Function at 0x14009f130
Capabilities:
Delete file
Enumerate files on windows
Get disk size
Set file attributes

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x868]
sub rsp, 0x940
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14024a080]
xor rax, rsp
mov qword [rbp + 0x830], rax
mov r13, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x410]
call fcn.140159570
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x620]
call fcn.140159570
mov r8d, 0x104
lea rdx, [rbp + 0x410]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x410]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x14009f1ce
lea rcx, [rbp + 0x410]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rdx, str.log_
lea rcx, [rbp + 0x410]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0x410]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rsi, [r13 + 0x80]
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x410]
lea r8, str._s_s.log
mov edx, 0x104
lea rcx, [rbp + 0x620]
call fcn.14007b720
lea rcx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x200]
call fcn.140159570
mov r8d, 0x104
lea rdx, [rbp + 0x200]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x200]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x14009f26b
lea rcx, [rbp + 0x200]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x70], rax
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x200]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x14009f2aa
cmp qword [rsp + 0x38], 0x40000000
ja 0x14009f2aa
xor r12b, r12b
jmp 0x14009f2ad
mov r12b, 1
mov eax, dword [r13 + 0x49c]
lea ebx, [rax + rax*2]
shl ebx, 3
call fcn.14018988c
mov rdi, rax
movsxd rax, ebx
movabs rcx, 0x861c46800
imul rax, rcx
sub rdi, rax
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp - 0x50]
call fcn.140159570
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x620]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x14009f4dd
xor ecx, ecx
mov rbx, rax
nop dword [rax]
test byte [rbp - 0x50], 0x10
jne 0x14009f4ba
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x40], ecx
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], cx
mov r8, 0xffffffffffffffff
inc r8
cmp word [rsi + r8*2], ax
jne 0x14009f350
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.14007dc20
nop
mov rdx, qword [r13 + 0x10]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x14009f373
lea rcx, [rsp + 0x70]
call fcn.14007ddb0
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x5c]
lea rcx, [rbp - 0x24]
call fcn.14007b780
test eax, eax
jne 0x14009f3d2
lea rcx, [rsp + 0x70]
call fcn.14007dbb0
jmp 0x14009f4ba
movzx r15d, word [rsp + 0x54]
movzx r14d, word [rsp + 0x58]
movzx ebx, word [rsp + 0x5c]
sub dword [rsp + 0x5c], 0x76c
mov eax, dword [rsp + 0x58]
lea eax, [rax - 1]
mov dword [rsp + 0x58], eax
js 0x14009f4ab
test eax, eax
js 0x14009f4ab
lea rcx, [rsp + 0x48]
call fcn.1401768b4
imul rax, rax, 0x989680
cmp rax, rdi
jl 0x14009f44f
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x14009f4ab
cmp bx, word [rbp - 0x68]
jne 0x14009f44a
cmp r14w, word [rbp - 0x66]
jne 0x14009f44a
cmp r15w, word [rbp - 0x62]
jne 0x14009f44a
mov eax, dword [r13 + 0x4a0]
sub eax, ecx
cmp eax, 4
jb 0x14009f4ab
jmp 0x14009f44f
test r12b, r12b
jne 0x14009f4ab
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x200]
call fcn.140159570
lea rax, [rbp - 0x24]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x410]
lea r8, str._s_s
mov edx, 0x104
lea rcx, [rbp + 0x200]
call fcn.14007b720
mov edx, 0x80
lea rcx, [rbp + 0x200]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp + 0x200]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rsp + 0x70]
call fcn.14007dbb0
mov rbx, qword [rsp + 0x38]
lea rdx, [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov ecx, 0
jne 0x14009f310
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x830]
xor rcx, rsp
call fcn.1400c7300
lea r11, [rsp + 0x940]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret