Function at 0x100224ce
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x288
mov eax, dword [0x1003b164]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
xor edi, edi
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x288], ecx
mov dword [ebp - 0x284], ebx
mov dword [ebp - 0x258], edi
call esi
lea eax, [eax + eax + 0xa]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
test eax, eax
mov dword [ebp - 0x27c], eax
jne 0x10022545
mov edi, 0x8007000e
push dword [ebp - 0x258]
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
call esi
push dword [ebp - 0x27c]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.10023cf0
leave
ret 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x10022648
push dword [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x280], eax
jne 0x10022652
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1002251e
cmp eax, 3
je 0x1002251e
xor ecx, ecx
cmp eax, ecx
jle 0x100225a0
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, 0x10022608
push eax
push 0x304
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x278]
push 0x10002b18
push eax
mov dword [ebp - 0x278], edi
mov word [ebp - 0x274], 0x63
mov dword [ebp - 0x270], 0xc00012d7
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x25c], 1
call fcn.1002a981
add esp, 0x10
jmp 0x1002251e
push 0x10002b88
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10022802
push 0x10002b80
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10022802
push dword [ebp - 0x258]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push ebx
call esi
mov ebx, eax
lea eax, [ebp - 0x228]
push eax
call esi
add ebx, eax
lea eax, [ebx + ebx + 4]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
test eax, eax
mov dword [ebp - 0x258], eax
je 0x1002288e
mov ebx, dword [ebp - 0x284]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x100026fc
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_lstrcatW]
test byte [ebp - 0x254], 0x10
push dword [ebp - 0x258]
je 0x100227f4
mov ecx, dword [ebp - 0x288]
call fcn.100224ce
mov edi, eax
test edi, edi
jl 0x10022799
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x10022802
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10022898
call esi
mov edi, eax
mov eax, 0x100227b0
push eax
xor ecx, ecx
push 0x323
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x278]
push 0x10002b18
push eax
mov dword [ebp - 0x278], edi
mov word [ebp - 0x274], 0x63
mov dword [ebp - 0x270], 0xc00012d7
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x25c], 1
call fcn.1002a981
add esp, 0x10
push dword [ebp - 0x280]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1002251e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x100228ad
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x280]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10022652
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x10022799
xor ecx, ecx
cmp eax, ecx
jle 0x1002283c
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, 0x10022850
push eax
push 0x338
jmp 0x1002274a
mov edi, 0x8007000e
jmp 0x10022799
call esi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
jmp 0x1002273d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1002290a
call esi
mov edi, eax
mov eax, 0x100228d0
push eax
xor ecx, ecx
push 0x32d
jmp 0x1002274a
call esi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
jmp 0x100228bd