Function at 0x140004aa0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2c8
mov esi, 0xffffffff
mov qword [rsp + 0x28], rcx
vmovups xmm0, xmmword [rcx]
vmovaps xmmword [rsp + 0x70], xmm0
lea rdx, [0x1400aa254]
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x70]
call fcn.140002760
mov rax, qword [rsp + 0x68]
lea rdi, [rax*4 + 2]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r14, [0x1400c67c0]
nop dword [rax]
mov ecx, dword [r14 + rbx*4 + 0x10]
cmp ecx, eax
je 0x140004b47
mov ecx, dword [r14 + rbx*4 + 0x14]
cmp ecx, eax
je 0x140004b38
mov ecx, dword [r14 + rbx*4 + 0x18]
cmp ecx, eax
je 0x140004b3d
mov ecx, dword [r14 + rbx*4 + 0x1c]
cmp ecx, eax
je 0x140004b43
add rbx, 4
cmp rbx, 0x80
jne 0x140004b00
mov eax, 0xffffffff
jmp 0x140004b49
inc rbx
jmp 0x140004b47
add rbx, 2
jmp 0x140004b47
add rbx, 3
mov eax, ebx
shl rax, 4
mov rcx, qword [rax + r14 + 0x218]
mov r8, qword [rax + r14 + 0x210]
add r8, rcx
add rdi, rcx
mov qword [rax + r14 + 0x218], rdi
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x60]
call fcn.1400030a0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
lea rdi, [rax*4 + 2]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop word cs:[rax + rax]
mov ecx, dword [r14 + rbx*4 + 0x10]
cmp ecx, eax
je 0x140004be7
mov ecx, dword [r14 + rbx*4 + 0x14]
cmp ecx, eax
je 0x140004bd8
mov ecx, dword [r14 + rbx*4 + 0x18]
cmp ecx, eax
je 0x140004bdd
mov ecx, dword [r14 + rbx*4 + 0x1c]
cmp ecx, eax
je 0x140004be3
add rbx, 4
cmp rbx, 0x80
jne 0x140004ba0
mov eax, 0xffffffff
jmp 0x140004be9
inc rbx
jmp 0x140004be7
add rbx, 2
jmp 0x140004be7
add rbx, 3
mov eax, ebx
shl rax, 4
mov rcx, qword [rax + r14 + 0x218]
mov r8, qword [rax + r14 + 0x210]
add r8, rcx
add rdi, rcx
mov qword [rax + r14 + 0x218], rdi
lea rcx, [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
call fcn.1400030a0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
mov word [rcx + rax], 0
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [r14 + rbx*4 + 0x10]
cmp ecx, eax
je 0x140004c82
mov ecx, dword [r14 + rbx*4 + 0x14]
cmp ecx, eax
je 0x140004c73
mov ecx, dword [r14 + rbx*4 + 0x18]
cmp ecx, eax
je 0x140004c78
mov ecx, dword [r14 + rbx*4 + 0x1c]
cmp ecx, eax
je 0x140004c7e
add rbx, 4
cmp rbx, 0x80
jne 0x140004c40
jmp 0x140004c84
inc rbx
jmp 0x140004c82
add rbx, 2
jmp 0x140004c82
add rbx, 3
mov esi, ebx
shl rsi, 4
mov rax, qword [rsi + r14 + 0x218]
mov rbx, qword [rsi + r14 + 0x210]
add rbx, rax
add rax, 0x800
mov qword [rsi + r14 + 0x218], rax
cmp rdi, 0xffffffffffffffff
je 0x140004feb
lea r12, [rsp + 0x9c]
jmp 0x140004cdf
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rdi
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140004feb
cmp word [rsp + 0x9c], 0
je 0x140004dd0
mov eax, 1
xor r13d, r13d
nop word cs:[rax + rax]
mov ecx, eax
inc eax
add r13d, 0xfffffffe
cmp word [rsp + rcx*2 + 0x9c], 0
jne 0x140004d00
test r13d, r13d
je 0x140004dd0
neg r13d
lea rax, [r12 + r13]
mov rcx, r12
xor ebp, ebp
jmp 0x140004d49
mov byte [rbx + rdx], r8b
mov ebp, 1
add rbp, rdx
add rcx, 2
cmp rcx, rax
jae 0x140004e30
mov rdx, rbp
movzx r8d, word [rcx]
cmp r8w, 0x7f
jbe 0x140004d30
movzx r9d, r8w
cmp r9d, 0x7ff
ja 0x140004d90
mov r9d, r8d
shr r9d, 6
or r9b, 0xc0
mov byte [rbx + rdx], r9b
and r8b, 0x3f
or r8b, 0x80
mov byte [rbx + rdx + 1], r8b
mov ebp, 2
jmp 0x140004d39
mov r10d, r9d
shr r10d, 0xc
or r10b, 0xe0
mov byte [rbx + rdx], r10b
shr r9d, 6
and r9b, 0x3f
or r9b, 0x80
mov byte [rbx + rdx + 1], r9b
and r8b, 0x3f
or r8b, 0x40
mov byte [rbx + rdx + 2], r8b
mov ebp, 3
jmp 0x140004d39
xor ebp, ebp
xor r13d, r13d
mov rsi, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
nop word cs:[rax + rax]
mov edx, dword [r14 + rcx*4 + 0x10]
cmp edx, eax
je 0x140004e5f
mov edx, dword [r14 + rcx*4 + 0x14]
cmp edx, eax
je 0x140004e50
mov edx, dword [r14 + rcx*4 + 0x18]
cmp edx, eax
je 0x140004e55
mov edx, dword [r14 + rcx*4 + 0x1c]
cmp edx, eax
je 0x140004e5b
add rcx, 4
cmp rcx, 0x80
jne 0x140004df0
mov eax, 0xffffffff
jmp 0x140004e61
cmp rbp, 2
je 0x140004f2b
cmp rbp, 1
jne 0x140004dd5
mov ebp, 1
cmp byte [rbx], 0x2e
je 0x140004cc9
jmp 0x140004dd5
inc rcx
jmp 0x140004e5f
add rcx, 2
jmp 0x140004e5f
add rcx, 3
mov eax, ecx
shl rax, 4
mov rcx, qword [rax + r14 + 0x218]
mov r15, qword [rax + r14 + 0x210]
add r15, rcx
add rsi, r13
add rcx, rsi
add rcx, 4
mov qword [rax + r14 + 0x218], rcx
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rcx, r15
mov r8, rsi
call fcn.140091e40
mov word [rsi + r15], 0x2f
lea rcx, [rsi + r15]
add rcx, 2
mov rdx, r12
mov r8, r13
call fcn.140091e40
lea rax, [rsi + r13]
add rax, 2
mov word [r15 + rax], 0
test byte [rsp + 0x70], 0x10
je 0x140004cc0
mov rax, qword [rsp + 0x28]
mov rsi, qword [rax]
mov r13, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
nop word [rax + rax]
mov edx, dword [r14 + rcx*4 + 0x10]
cmp edx, eax
je 0x140004f4f
mov edx, dword [r14 + rcx*4 + 0x14]
cmp edx, eax
je 0x140004f54
mov edx, dword [r14 + rcx*4 + 0x18]
cmp edx, eax
je 0x140004f5c
mov edx, dword [r14 + rcx*4 + 0x1c]
cmp edx, eax
je 0x140004f65
add rcx, 4
cmp rcx, 0x80
jne 0x140004ef0
mov rdx, rsi
mov eax, 0xffffffff
jmp 0x140004f6e
mov rcx, rbx
lea rdx, [0x1400aa25a]
mov r8, rbp
call fcn.140092690
mov ebp, 2
test eax, eax
jne 0x140004dd5
jmp 0x140004cc9
mov rdx, rsi
jmp 0x140004f6c
mov rdx, rsi
inc rcx
jmp 0x140004f6c
mov rdx, rsi
add rcx, 2
jmp 0x140004f6c
mov rdx, rsi
add rcx, 3
mov eax, ecx
shl rax, 4
mov rcx, qword [rax + r14 + 0x218]
mov rsi, qword [rax + r14 + 0x210]
add rsi, rcx
mov r8, rbp
add r8, r13
add rcx, r8
add rcx, 2
mov qword [rax + r14 + 0x218], rcx
test r13, r13
je 0x140004fb4
mov rcx, rsi
mov r8, r13
call fcn.140091e40
mov byte [rsi + r13], 0x2f
inc r13
jmp 0x140004fb7
xor r13d, r13d
lea rcx, [rsi + r13]
mov rdx, rbx
mov r8, rbp
call fcn.140091e40
add r13, rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r13
lea rcx, [rsp + 0x40]
call fcn.140004aa0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x140004cc9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
add rsp, 0x2c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret