Function at 0x100030000
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get common file path
Get file attributes
Move file
Set file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xb20
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x100081138]
xor rax, rsp
mov qword [rsp + 0xb10], rax
mov rdi, rcx
mov ebp, 1
mov byte [rsp + 0x40], bpl
lea rcx, [rsp + 0x58]
call fcn.10001e06c
nop
lea rcx, [rsp + 0x48]
call fcn.10001e06c
nop
lea rcx, [rsp + 0x50]
call fcn.10001e06c
nop
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x100030097
lea rcx, [rsp + 0x50]
call fcn.10001f3ec
nop
lea rcx, [rsp + 0x48]
call fcn.10001f3ec
nop
lea rcx, [rsp + 0x58]
call fcn.10001f3ec
xor al, al
jmp 0x1000304d4
test al, 0x10
jne 0x1000300b8
lea rcx, [rsp + 0x50]
call fcn.10001f3ec
nop
lea rcx, [rsp + 0x48]
call fcn.10001f3ec
nop
xor esi, esi
jmp 0x1000304c7
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.10002f82c
xor esi, esi
cmp al, sil
je 0x10003013d
mov rcx, qword [rsp + 0x48]
cmp dword [rcx - 0x10], esi
je 0x10003013d
lea r9, [rsp + 0x4e0]
xor r8d, r8d
lea rdx, [0x10000b5a0]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp eax, esi
je 0x10003013d
mov r8d, ebp
lea rdx, [rsp + 0x4e0]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, esi
je 0x10003013d
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x4e0]
repne scasw ax, word [rdi]
not rcx
sub rcx, rbp
mov r8d, ecx
lea rdx, [rsp + 0x4e0]
lea rcx, [rsp + 0x58]
call fcn.10001e7fc
jmp 0x100030168
mov rdx, qword [rdi]
cmp rdx, rsi
jne 0x100030149
mov ecx, esi
jmp 0x10003015b
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, rbp
mov r8d, ecx
lea rcx, [rsp + 0x58]
call fcn.10001e7fc
bt ebx, 0xa
jae 0x1000301dd
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x6200000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x10000
lea r8d, [r9 + 7]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1000301ab
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000301bf
xor edx, edx
lea r8d, [rdx + 4]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov bpl, sil
lea rcx, [rsp + 0x50]
call fcn.10001f3ec
nop
lea rcx, [rsp + 0x48]
call fcn.10001f3ec
nop
mov sil, bpl
jmp 0x1000304c7
mov r10d, 0x104
mov rdx, r10
lea rcx, [rsp + 0x6f0]
mov r9d, esi
lea rax, [rsp + 0x6f0]
mov rdi, qword [rsp + 0x58]
mov r8, rdi
sub r8, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, rsi
je 0x100030226
movzx eax, word [r8 + rcx]
cmp ax, si
je 0x100030226
mov word [rcx], ax
add rcx, 2
sub rdx, rbp
jne 0x100030204
cmp rdx, rsi
jne 0x100030235
sub rcx, 2
mov r9d, 0x8007007a
mov word [rcx], si
cmp r9d, esi
jge 0x100030258
lea rcx, [rsp + 0x50]
call fcn.10001f3ec
nop
lea rcx, [rsp + 0x48]
call fcn.10001f3ec
nop
jmp 0x1000304c7
xor r9d, r9d
mov r8d, r10d
lea rdx, [0x10000b5a8]
lea rcx, [rsp + 0x6f0]
call fcn.10005a4f4
cmp eax, esi
jne 0x100030291
lea rcx, [rsp + 0x50]
call fcn.10001f3ec
nop
lea rcx, [rsp + 0x48]
call fcn.10001f3ec
nop
jmp 0x1000304c7
mov ebx, ebp
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x6f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
je 0x100030475
cmp ebx, ebp
jne 0x100030470
mov r10d, 0x104
mov rdx, r10
lea rcx, [rsp + 0x2d0]
mov r8d, esi
lea rax, [rsp + 0x2d0]
mov r9, rdi
sub r9, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, rsi
je 0x100030304
movzx eax, word [r9 + rcx]
cmp ax, si
je 0x100030304
mov word [rcx], ax
add rcx, 2
sub rdx, rbp
jne 0x1000302e2
cmp rdx, rsi
jne 0x100030313
sub rcx, 2
mov r8d, 0x8007007a
mov word [rcx], si
cmp r8d, esi
jl 0x100030456
xor r9d, r9d
mov r8d, r10d
lea rdx, [rsp + 0xac]
lea rcx, [rsp + 0x2d0]
call fcn.10005a4f4
cmp eax, esi
je 0x100030456
test byte [rsp + 0x80], 0x10
je 0x1000303c6
lea rdx, [0x100009814]
lea rcx, [rsp + 0xac]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, esi
je 0x100030456
lea rdx, [0x100009818]
lea rcx, [rsp + 0xac]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, esi
je 0x100030456
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x68]
call fcn.10001e134
nop
lea rcx, [rsp + 0x68]
call fcn.100030000
cmp al, sil
sete bl
lea rcx, [rsp + 0x68]
call fcn.10001f3ec
cmp bl, sil
je 0x100030456
mov byte [rsp + 0x40], sil
jmp 0x100030456
mov edx, 0x80
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, esi
jne 0x100030456
lea r9, [rsp + 0x900]
xor r8d, r8d
lea rdx, [0x10000b5a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp eax, esi
je 0x10003043d
mov r8d, ebp
lea rdx, [rsp + 0x900]
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, esi
je 0x10003043d
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [rsp + 0x900]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x100030451
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [rsp + 0x40], sil
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ebx, eax
jmp 0x1000302b8
mov rax, qword [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x1000304ac
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp eax, esi
jne 0x1000304ac
xor edx, edx
lea r8d, [rdx + 4]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [rsp + 0x40], sil
lea rcx, [rsp + 0x50]
call fcn.10001f3ec
nop
lea rcx, [rsp + 0x48]
call fcn.10001f3ec
nop
mov sil, byte [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.10001f3ec
mov al, sil
mov rcx, qword [rsp + 0xb10]
xor rcx, rsp
call fcn.10005cbe0
lea r11, [rsp + 0xb20]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret