Function at 0x401510
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x413e46
mov eax, dword fs:[0]
push eax
sub esp, 0x6a4
mov eax, dword [0x418050]
xor eax, esp
mov dword [esp + 0x6a0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x418050]
xor eax, esp
push eax
lea eax, [esp + 0x6b8]
mov dword fs:[0], eax
mov esi, ecx
push 4
mov dword [esp + 0x34], esi
call fcn.004049d3
xor ecx, ecx
add esp, 4
cmp eax, ecx
je 0x401569
lea edx, [esp + 0x14]
mov dword [eax], edx
jmp 0x40156b
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push 0x51a398
push esi
push str._s_s_.log
lea eax, [esp + 0x4b8]
push 0x104
push eax
mov dword [esp + 0x6d4], 1
call fcn.00403636
add esp, 0x14
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x4b0]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x401627
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov bl, 0x10
test byte [esp + 0x44], bl
jne 0x40161b
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x298]
push 0x104
push ecx
call fcn.00404856
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x68]
add esp, 0xc
mov dword [esp + 0x49c], edx
lea edx, [esp + 0x294]
mov dword [esp + 0x4a0], eax
push edx
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x4ac], ecx
call fcn.004018e0
lea ecx, [esp + 0x44]
push ecx
push esi
call edi
test eax, eax
jne 0x4015c8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov edi, eax
cmp esi, eax
jbe 0x401649
call fcn.00403e5d
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov ebp, dword [esp + 0x14]
cmp esi, eax
jbe 0x401656
call fcn.00403e5d
test ebp, ebp
je 0x401660
cmp ebp, dword [esp + 0x14]
je 0x401665
call fcn.00403e5d
mov ecx, edi
sub ecx, esi
mov eax, 0xf6603d99
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
push 0x4014e0
add eax, edx
push eax
push edi
push esi
call fcn.004023b0
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov esi, ecx
sub esi, edi
mov eax, 0xf6603d99
imul esi
add edx, esi
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
add esp, 0x10
cmp eax, 0xa
jl 0x401725
mov ebp, 0xb
sub ebp, eax
xor esi, esi
test ebp, ebp
jle 0x401725
xor ebx, ebx
nop
sub ecx, edi
mov eax, 0xf6603d99
imul ecx
add edx, ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp esi, ecx
jb 0x4016e2
call fcn.00403e5d
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x30]
add edi, ebx
push edi
push edx
push str._s_s
lea eax, [esp + 0x4b8]
push 0x104
push eax
call fcn.00403636
add esp, 0x14
lea ecx, [esp + 0x4ac]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
inc esi
add ebx, 0x214
cmp esi, ebp
jl 0x4016c0
mov ebx, ecx
cmp edi, ecx
jbe 0x401738
call fcn.00403e5d
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
mov ebp, edi
mov dword [esp + 0x2c], ebp
cmp edi, ecx
jbe 0x40174f
call fcn.00403e5d
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
cmp edi, ebp
ja 0x401757
cmp ebp, ecx
jbe 0x401764
call fcn.00403e5d
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x14]
cmp edi, ebx
ja 0x401770
cmp ebx, ecx
jbe 0x401779
call fcn.00403e5d
mov ecx, dword [esp + 0x24]
xor edi, edi
cmp esi, edi
je 0x401785
cmp esi, dword [esp + 0x14]
je 0x40178e
call fcn.00403e5d
mov ecx, dword [esp + 0x24]
cmp ebp, ebx
je 0x4017e6
mov esi, ecx
sub esi, ebx
mov eax, 0xf6603d99
imul esi
add edx, esi
mov esi, dword [esp + 0x2c]
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x214
add edx, esi
mov ebp, ecx
mov eax, ebx
cmp ebx, ecx
je 0x4017e2
mov ecx, esi
sub ecx, ebx
mov dword [esp + 0x2c], ecx
jmp 0x4017cb
mov ecx, dword [esp + 0x2c]
lea edi, [eax + ecx]
mov esi, eax
add eax, 0x214
mov ecx, 0x85
rep movsd dword es:[edi], dword [esi]
cmp eax, ebp
jne 0x4017c7
xor edi, edi
mov dword [esp + 0x24], edx
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x40]
movzx eax, word [esp + 0x3e]
movzx ecx, word [esp + 0x3c]
push edx
movzx edx, word [esp + 0x3e]
push eax
movzx eax, word [esp + 0x3e]
push ecx
push edx
push eax
mov eax, dword [esp + 0x44]
push 0x51a398
push eax
push str._s_s__02d_02d__02d_02d_02d.log
push 0x104
push eax
call fcn.00403636
mov eax, dword [esp + 0x48]
add esp, 0x28
cmp eax, edi
je 0x40183d
push eax
call fcn.00404156
add esp, 4
mov ecx, dword [esp + 0x14]
push ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call fcn.00404156
add esp, 4
mov ecx, dword [esp + 0x6b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x6a0]
xor ecx, esp
call fcn.00403476
add esp, 0x6b0
ret