Function at 0x1400406b0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x4c0
lea rdi, [rsp + 0x20]
mov ecx, pe_nt_image_headers64
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4d0]
mov rax, qword [0x1402558e8]
xor rax, rsp
mov qword [rsp + 0x4b8], rax
mov rcx, qword [rsp + 0x4d0]
call fcn.140007e50
mov r9d, 0x661
lea r8, [0x1401c32b0]
lea rdx, [0x1401c2c58]
mov rcx, rax
call fcn.14001a700
mov rcx, qword [rsp + 0x4d0]
call fcn.14001a950
test rax, rax
jne 0x14004073a
mov qword [rsp + 0x468], 1
jmp 0x140040746
mov qword [rsp + 0x468], 0
mov r9d, 0x662
lea r8, [0x1401c3310]
lea rdx, str.IsEmptyStr__szOSDirectoryName___FALSE
mov rcx, qword [rsp + 0x468]
call fcn.14001a700
mov rdx, qword [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call fcn.1400069b0
nop
mov dx, 0x5c
lea rcx, [rsp + 0x2a0]
call fcn.140052cc0
lea r8, [0x1401c3078]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x328]
call fcn.1400588c0
mov qword [rsp + 0x470], rax
mov rax, qword [rsp + 0x470]
mov qword [rsp + 0x478], rax
mov rcx, qword [rsp + 0x478]
call fcn.140052570
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x308], rax
lea rcx, [rsp + 0x328]
call fcn.140006c20
cmp qword [rsp + 0x308], 0xffffffffffffffff
je 0x140040a13
cmp dword [rsp + 0x4d8], 2
jne 0x140040818
mov dword [rsp + 0x480], 0
jmp 0x140040826
mov eax, dword [rsp + 0x4d8]
mov dword [rsp + 0x480], eax
mov eax, dword [rsp + 0x480]
mov dword [rsp + 0x310], eax
lea rcx, [rsp + 0x5c]
call fcn.140038790
test rax, rax
jne 0x1400409ea
mov eax, dword [rsp + 0x30]
and eax, 0x10
test eax, eax
je 0x14004092a
lea r8, [rsp + 0x5c]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x388]
call fcn.1400588c0
mov qword [rsp + 0x488], rax
mov rax, qword [rsp + 0x488]
mov qword [rsp + 0x490], rax
mov rcx, qword [rsp + 0x490]
call fcn.140052570
mov r8, qword [rsp + 0x4e0]
mov edx, dword [rsp + 0x310]
mov rcx, rax
call fcn.1400406b0
test rax, rax
jne 0x1400408be
mov dword [rsp + 0x498], 1
jmp 0x1400408c9
mov dword [rsp + 0x498], 0
movzx eax, byte [rsp + 0x498]
mov byte [rsp + 0x380], al
lea rcx, [rsp + 0x388]
call fcn.140006c20
movzx eax, byte [rsp + 0x380]
test eax, eax
je 0x140040925
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x3e0], 0
lea rcx, [rsp + 0x2a0]
call fcn.140006c20
mov rax, qword [rsp + 0x3e0]
jmp 0x140040acc
jmp 0x1400409ea
lea r8, [rsp + 0x5c]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x3f0]
call fcn.1400588c0
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0x4a8], rax
mov rcx, qword [rsp + 0x4a8]
call fcn.140052570
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140040983
mov dword [rsp + 0x4b0], 1
jmp 0x14004098e
mov dword [rsp + 0x4b0], 0
movzx eax, byte [rsp + 0x4b0]
mov byte [rsp + 0x3e8], al
lea rcx, [rsp + 0x3f0]
call fcn.140006c20
movzx eax, byte [rsp + 0x3e8]
test eax, eax
je 0x1400409ea
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x448], 0
lea rcx, [rsp + 0x2a0]
call fcn.140006c20
mov rax, qword [rsp + 0x448]
jmp 0x140040acc
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140040834
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rsp + 0x4d8], 0
je 0x140040a43
mov qword [rsp + 0x450], 1
lea rcx, [rsp + 0x2a0]
call fcn.140006c20
mov rax, qword [rsp + 0x450]
jmp 0x140040acc
cmp qword [rsp + 0x4e0], 0
je 0x140040a7f
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov qword [rsp + 0x458], 1
lea rcx, [rsp + 0x2a0]
call fcn.140006c20
mov rax, qword [rsp + 0x458]
jmp 0x140040acc
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cdqe
mov qword [rsp + 0x318], rax
cmp qword [rsp + 0x318], 0
jne 0x140040aa7
call fcn.14003d670
mov rax, qword [rsp + 0x318]
mov qword [rsp + 0x460], rax
lea rcx, [rsp + 0x2a0]
call fcn.140006c20
mov rax, qword [rsp + 0x460]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.1400bfbe0
mov rax, rdi
mov rcx, qword [rsp + 0x4b8]
xor rcx, rsp
call fcn.1400bfed0
add rsp, 0x4c0
pop rdi
ret