x5c
lea ecx, [ecx + edx*2]
mov edx, dword [ebp - 0x82c]
je 0x10016893
cmp ecx, edx
je 0x10016899
sub ecx, 2
cmp word [ecx], 0x5c
jne 0x10016886
sub ecx, edx
sar ecx, 1
jmp 0x1001689c
or ecx, 0xffffffff
mov dword [ebp - 0x56c], 0
mov edx, dword [ebp - 0x824]
lea ecx, [ecx + 1]
mov dword [ebp - 0x55c], 0
mov dword [ebp - 0x558], 7
mov byte [ebp - 4], 1
lea ecx, [edx + ecx*2]
cmp ecx, eax
je 0x100168eb
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x56c]
call fcn.10017ca0
mov edi, dword [ebp - 0x528]
mov esi, dword [ebp - 0x53c]
cmp edi, 8
jb 0x1001691f
lea edi, [edi*2 + 2]
mov eax, esi
cmp edi, 0x1000
jb 0x10016915
mov esi, dword [esi - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10016abb
push edi
push esi
call fcn.1003bc00
add esp, 8
movups xmm0, xmmword [ebp - 0x56c]
movups xmmword [ebp - 0x53c], xmm0
movq xmm0, qword [ebp - 0x55c]
movq qword [ebp - 0x52c], xmm0
mov edi, dword [ebp - 0x528]
mov ecx, dword [ebp - 0x52c]
mov esi, dword [ebp - 0x53c]
mov byte [ebp - 4], 1
cmp edi, 8
lea eax, [ebp - 0x53c]
cmovae eax, esi
setae byte [ebp - 0x81d]
mov dword [ebp - 0x824], eax
test ecx, ecx
je 0x10016aed
mov edx, ecx
mov dword [ebp - 0x82c], eax
xor eax, eax
test edx, edx
je 0x100169b5
mov eax, dword [ebp - 0x824]
cmp word [eax], 0x2f
je 0x100169ab
nop
cmp edx, 1
je 0x100169b3
mov eax, dword [ebp - 0x82c]
dec edx
add eax, 2
mov dword [ebp - 0x82c], eax
cmp word [eax], 0x2f
jne 0x10016990
mov eax, dword [ebp - 0x82c]
jmp 0x100169b5
xor eax, eax
test eax, eax
je 0x10016aed
sub eax, dword [ebp - 0x824]
sar eax, 1
cmp eax, 0xffffffff
je 0x10016aed
cmp byte [ebp - 0x81d], 0
lea eax, [ebp - 0x53c]
je 0x100169ea
mov edx, esi
mov dword [ebp - 0x824], esi
lea eax, [esi + ecx*2]
jmp 0x10016a01
lea edx, [ebp - 0x53c]
mov edi, edx
lea eax, [eax + ecx*2]
mov dword [ebp - 0x824], edi
mov edi, dword [ebp - 0x528]
test ecx, ecx
je 0x10016a43
dec ecx
mov edi, 0xffffffff
cmp ecx, 0xffffffff
cmovb edi, ecx
mov ecx, edi
mov dword [ebp - 0x82c], edi
cmp word [edx + ecx*2], 0x2f
lea ecx, [edx + ecx*2]
mov edi, dword [ebp - 0x528]
je 0x10016a3d
nop dword [eax]
cmp ecx, edx
je 0x10016a43
sub ecx, 2
cmp word [ecx], 0x2f
jne 0x10016a30
sub ecx, edx
sar ecx, 1
jmp 0x10016a46
or ecx, 0xffffffff
mov dword [ebp - 0x56c], 0
mov edx, dword [ebp - 0x824]
lea ecx, [ecx + 1]
mov dword [ebp - 0x55c], 0
mov dword [ebp - 0x558], 7
mov byte [ebp - 4], 1
lea ecx, [edx + ecx*2]
cmp ecx, eax
je 0x10016a95
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x56c]
call fcn.10017ca0
mov edi, dword [ebp - 0x528]
mov esi, dword [ebp - 0x53c]
cmp edi, 8
jb 0x10016acb
lea edi, [edi*2 + 2]
mov eax, esi
cmp edi, 0x1000
jb 0x10016ac1
mov esi, dword [esi - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10016ac1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edi
push esi
call fcn.1003bc00
add esp, 8
movups xmm0, xmmword [ebp - 0x56c]
movups xmmword [ebp - 0x53c], xmm0
movq xmm0, qword [ebp - 0x55c]
movq qword [ebp - 0x52c], xmm0
mov byte [ebp - 4], 1
xor eax, eax
push str.LOCALAPPDATA
mov word [ebp - 0x218], ax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
mov edx, eax
add esp, 4
test edx, edx
je 0x10017177
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10016b10
lea edi, [ebp - 0x218]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10016b26
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10016b50
cmp dword [ebp - 0x528], 8
lea edx, [ebp - 0x53c]
mov ecx, 7
mov esi, str.MovaviLogs_
cmovae edx, dword [ebp - 0x53c]
rep movsd dword es:[edi], dword [esi]
mov esi, edx
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10016b80
lea edi, [ebp - 0x218]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10016b96
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10016bc0
mov eax, dword [0x10047b8c]
mov dword [edi], eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10016be9
test al, 0x10
jne 0x10016c0c
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
je 0x10016c0c
cmp eax, 0x50
je 0x10016c0c
cmp eax, 0xb7
jne 0x10017177
push 0x104
lea eax, [ebp - 0x420]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 0x828]
mov edi, dword [ebp - 0x824]
push 0xffffff36
push 0xd5964000
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.1003c240
add esi, eax
lea ecx, [ebp - 0x56c]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x830], esi
adc edi, edx
push eax
mov dword [ebp - 0x82c], edi
call fcn.10014740
lea ecx, [ebp - 0x420]
mov byte [ebp - 4], 0xa
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10016ca0
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x56c]
call fcn.10017a80
push 2
push 0x10047b90
lea ecx, [ebp - 0x56c]
call fcn.10017a80
cmp dword [ebp - 0x558], 8
lea ecx, [ebp - 0x81c]
lea eax, [ebp - 0x56c]
cmovae eax, dword [ebp - 0x56c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
nop
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 0xffffffff
jne 0x10016ddb
mov dword [ebp - 0x554], 0
xor eax, eax
mov dword [ebp - 0x544], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x540], 7
mov word [ebp - 0x554], ax
lea edx, [ecx + 2]
mov byte [ebp - 4], 0xa
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10016d51
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x554]
call fcn.10017ca0
lea ecx, [ebp - 0x7f0]
mov byte [ebp - 4], 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10016d80
sub ecx, edx
lea eax, [ebp - 0x7f0]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x554]
call fcn.10017a80
cmp dword [ebp - 0x540], 8
lea eax, [ebp - 0x554]
cmovae eax, dword [ebp - 0x554]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x540]
cmp eax, 8
jb 0x10016ddb
inc eax
lea ecx, [ebp - 0x554]
push eax
push dword [ebp - 0x554]
call fcn.10018110
lea eax, [ebp - 0x81c]
push eax
push esi
call edi
test eax, eax
jne 0x10016d00
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], 1
call fcn.10017700
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x5cc]
call fcn.10014740
mov edi, eax
push 0x10047b98
lea ecx, [ebp - 0x5b4]
mov byte [ebp - 4], 0xd
call fcn.10014740
mov esi, eax
push 0x10047b9c
lea ecx, [ebp - 0x59c]
mov byte [ebp - 4], 0xe
call fcn.10014740
push esi
push eax
push dword [ebp - 0x824]
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], 0xf
call fcn.100147d0
push edi
lea eax, [ebp - 0x56c]
mov byte [ebp - 4], 0x10
push eax
push dword [ebp - 0x824]
lea ecx, [ebp - 0x584]
call fcn.100147d0
lea ecx, [ebp - 0x56c]
call fcn.10017700
lea ecx, [ebp - 0x59c]
call fcn.10017700
lea ecx, [ebp - 0x5b4]
call fcn.10017700
lea ecx, [ebp - 0x5cc]
mov byte [ebp - 4], 0x15
call fcn.10017700
mov eax, dword [ebp - 0x574]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1003c22f
add esp, 4
lea ecx, [ebp - 0x584]
cmp dword [ebp - 0x570], 8
mov esi, eax
jb 0x10016ee7
mov edx, dword [ebp - 0x584]
mov ecx, dword [ebp - 0x574]
lea ecx, [edx + ecx*2]
jmp 0x10016ef6
mov eax, dword [ebp - 0x574]
lea edx, [ebp - 0x584]
lea ecx, [ecx + eax*2]
sub ecx, edx
push ecx
push edx
push esi
call fcn.1003d1a8
mov eax, dword [ebp - 0x574]
xor ecx, ecx
push esi
mov word [esi + eax*2], cx
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wputenv]
push esi
call fcn.1003c238
lea edx, [ebp - 0x420]
add esp, 0x14
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10016f24
lea edi, [ebp - 0x218]
sub edx, esi
add edi, 0xfffffffe
nop word [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10016f40
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10016f63
mov eax, dword [0x10047bb8]
push 0x10047bbc
mov dword [edi], eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
mov edx, eax
add esp, 4
mov esi, edx
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10016f90
lea edi, [ebp - 0x218]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10016fa6
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [sym.imp.glog.dll_void___cdecl_google::SetLogDestination_int__char_const__]
xor esi, esi
cmp esi, dword [ebp + 0xc]
jge 0x10016fda
push 0x10047b0f
push esi
call edi
jmp 0x100170f9
push 0
push 0
push 0x104
lea eax, [ebp - 0x6d0]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x218]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x554], 0
lea ecx, [ebp - 0x6d0]
mov dword [ebp - 0x544], 0
mov dword [ebp - 0x540], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x554], 0
mov byte [ebp - 4], 0x15
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10017032
sub ecx, edx
lea eax, [ebp - 0x6d0]
push ecx
push eax
lea ecx, [ebp - 0x554]
call fcn.1000d850
push 1
push 0x10047bd0
lea ecx, [ebp - 0x554]
mov byte [ebp - 4], 0x17
call fcn.10017900
mov eax, dword [sym.imp.glog.dll_char_const__const_const__const_const_google::LogSeverityNames]
mov edx, dword [eax + esi*4]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x824], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10017077
sub ecx, dword [ebp - 0x824]
push ecx
push edx
lea ecx, [ebp - 0x554]
call fcn.10017900
push 1
push 0x10047bd0
lea ecx, [ebp - 0x554]
call fcn.10017900
cmp dword [ebp - 0x540], 0x10
lea eax, [ebp - 0x554]
cmovae eax, dword [ebp - 0x554]
push eax
push esi
call edi
mov edx, dword [ebp - 0x540]
add esp, 8
mov byte [ebp - 4], 0x15
cmp edx, 0x10
jb 0x100170fc
mov ecx, dword [ebp - 0x554]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100170f2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10016762
push edx
push ecx
call fcn.1003bc00
add esp, 8
inc esi
cmp esi, 4
jl 0x10016fc8
cmp dword [ebp - 0x528], 8
lea ecx, [ebp - 0x524]
push 0
push 0
push 0x104
push ecx
push 0xffffffffffffffff
lea eax, [ebp - 0x53c]
cmovae eax, dword [ebp - 0x53c]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x524]
push eax
call dword [sym.imp.glog.dll_void___cdecl_google::InitGoogleLogging_char_const__]
add esp, 4
lea ecx, [ebp - 0x584]
call fcn.10017700
mov eax, dword [ebp - 0x528]
cmp eax, 8
jb 0x10017173
inc eax
lea ecx, [ebp - 0x53c]
push eax
push dword [ebp - 0x53c]
call fcn.10018110
mov al, 1
jmp 0x10017197
mov eax, dword [ebp - 0x528]
cmp eax, 8
jb 0x10017195
inc eax
lea ecx, [ebp - 0x53c]
push eax
push dword [ebp - 0x53c]
call fcn.10018110
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003bc1c
mov esp, ebp
pop ebp
ret