Function at 0x6d5a21b0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x2254]
mov eax, 0x2254
call fcn.6d5ca7f0
push 0xfffffffffffffffe
push 0x6d5db210
push 0x6d5ca792
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6d5e2a5c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x2250], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x225c]
mov dword [ebp - 0x1c], edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
xor eax, eax
mov word [ebp + 0x1250], ax
push edi
push 0x800
lea ecx, [ebp + 0x1250]
push ecx
mov esi, dword [sym.imp.MSVCR100.dll_wcscat_s]
call esi
add esp, 0xc
xor eax, eax
cmp dword [ebp + 0x2264], eax
je 0x6d5a2237
mov dword [ebp - 0x28], 1
jmp 0x6d5a2248
xor edx, edx
cmp dword [ebp + 0x2268], eax
setne dl
add edx, 2
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], eax
mov edi, edi
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x24], eax
jge 0x6d5a23f0
xor ecx, ecx
mov word [ebp + 0x250], cx
push edi
push 0x800
lea edx, [ebp + 0x250]
push edx
call esi
mov eax, dword [ebp - 0x24]
mov ecx, eax
shl ecx, 4
sub ecx, eax
lea edx, [ecx*2 + str.npoji.dll]
push edx
push 0x800
lea eax, [ebp + 0x250]
push eax
call esi
add esp, 0x18
lea ecx, [ebp]
push ecx
lea edx, [ebp + 0x250]
push edx
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov dword [ebp - 0x2c], eax
cmp eax, 0xffffffff
je 0x6d5a23e8
lea eax, [ebp + 0x2c]
push eax
push 0x800
lea ecx, [ebp + 0x1250]
push ecx
call esi
add esp, 0xc
cmp dword [ebp + 0x2264], 0
je 0x6d5a22ff
lea edx, [ebp + 0x1250]
push edx
call fcn.6d593700
add esp, 4
test eax, eax
je 0x6d5a22ff
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x6d5e2a5c
call sub.MSVCR100.dll__local_unwind4
add esp, 0xc
xor eax, eax
jmp 0x6d5a2440
mov eax, dword [ebp + 0x2260]
test eax, eax
je 0x6d5a2338
lea ecx, [ebp + 0x2c]
push ecx
push edi
push eax
call fcn.6d5a1430
add esp, 0xc
test eax, eax
jne 0x6d5a2338
xor edx, edx
mov word [ebp + 0x1250], dx
push edi
push 0x800
lea eax, [ebp + 0x1250]
push eax
call esi
jmp 0x6d5a23cf
push 0x804
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
jne 0x6d5a2363
push 0xfffffffffffffffe
lea ecx, [ebp - 0x10]
push ecx
push 0x6d5e2a5c
call sub.MSVCR100.dll__local_unwind4
add esp, 0xc
xor eax, eax
jmp 0x6d5a2440
xor edx, edx
mov word [eax], dx
lea ecx, [ebp + 0x1250]
mov esi, ecx
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x6d5a2370
sub ecx, esi
mov edx, ecx
lea edi, [eax - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x6d5a2382
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [eax + 0x800], ebx
mov ebx, eax
mov dword [ebp - 0x20], ebx
xor eax, eax
mov word [ebp + 0x1250], ax
mov ecx, dword [ebp - 0x1c]
push ecx
push 0x800
lea edx, [ebp + 0x1250]
push edx
call dword [sym.imp.MSVCR100.dll_wcscat_s]
mov edi, dword [ebp - 0x1c]
mov esi, dword [sym.imp.MSVCR100.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x6d5a22b4
inc dword [ebp - 0x24]
jmp 0x6d5a2250
mov edi, dword [sym.imp.kernel32.dll_DeleteFileW]
test ebx, ebx
je 0x6d5a242f
push ebx
call edi
test eax, eax
jne 0x6d5a2419
push ebx
call fcn.6d593700
add esp, 4
test eax, eax
je 0x6d5a2419
push 0
push ebx
call fcn.6d5a1c80
add esp, 8
mov esi, dword [ebx + 0x800]
push ebx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ebx, esi
mov dword [ebp - 0x20], ebx
jmp 0x6d5a23f6
mov dword [ebp - 4], 0xfffffffe
call fcn.6d5a2466
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2250]
xor ecx, ebp
call fcn.6d5ca6ac
lea esp, [ebp + 0x2254]
pop ebp
ret