Function at 0x1014008
Capabilities:
Delete file
Enumerate files on windows
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102eb6e
mov eax, dword fs:[0]
push eax
mov eax, 0x22c8
call fcn.0100f330
mov eax, dword [0x10370ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x22a8]
mov dword [ebp - 0x22d4], esi
mov dword [ebp - 0x22d0], edi
mov byte [ebp - 0x22a9], bl
call fcn.0101a1db
push ebx
push ebx
lea ecx, [ebp - 0x22a8]
mov dword [ebp - 4], ebx
call fcn.0101a869
cmp eax, ebx
jl 0x10142be
push 0x1038044
lea ecx, [ebp - 0x22b4]
call fcn.0101672d
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
lea edx, [ebp - 0x22b4]
push edx
mov byte [ebp - 4], 1
call dword [eax + 0x38]
cmp byte [ebp + 0xc], bl
je 0x10140b0
push 0x2710
lea ecx, [ebp - 0x22a8]
call fcn.0101a22c
push dword [edi]
lea ecx, [ebp - 0x22a8]
push dword [ebp - 0x22b4]
call fcn.0101af3e
cmp eax, ebx
jl 0x10142a8
lea ecx, [ebp - 0x22a8]
call fcn.0101a299
test eax, eax
jne 0x10142a8
lea ecx, [ebp - 0x22c8]
call fcn.010287be
mov ecx, dword [edi]
add esi, 0x20
mov eax, dword [esi]
push eax
push ecx
lea ecx, [ebp - 0x22c8]
mov byte [ebp - 4], 2
call fcn.01028b99
cmp eax, ebx
jl 0x1014299
push esi
lea ecx, [ebp - 0x22bc]
mov dword [ebp - 0x22c0], ebx
call fcn.01008d1d
push 0x1002214
lea ecx, [ebp - 0x22bc]
mov byte [ebp - 4], 3
call fcn.0100b683
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x22bc]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x22cc], eax
cmp eax, 0xffffffff
je 0x101428b
test byte [ebp - 0x260], 0x10
jne 0x1014254
push esi
lea ecx, [ebp - 0x22c4]
call fcn.01008d1d
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x22c4]
mov byte [ebp - 4], 4
call fcn.0100b683
push ebx
push 1
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [ebp - 0x22c4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1014235
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x22b0], eax
cmp eax, 0xffffffff
je 0x101422e
cmp eax, 0x100000
ja 0x101422e
inc eax
push eax
call fcn.0100ed46
pop ecx
mov dword [ebp - 0x22b8], eax
cmp eax, ebx
je 0x101422e
mov ecx, dword [ebp - 0x22b0]
inc ecx
push ecx
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
lea eax, [ebp - 0x22b0]
push eax
push dword [ebp - 0x22b0]
push dword [ebp - 0x22b8]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1014222
push dword [ebp - 0x22b0]
mov ecx, dword [ebp - 0x22d4]
push dword [ebp - 0x22b8]
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
jl 0x1014222
inc dword [ebp - 0x22c0]
push dword [ebp - 0x22b8]
call fcn.0100ecc6
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x22c4]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 3
call fcn.0100744d
mov edi, dword [ebp - 0x22d0]
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x22cc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1014151
cmp dword [ebp - 0x22c0], 1
jbe 0x101427f
mov byte [ebp - 0x22a9], 1
push dword [ebp - 0x22cc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x22bc]
add ecx, 0xfffffff0
call fcn.0100744d
lea ecx, [ebp - 0x22c8]
mov byte [ebp - 4], 1
call fcn.01008cb3
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x22b4]
add ecx, 0xfffffff0
call fcn.0100744d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22a8]
call fcn.0101a859
mov al, byte [ebp - 0x22a9]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0100f31b
leave
ret 8