Function at 0x1401d67a0
Capabilities:
Delete file
Enumerate files on windows
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x260], rbx
movdqa xmm0, xmmword [0x14029c3d0]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
lea r12, [0x14034eb30]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop
inc r8
cmp byte [r12 + r8], 0
jne 0x1401d67f0
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.1400b29c0
nop
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x1401d6854
lea rax, [rcx + 6]
mov qword [rsp + 0x70], rax
lea rbx, [rsp + 0x60]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x60]
add rbx, rcx
mov r8d, 6
lea rdx, str..tst
mov rcx, rbx
call fcn.1402496a0
mov byte [rbx + 6], 0
jmp 0x1401d6875
mov qword [rsp + 0x20], 6
lea r9, str..tst
xor r8d, r8d
lea edx, [r8 + 6]
lea rcx, [rsp + 0x60]
call fcn.14007b030
mov dword [reloc.OLEAUT32.dll_SysStringLen], 0x92d
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rcx, qword [rsp + 0x60]
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1401d6c80
xor r13d, r13d
nop word [rax + rax]
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], SafeArrayUnaccessData
mov byte [rsp + 0x40], 0
mov r8, rdi
inc r8
cmp byte [r12 + r8], 0
jne 0x1401d68c6
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.1400b29c0
nop
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1401d692a
lea rax, [rcx + 1]
mov qword [rsp + 0x50], rax
lea rbx, [rsp + 0x40]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x40]
add rbx, rcx
mov r8d, 1
lea rdx, [0x140287e84]
mov rcx, rbx
call fcn.1402496a0
mov byte [rbx + 1], 0
jmp 0x1401d694b
mov qword [rsp + 0x20], 1
lea r9, [0x140287e84]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x40]
call fcn.14007b030
lea rax, [rbp - 4]
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], 0
jne 0x1401d6952
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x1401d69a0
lea rax, [rbx + rcx]
mov qword [rsp + 0x50], rax
lea rdi, [rsp + 0x40]
cmp rdx, 0x10
cmovae rdi, qword [rsp + 0x40]
add rdi, rcx
mov r8, rbx
lea rdx, [rbp - 4]
mov rcx, rdi
call fcn.1402496a0
mov byte [rdi + rbx], 0
jmp 0x1401d69b9
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 4]
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.14007b030
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1401d6bc9
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test eax, eax
je 0x1401d6ba7
mov ecx, ebx
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x150]
mov r8d, ebx
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401d6c36
test rdi, rdi
je 0x1401d6ba7
mov r8d, dword [rbp + 0x150]
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], SafeArrayGetDim
mov byte [rbp - 0x80], 0
mov rdx, rdi
lea rcx, [rbp - 0x80]
call fcn.1400b29c0
nop
mov ecx, dword [rbp + 0x150]
inc ecx
mov eax, 2
mul rcx
mov rsi, rax
mov rax, 0xffffffffffffffff
cmovo rsi, rax
mov rcx, rsi
call fcn.140247068
mov rbx, rax
test rax, rax
je 0x1401d6aa9
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.140249b10
jmp 0x1401d6aac
mov rbx, r13
mov qword [rbp + 0x158], rbx
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae r8, qword [rbp - 0x80]
mov eax, dword [rbp + 0x150]
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, dword [rbp - 0x70]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8d, dword [rbp + 0x150]
inc r8d
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r13w
mov rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.1400b2b10
nop
lea rcx, [rbp - 0x60]
call fcn.1401d83d0
mov rcx, rdi
call fcn.140247060
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x1401d6b5e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401d6b58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401d6cda
call fcn.140247060
nop
test rbx, rbx
je 0x1401d6b6c
mov rcx, rbx
call fcn.140247060
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1401d6ba7
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401d6ba2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401d6ce0
call fcn.140247060
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1401d6bdc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.error
call fcn.1400b2f60
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1401d6c19
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401d6c14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401d6cd4
call fcn.140247060
lea rdx, [rbp - 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1401d6c76
mov rdi, 0xffffffffffffffff
jmp 0x1401d68b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1401d6c76
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401d6c71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401d6ce6
call fcn.140247060
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1401d6cb9
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401d6cb4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401d6cec
call fcn.140247060
mov rbx, qword [rsp + 0x260]
add rsp, 0x210
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1402500e8
nop
call fcn.1402500e8
nop
call fcn.1402500e8
nop
call fcn.1402500e8
nop
call fcn.1402500e8
int3