Function at 0x1400017d0
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x238]
sub rsp, 0x338
mov r13, rcx
xor edx, edx
mov dword [rbp + 0x290], edx
mov r14, qword [rcx + 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r14
cmp rax, 2
jb 0x140002130
mov r15, r13
cmp qword [r13 + 0x18], 8
jb 0x140001827
mov r15, qword [r13]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rdx
lea rsi, [r14 + 2]
mov ebx, 7
lea rdi, [rsp + 0x60]
lea eax, [rbx + 3]
movabs r8, 0x7fffffffffffffff
cmp rsi, rbx
jbe 0x1400018ce
mov rbx, rsi
or rbx, 7
cmp rbx, rcx
jbe 0x14000186b
mov rbx, rcx
lea rcx, [rax - 0xc]
jmp 0x14000188b
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, r8
ja 0x140002136
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400018b7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002136
mov rcx, rax
call fcn.14007bb78
test rax, rax
je 0x14000212a
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400018c9
test rcx, rcx
je 0x1400018c6
call fcn.14007bb78
mov rdi, rax
jmp 0x1400018c9
mov rdi, rdx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rbx
lea rbx, [r14 + r14]
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.14007dab0
mov dword [rbx + rdi], 0x2a005c
xor r15d, r15d
mov word [rdi + rsi*2], r15w
lea r12d, [r15 + 4]
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
mov qword [rbp + 0x298], rax
cmp rax, 0xffffffffffffffff
je 0x1400020b2
mov rsi, qword [r13 + 0x10]
movabs rax, 0x7ffffffffffffffe
test byte [rbp - 0x20], 0x10
je 0x140001ebe
cmp rsi, rax
je 0x140002160
mov r15, r13
cmp qword [r13 + 0x18], 8
jb 0x14000195b
mov r15, qword [r13]
xor edx, edx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rdx
lea r14, [rsi + 1]
mov ebx, 7
lea rdi, [rsp + 0x40]
cmp r14, rbx
jbe 0x140001a0b
mov rbx, r14
or rbx, 7
cmp rbx, rax
jbe 0x140001998
mov rbx, rax
lea rcx, [rdx - 2]
jmp 0x1400019c8
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140002142
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400019f4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002142
mov rcx, rax
call fcn.14007bb78
test rax, rax
je 0x14000213c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001a06
test rcx, rcx
je 0x140001a03
call fcn.14007bb78
mov rdi, rax
jmp 0x140001a06
mov rdi, rdx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rbx
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.14007dab0
mov eax, 0x5c
mov word [rbx + rdi], ax
xor r15d, r15d
mov word [rdi + r14*2], r15w
or r12d, 8
lea rax, [rbp + 0xc]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140001a50
lea rdx, [rbp + 0xc]
lea rcx, [rsp + 0x40]
call fcn.1400272a0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
or r12d, 0x10
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140001ace
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ac9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002148
call fcn.14007bbb4
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r15w
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r15w
lea rax, [rbp + 0xc]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140001b02
lea rdx, [rbp + 0xc]
lea rcx, [rbp - 0x80]
call fcn.14000ad50
nop
or r12d, 1
mov dword [rbp + 0x288], r12d
mov dword [rbp + 0x290], r12d
lea r8, [rbp - 0x80]
mov rdi, qword [rbp - 0x80]
mov rsi, qword [rbp - 0x68]
cmp rsi, 8
cmovae r8, rdi
mov r9, qword [rbp - 0x70]
mov rdx, r9
cmp r9, 1
mov eax, 1
cmova rdx, rax
lea rax, [0x1400aafbc]
mov rcx, rax
test rdx, rdx
je 0x140001b84
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x140001b8e
add rcx, 2
sub rdx, 1
jne 0x140001b70
cmp r9, 1
je 0x140001c30
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], 7
lea rax, [rbp + 0xc]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140001bb0
lea rdx, [rbp + 0xc]
lea rcx, [rsp + 0x20]
call fcn.14000ad50
or r12d, 2
mov dword [rbp + 0x288], r12d
lea r8, [rsp + 0x20]
mov r9, qword [rsp + 0x20]
mov r10, qword [rsp + 0x38]
cmp r10, 8
cmovae r8, r9
mov r11, qword [rsp + 0x30]
mov rdx, r11
cmp r11, 2
mov eax, 2
cmova rdx, rax
lea rax, [0x1400aafc0]
mov rcx, rax
test rdx, rdx
je 0x140001c26
sub r8, rax
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x140001c2c
add rcx, 2
sub rdx, 1
jne 0x140001c12
cmp r11, 2
je 0x140001c3a
mov bl, 1
jmp 0x140001c3c
mov r10, qword [rsp + 0x38]
mov r9, qword [rsp + 0x20]
xor bl, bl
test r12b, 2
je 0x140001c89
and r12d, 0xfffffffd
mov dword [rbp + 0x288], r12d
cmp r10, 8
jb 0x140001c89
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x140001c80
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000214e
mov rcx, r9
call fcn.14007bbb4
nop
test r12b, 1
je 0x140001cd5
and r12d, 0xfffffffe
mov dword [rbp + 0x288], r12d
cmp rsi, 8
jb 0x140001cd5
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140001ccd
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002154
mov rcx, rdi
call fcn.14007bbb4
mov r12, qword [rbp - 0x30]
mov r14, qword [rbp - 0x48]
test bl, bl
je 0x140001e61
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
lea rsi, [rbp - 0x48]
cmp r12, 8
cmovae rsi, r14
mov rdi, qword [rbp - 0x38]
movabs r13, 0x7ffffffffffffffe
cmp rdi, 8
jae 0x140001d27
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], 7
jmp 0x140001d60
mov rbx, rdi
or rbx, 7
cmp rbx, r13
cmova rbx, r13
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x20]
call fcn.14000ace0
mov qword [rsp + 0x20], rax
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.14007dab0
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x20]
call fcn.1400017d0
lea rbx, [rbp - 0x48]
cmp r12, 8
cmovae rbx, r14
cmp rdi, 8
jae 0x140001d96
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x20], xmm0
mov r15d, 7
mov r13, qword [rsp + 0x20]
jmp 0x140001dcd
mov r15, rdi
or r15, 7
cmp r15, r13
cmova r15, r13
lea rdx, [r15 + 1]
lea rcx, [rsp + 0x20]
call fcn.14000ace0
mov r13, rax
mov qword [rsp + 0x20], rax
lea r8, [rdi*2 + 2]
mov rdx, rbx
mov rcx, rax
call fcn.14007dab0
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rdi
add rdi, rdi
lea rcx, [rdi + 4]
call fcn.14008264c
mov rsi, rax
lea r8, [rdi + 4]
xor edx, edx
mov rcx, rax
call fcn.14007e440
lea rdx, [rsp + 0x20]
cmp r15, 8
cmovae rdx, r13
mov r8, rdi
mov rcx, rsi
call fcn.14007dab0
xor r15d, r15d
mov qword [rbp - 0x80], r15
mov dword [rbp - 0x78], 3
mov qword [rbp - 0x70], rsi
lea rax, [0x1400aafb8]
mov qword [rbp - 0x68], rax
mov ecx, 0x414
mov word [rbp - 0x60], cx
mov dword [rbp - 0x5c], r15d
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x80]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov rcx, rsi
call fcn.140082638
lea rcx, [rsp + 0x20]
call fcn.14000a970
mov r13, qword [rbp + 0x280]
cmp r12, 8
jb 0x140001e9c
lea rdx, [r12*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x140001e94
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000215a
mov rcx, r14
call fcn.14007bbb4
mov r12d, dword [rbp + 0x288]
lea rdx, [rbp - 0x20]
mov rbx, qword [rbp + 0x298]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jmp 0x140001926
cmp rsi, rax
je 0x140002178
mov r15, r13
cmp qword [r13 + 0x18], 8
jb 0x140001ed5
mov r15, qword [r13]
xor edx, edx
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rdx
lea r14, [rsi + 1]
mov ebx, 7
lea rdi, [rsp + 0x20]
cmp r14, rbx
jbe 0x140001f85
mov rbx, r14
or rbx, 7
cmp rbx, rax
jbe 0x140001f12
mov rbx, rax
lea rcx, [rdx - 2]
jmp 0x140001f42
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140002166
add rcx, rcx
cmp rcx, 0x1000
jb 0x140001f6e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002166
mov rcx, rax
call fcn.14007bb78
test rax, rax
je 0x14000216c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001f80
test rcx, rcx
je 0x140001f7d
call fcn.14007bb78
mov rdi, rax
jmp 0x140001f80
mov rdi, rdx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rbx
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.14007dab0
mov eax, 0x5c
mov word [rdi + rbx], ax
xor r15d, r15d
mov word [rdi + r14*2], r15w
or r12d, 0x20
lea rax, [rbp + 0xc]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140001fc1
lea rdx, [rbp + 0xc]
lea rcx, [rsp + 0x20]
call fcn.1400272a0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
or r12d, 0x40
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140002050
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000204b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000216c
call fcn.14007bbb4
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140001ea3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400020a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002172
call fcn.14007bbb4
jmp 0x140001ea3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400020fa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400020f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000212a
call fcn.14007bbb4
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r15w
mov rcx, r13
call fcn.14000a970
add rsp, 0x338
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140082148
nop
call fcn.14000acc0
int3
call fcn.14000aca0
nop
call fcn.140082148
int3
call fcn.14000aca0
nop
call fcn.140082148
nop
call fcn.140082148
nop
call fcn.140082148
nop
call fcn.140082148
int3
call fcn.14000acc0
int3
call fcn.14000aca0
int3
call fcn.140082148
int3
call fcn.140082148
int3
call fcn.14000acc0
int3