Function at 0x140002820
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x140008008]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rbp - 0x78], rdx
xor r14d, r14d
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x140002868
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, al
jns 0x1400028c8
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140002dd0
mov rdx, rax
call fcn.1400025f0
movzx ebx, al
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140002925
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140002920
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
jbe 0x14000291d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
bt eax, 0xa
jae 0x14000292d
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400028db
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140002925
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140002920
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002dc4
mov rcx, r8
call fcn.14000357c
movzx eax, bl
jmp 0x140002d8d
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.140002dd0
nop
mov r8d, 4
mov rcx, rax
call fcn.140002f00
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x1400029bc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400029b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000357c
movdqa xmm0, xmmword [0x140005970]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], r14w
lea rdx, [0x140005950]
lea rcx, [rsp + 0x48]
call fcn.1400016f0
mov rbx, rax
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.140002dd0
nop
mov r9, rbx
mov r8, rax
lea rcx, [rbp - 0x50]
call fcn.1400032f0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140002a46
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a41
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000357c
movdqa xmm0, xmmword [0x140005970]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r14w
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140002a9f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a9a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000357c
movdqa xmm0, xmmword [0x140005970]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r14w
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002bbf
nop dword [rax + rax]
movzx edx, word [rbp - 4]
movzx ecx, word [rbp - 2]
cmp dx, 0x2e
jne 0x140002b0c
test cx, cx
je 0x140002ba1
cmp dx, dx
jne 0x140002b0c
cmp cx, dx
jne 0x140002b0c
cmp word [rbp], 0
je 0x140002ba1
mov eax, dword [rbp - 0x30]
lea r8, [rbp - 4]
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x28]
bt eax, 0xa
jae 0x140002b7e
call fcn.140002f80
cmp qword [rax + 0x18], 8
jb 0x140002b31
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140002ba1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002cb4
call fcn.14000357c
jmp 0x140002ba1
test al, 0x10
jne 0x140002b91
call fcn.140002f80
mov rdx, rax
call fcn.1400025f0
jmp 0x140002ba1
call fcn.140002f80
mov rdx, rax
mov rcx, rsi
call fcn.140002820
lea rdx, [rbp - 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140002ae0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140002bcc
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop
mov rdx, qword [rbp - 0x38]
test eax, eax
je 0x140002cbb
cmp rdx, 8
jb 0x140002c1c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002cee
call fcn.14000357c
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x140002c5c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002d32
call fcn.14000357c
movdqa xmm0, xmmword [0x140005970]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r14w
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140002cad
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140002ca8
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002dc4
mov rcx, r8
call fcn.14000357c
xor al, al
jmp 0x140002d8d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
cmp rdx, 8
jb 0x140002cfb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002cf5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002cf5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000357c
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x140002d3e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002d39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000357c
movdqa xmm0, xmmword [0x140005970]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r14w
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140002d8b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140002d86
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002dc4
mov rcx, r8
call fcn.14000357c
mov al, 1
mov word [rdi], r14w
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r14
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.140003520
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3