Function at 0x201b7e
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00201b7e
xor esi, esi
xor edi, edi
mov ecx, 0x70
push esi
dec ecx
jne 0x201b9a
xor eax, eax
mov ebx, dword [ebp + 0x20]
cmp eax, dword [ebx]
jne 0x201bc6
xor eax, eax
push eax
mov ebx, dword [ebp + 0x10]
call fcn.0020a4c5
mov eax, ebx
push eax
call dword [0x20ca90]
mov esi, eax
jmp 0x201bcb
mov ebx, dword [ebp + 0x20]
mov esi, dword [ebx]
cmp esi, 0
je 0x20201e
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebx]
call fcn.0020a0c8
mov edx, 0x20cee8
call fcn.0020a15c
call fcn.0020a8fc
mov dword [ebp - 0x20c], eax
mov edi, 1
jmp 0x202004
mov dword [ebp - 0x210], 0
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebx]
call fcn.0020a0c8
mov edx, 0x20cee8
call fcn.0020a15c
mov eax, edi
call fcn.0020a989
lea ebx, [ebp - 0x214]
call fcn.0020a0df
lea ebx, [ebp - 0x214]
push ebx
call fcn.002019d2
call fcn.0020a174
xor eax, eax
call fcn.00207a87
lea ebx, [ebp - 0x218]
call fcn.0020a0df
lea ebx, [ebp - 0x1d8]
push ebx
lea ebx, [ebp - 0x214]
call fcn.0020a4c5
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x21c], eax
fild qword [0x20d1c4]
mov eax, dword [ebp - 0x21c]
call fcn.002099e4
fcompp
fnstsw ax
sahf
je 0x202002
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 0x2e
lea ebx, [ebp - 0x1ac]
call fcn.0020a200
mov ecx, 1
xchg ecx, eax
call fcn.002091d8
cmp eax, ecx
je 0x201fc1
mov edx, dword [ebp - 0x218]
call fcn.0020a0c8
lea ebx, [ebp - 0x1ac]
call fcn.0020a200
call fcn.0020af60
lea ebx, [ebp - 0x220]
call fcn.0020a0df
fild dword [0x20d1bc]
fild dword [0x20d1bc]
mov eax, dword [ebp - 0x1d8]
call fcn.002099e4
call fcn.00209975
fcompp
fnstsw ax
sahf
jne 0x201d96
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x201d91
push 0
push 0
lea ebx, [ebp - 0x200]
mov dword [ebx], esi
push ebx
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov edx, 0x20cefc
call fcn.0020a15c
lea ebx, [esp + 0x14]
push ebx
call fcn.0020a0df
mov edx, dword [ebp - 0x220]
call fcn.0020a0c8
mov edx, 0x20cef0
call fcn.0020a15c
call fcn.0020af60
lea ebx, [esp + 0x14]
push ebx
call fcn.0020a0df
mov eax, dword [ebp + 8]
push eax
call fcn.00201b7e
mov ebx, eax
pop eax
call fcn.0020890a
pop eax
call fcn.0020890a
mov eax, ebx
mov esi, dword [ebp - 0x200]
add dword [ebp - 0x210], eax
jmp 0x201fc1
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x201df4
lea ebx, [ebp - 0x228]
mov eax, ebx
push eax
lea ebx, [ebp - 0x1c4]
push ebx
call dword [sym.imp.KERNEL32.DLL_FileTimeToLocalFileTime]
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x230]
push ebx
lea ebx, [ebp - 0x22c]
push ebx
lea ebx, [ebp - 0x228]
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.DLL_FileTimeToDosDateTime]
fldcw word [ebp - 0x10]
movzx ecx, word [ebp - 0x230]
movzx eax, word [ebp - 0x22c]
shl eax, 0x10
mov ax, cx
mov dword [ebp - 0x1e4], eax
mov eax, 0xffffffff
push eax
mov eax, 8
push eax
push 0
push 0
push 0
push 0
push 0
lea ebx, [ebp - 0x1fc]
push ebx
mov eax, 3
lea ebx, [ebp - 0x220]
call fcn.0020a4c5
mov dword [ebp - 0x30], eax
mov eax, ebx
add eax, dword [ebp - 0x30]
push eax
mov eax, esi
push eax
call dword [0x20ca94]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jne 0x201fc1
call fcn.0020a054
mov dword [ebp - 0x238], eax
mov edx, dword [ebp - 0x220]
call fcn.0020a0c8
xor ebx, ebx
mov eax, dword [ebp - 0x238]
mov word [ebp - 0x46], ax
mov ecx, pe_nt_image_headers32
mov eax, 1
mov dx, 0x20c4
call fcn.00208360
call fcn.002068a8
xor eax, eax
mov ecx, dword [ebp - 0x238]
xchg ecx, eax
call fcn.00205410
cmp eax, ecx
jne 0x201f1d
mov eax, dword [ebp - 0x238]
mov word [ebp - 0x46], ax
mov eax, 0x4000
call fcn.002057fc
lea ebx, [ebp - 0x23c]
call fcn.0020a0df
mov edx, dword [ebp - 0x23c]
call fcn.0020a0c8
call fcn.0020a094
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
jle 0x201f13
mov eax, dword [ebp - 0x240]
push eax
lea ebx, [ebp - 0x23c]
call fcn.0020a4c5
mov eax, ebx
push eax
mov eax, esi
push eax
call dword [0x20ca98]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
je 0x201f0e
jmp 0x201f1d
jmp 0x201f18
jmp 0x201f1d
jmp 0x201e80
xor ecx, ecx
mov eax, dword [ebp - 0x238]
call fcn.00208a28
mov eax, esi
push eax
call dword [0x20ca9c]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jne 0x201f6e
inc dword [ebp - 0x210]
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x201f6e
lea ebx, [ebp - 0x220]
call fcn.0020a4c5
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
fldcw word [ebp - 0x10]
cmp dword [ebp + 8], 0
je 0x201fc1
push 0
mov edx, 0x20cf04
call fcn.0020a15c
mov edx, dword [ebp - 0x220]
call fcn.0020a0c8
call fcn.0020af60
mov eax, 0x64
call fcn.0020b2df
call fcn.0020af60
mov ebx, esp
call fcn.00209a99
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.DLL_SetWindowTextA]
mov ebx, eax
pop eax
call fcn.0020890a
mov eax, ebx
fldcw word [ebp - 0x10]
push 0
lea ebx, [ebp - 0x1d8]
push ebx
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x201ca0
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x210]
add dword [ebp - 0x244], eax
inc edi
mov eax, edi
cmp eax, dword [ebp - 0x20c]
jle 0x201c00
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x98], eax
xor eax, eax
mov ebx, dword [ebp + 0x20]
cmp eax, dword [ebx]
jne 0x202060
cmp esi, 0
je 0x202060
push 0
mov eax, esi
push eax
call dword [0x20caa0]
cmp dword [ebp - 0x244], 0
jne 0x202060
mov ebx, dword [ebp + 0x10]
call fcn.0020a4c5
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
fldcw word [ebp - 0x10]
call fcn.00209f9c
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c