Function at 0x18004b9f0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x708
mov qword [rsp + 0x6d0], 0xfffffffffffffffe
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x6f8], rax
mov byte [rsp + 0x140], 0
lea rdi, [rsp + 0x141]
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov byte [rsp + 0x30], 0
lea rdi, [rsp + 0x31]
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov dword [rsp + 0x20], 0
lea rdi, [rsp + 0x30]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
sub rdi, 1
mov rdx, qword [rsp + 0x720]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx], al
add rcx, 1
test al, al
jne 0x18004ba73
lea rdi, [rsp + 0x30]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
sub rdi, 1
lea rsi, [0x180075f78]
mov ecx, 5
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x390], rax
cmp qword [rsp + 0x390], 0xffffffffffffffff
jne 0x18004bad1
xor eax, eax
jmp 0x18004bef5
lea rdx, [rsp + 0x27c]
lea rcx, [0x180075b24]
sub rcx, rdx
movzx eax, byte [rdx]
cmp al, byte [rdx + rcx]
jne 0x18004baf7
add rdx, 1
test al, al
jne 0x18004bae3
xor eax, eax
jmp 0x18004bafc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x18004bb2f
lea rdx, [rsp + 0x27c]
lea rcx, [0x180075c14]
sub rcx, rdx
movzx eax, byte [rdx]
cmp al, byte [rdx + rcx]
jne 0x18004bb26
add rdx, 1
test al, al
jne 0x18004bb12
xor eax, eax
jmp 0x18004bb2b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x18004bb34
jmp 0x18004bec7
lea rdx, [0x180075f80]
lea rcx, [rsp + 0x27c]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x18004bec7
cmp dword [rsp + 0x270], 0x7d000
jbe 0x18004bb8c
cmp dword [rsp + 0x270], 0x100000
jae 0x18004bb8c
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x27c]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp rcx, 0xa
ja 0x18004bb91
jmp 0x18004bec7
lea rcx, [rsp + 0x27c]
call fcn.18004b930
test eax, eax
je 0x18004bba7
jmp 0x18004bec7
mov byte [rsp + 0x4b0], 0
lea rdi, [rsp + 0x4b1]
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
lea rdi, [rsp + 0x4b0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
sub rdi, 1
mov rdx, qword [rsp + 0x720]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx], al
add rcx, 1
test al, al
jne 0x18004bbe1
lea rdi, [rsp + 0x4b0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
sub rdi, 1
lea rsi, [0x180075c7c]
mov ecx, 2
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x4b0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
sub rdi, 1
lea rdx, [rsp + 0x27c]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx], al
add rcx, 1
test al, al
jne 0x18004bc36
mov byte [rsp + 0x3a0], 0
lea rdi, [rsp + 0x3a1]
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
lea rdx, [rsp + 0x3a0]
lea rcx, [rsp + 0x4b0]
call fcn.18004c980
test eax, eax
je 0x18004be89
lea rax, str.000617FF000D400048C5B216567A67F3
mov qword [rsp + 0x5d8], rax
lea rax, str.00061DDF000D6000F994218927B394EC
mov qword [rsp + 0x5c8], rax
lea rax, str.0006361F000D80001A33A73940E653E5
mov qword [rsp + 0x5c0], rax
lea rax, str.000614BF000D40008D90B4993F19E29F
mov qword [rsp + 0x5e0], rax
lea rax, str.00063C1F000D90005FE31F6C347BEEE4
mov qword [rsp + 0x5d0], rax
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x5d8]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov r8, rcx
mov rdx, qword [rsp + 0x5d8]
lea rcx, [rsp + 0x3a0]
call fcn.180069618
test eax, eax
je 0x18004bde0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x5c8]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov r8, rcx
mov rdx, qword [rsp + 0x5c8]
lea rcx, [rsp + 0x3a0]
call fcn.180069618
test eax, eax
je 0x18004bde0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x5c0]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov r8, rcx
mov rdx, qword [rsp + 0x5c0]
lea rcx, [rsp + 0x3a0]
call fcn.180069618
test eax, eax
je 0x18004bde0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x5e0]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov r8, rcx
mov rdx, qword [rsp + 0x5e0]
lea rcx, [rsp + 0x3a0]
call fcn.180069618
test eax, eax
je 0x18004bde0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x5d0]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov r8, rcx
mov rdx, qword [rsp + 0x5d0]
lea rcx, [rsp + 0x3a0]
call fcn.180069618
test eax, eax
jne 0x18004be87
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x18004be85
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x6d8], rax
mov rax, qword [rsp + 0x728]
mov qword [rsp + 0x6e0], rax
mov rax, qword [rsp + 0x6e0]
mov qword [rsp + 0x6e8], rax
mov rax, qword [rsp + 0x6d8]
movzx eax, byte [rax]
mov byte [rsp + 0x6f0], al
mov rcx, qword [rsp + 0x6e0]
movzx eax, byte [rsp + 0x6f0]
mov byte [rcx], al
mov rax, qword [rsp + 0x6d8]
add rax, 1
mov qword [rsp + 0x6d8], rax
mov rax, qword [rsp + 0x6e0]
add rax, 1
mov qword [rsp + 0x6e0], rax
cmp byte [rsp + 0x6f0], 0
jne 0x18004be26
mov eax, 1
jmp 0x18004bef5
jmp 0x18004bec7
jmp 0x18004be8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x27c]
lea rcx, [rsp + 0x5e8]
call fcn.1800024d0
nop
lea rdx, [rsp + 0x5e8]
lea rcx, [0x1800a7060]
call fcn.18001b3d0
nop
lea rcx, [rsp + 0x5e8]
call fcn.180002520
lea rdx, [rsp + 0x250]
mov rcx, qword [rsp + 0x390]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x18004bad1
mov rcx, qword [rsp + 0x390]
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov rcx, qword [rsp + 0x6f8]
xor rcx, rsp
call fcn.180050540
add rsp, 0x708
pop rdi
pop rsi
ret