Function at 0x44cf90
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x3a8
mov rdi, qword [rdx]
mov rsi, qword [rdx + 8]
lea rax, [rsp + 0x90]
mov r12, rcx
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0xa0]
add rsi, rsi
mov qword [rsp + 0x90], rax
mov rax, rdi
add rax, rsi
je 0x44cfe6
test rdi, rdi
jne 0x44cfe6
lea rcx, [0x0080e918]
call fcn.007cd620
mov rax, rsi
sar rax, 1
cmp rax, 7
mov rdx, rax
mov qword [rsp + 0x150], rax
ja 0x44daa2
cmp rax, 1
je 0x44d0ab
mov rbx, qword [rsp + 0x68]
add rbx, 0x10
test rax, rax
jne 0x44dbf0
lea rsi, [rdx + rdx]
xor r8d, r8d
mov qword [rsp + 0x98], rdx
lea rax, [rbx + rsi]
mov word [rax], r8w
cmp word [rbx + rdx*2 - 2], 0x5c
je 0x44d07d
mov rcx, qword [rsp + 0x68]
lea rdi, [rdx + 1]
add rcx, 0x10
cmp rbx, rcx
je 0x44dc1e
mov rcx, qword [rsp + 0xa0]
cmp rdi, rcx
ja 0x44da14
lea rsi, [rdi + rdi]
mov edx, 0x5c
xor ecx, ecx
mov word [rax], dx
mov qword [rsp + 0x98], rdi
mov word [rbx + rdi*2], cx
lea rax, [rsp + 0xb0]
test rbx, rbx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0xb0], rax
jne 0x44d103
lea rcx, [0x0080e918]
call fcn.007cd620
movzx eax, word [rdi]
xor r9d, r9d
mov qword [rsp + 0x98], 1
mov word [rsp + 0xa2], r9w
cmp ax, 0x5c
mov word [rsp + 0xa0], ax
jne 0x44db25
lea rax, [rsp + 0xb0]
mov esi, 2
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x68]
lea rbx, [rax + 0x10]
mov rcx, rsi
sar rcx, 1
cmp rcx, 7
mov rax, rcx
mov qword [rsp + 0x70], rcx
ja 0x44da5b
cmp rax, 1
je 0x44db0c
mov rdi, qword [rsp + 0x50]
test rcx, rcx
lea rdx, [rdi + 0x10]
jne 0x44dbf8
xor r15d, r15d
mov qword [rsp + 0xb8], rax
lea rcx, [0x0080e9b4]
mov word [rdx + rax*2], r15w
call sub.msvcrt.dll_wcslen
movabs rdx, 0x3fffffffffffffff
sub rdx, qword [rsp + 0xb8]
mov r8, rax
cmp rax, rdx
ja 0x44dcd6
mov rcx, qword [rsp + 0x50]
lea rdx, [0x0080e9b4]
call fcn.0079f760
lea r15, [rsp + 0x150]
mov rcx, qword [rsp + 0xb0]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
mov qword [rsp + 0x40], rax
je 0x44d981
lea rax, [rsp + 0x110]
mov qword [rsp + 0x58], rax
lea rbp, [rsp + 0x130]
lea rax, [rsp + 0x120]
mov qword [rsp + 0x48], rax
lea rdi, [rbp + 0x10]
jmp 0x44d206
lea rcx, [r15 + 0x2c]
mov rbx, qword [sym.imp.msvcrt.dll__wcsicmp]
lea rdx, [0x0080e9bc]
call rbx
test eax, eax
jne 0x44d411
nop
mov rdx, r15
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x44d976
mov eax, dword [rsp + 0x150]
test al, 4
jne 0x44d1f0
test al, 0x10
jne 0x44d1d2
mov rax, qword [rsp + 0x48]
lea rcx, [r15 + 0x2c]
mov qword [rsp + 0x110], rax
call sub.msvcrt.dll_wcslen
lea rbx, [rax + rax]
mov rdx, rbx
sar rdx, 1
cmp rdx, 7
mov qword [rsp + 0x88], rdx
ja 0x44d3c0
cmp rdx, 1
mov rcx, qword [rsp + 0x110]
je 0x44d8e3
test rdx, rdx
jne 0x44d3f0
xor r8d, r8d
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x118], rdx
mov r9, qword [rsp + 0x90]
mov word [rcx + rdx*2], r8w
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.0079dae0
mov qword [rsp + 0x130], rdi
mov rcx, qword [rax]
lea rdx, [rax + 0x10]
cmp rcx, rdx
je 0x44d911
mov qword [rsp + 0x130], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x140], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x138], rcx
mov qword [rax], rdx
xor edx, edx
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 8], 0
mov word [rax + 0x10], dx
mov rax, qword [rsp + 0x130]
cmp rax, rdi
je 0x44d9cc
mov rsi, qword [rsp + 0x50]
lea rdx, [rsi + 0x10]
cmp rcx, rdx
je 0x44d8f3
movdqu xmm0, xmmword [rsp + 0x138]
test rcx, rcx
mov qword [rsp + 0xb0], rax
mov rdx, qword [rsp + 0xc0]
movups xmmword [rsp + 0xb8], xmm0
je 0x44d35b
mov qword [rsp + 0x130], rcx
mov qword [rsp + 0x140], rdx
mov qword [rsp + 0x138], 0
xor eax, eax
cmp rcx, rdi
mov word [rcx], ax
je 0x44d35b
call fcn.007da050
mov rcx, qword [rsp + 0x110]
cmp rcx, qword [rsp + 0x48]
je 0x44d36f
call fcn.007da050
mov rcx, qword [r12 + 0x240]
mov r9d, 1
mov edx, 2
mov r8, qword [rsp + 0xb0]
mov rax, qword [rcx]
mov qword [rsp + 0x20], 0
call qword [rax + 0x50]
mov edx, pe_nt_image_headers64
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x44d1f0
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x88]
xor r8d, r8d
call fcn.0079f8b0
mov rcx, rax
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x120], rax
lea rdx, [r15 + 0x2c]
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x110]
jmp 0x44d262
lea rcx, [r15 + 0x2c]
lea rdx, [0x0080e9c0]
call rbx
test eax, eax
je 0x44d1f0
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x60], rax
lea rcx, [r15 + 0x2c]
lea rax, [rsp + 0xe0]
mov qword [rsp + 0xd0], rax
call sub.msvcrt.dll_wcslen
lea rbx, [rax + rax]
mov rdx, rbx
sar rdx, 1
cmp rdx, 7
mov qword [rsp + 0x78], rdx
ja 0x44d92e
cmp rdx, 1
mov rcx, qword [rsp + 0xd0]
je 0x44d9e6
test rdx, rdx
jne 0x44d958
xor r14d, r14d
mov rax, qword [rsp + 0x98]
xor r8d, r8d
mov qword [rsp + 0xd8], rdx
mov r9, qword [rsp + 0x90]
mov word [rcx + rdx*2], r14w
xor edx, edx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.0079dae0
mov qword [rsp + 0x130], rdi
mov rcx, qword [rax]
lea rdx, [rax + 0x10]
cmp rcx, rdx
je 0x44da3e
mov qword [rsp + 0x130], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x140], rcx
mov rcx, qword [rax + 8]
xor r13d, r13d
mov qword [rsp + 0x138], rcx
mov qword [rax], rdx
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 8], 0
mov word [rax + 0x10], r13w
mov rax, qword [rsp + 0x130]
cmp rax, rdi
je 0x44daf2
mov rsi, qword [rsp + 0x50]
lea rdx, [rsi + 0x10]
cmp rcx, rdx
je 0x44d9f6
movdqu xmm0, xmmword [rsp + 0x138]
test rcx, rcx
mov qword [rsp + 0xb0], rax
mov rdx, qword [rsp + 0xc0]
movups xmmword [rsp + 0xb8], xmm0
je 0x44d57b
mov qword [rsp + 0x130], rcx
mov qword [rsp + 0x140], rdx
mov qword [rsp + 0x138], 0
xor esi, esi
cmp rcx, rdi
mov word [rcx], si
je 0x44d57b
call fcn.007da050
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xd0]
add rax, 0x10
cmp rcx, rax
je 0x44d596
call fcn.007da050
mov r13, qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rax, [rsp + 0x80]
xor r14d, r14d
mov qword [rsp + 0x38], rax
nop dword [rax]
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x130], rdi
mov rsi, qword [rsp + 0xb0]
lea rbx, [rax + rax]
mov rax, rsi
add rax, rbx
je 0x44d5e5
test rsi, rsi
jne 0x44d5e5
lea rcx, [0x0080e918]
call fcn.007cd620
mov rdx, rbx
sar rdx, 1
cmp rdx, 7
mov rax, rdx
mov qword [rsp + 0x80], rdx
ja 0x44d880
cmp rax, 1
je 0x44d8d0
test rdx, rdx
mov rcx, rdi
jne 0x44d8ab
xor ebx, ebx
mov qword [rsp + 0x138], rax
mov rdx, rbp
mov word [rcx + rax*2], bx
mov rcx, r12
call fcn.0044cf90
mov rcx, qword [rsp + 0x130]
cmp rcx, rdi
je 0x44d641
call fcn.007da050
mov rcx, qword [rsp + 0xb0]
call r13
test eax, eax
jne 0x44d1f0
add r14d, 1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp r14d, 2
jle 0x44d5b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbx, [rsp + 0xf0]
mov dword [rsp + 0x20], eax
mov r8d, 0x10
lea r9, [0x0080e9c6]
mov rcx, rbx
lea rdx, [0x0044c2c0]
call fcn.0044c790
lea rcx, [0x0080e9cc]
call sub.msvcrt.dll_wcslen
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
lea r9, [0x0080e9cc]
call fcn.0079dae0
mov rsi, qword [rsp + 0x48]
lea rdx, [rax + 0x10]
mov qword [rsp + 0x110], rsi
mov rcx, qword [rax]
cmp rcx, rdx
je 0x44db3f
mov qword [rsp + 0x110], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x120], rcx
mov rcx, qword [rax + 8]
xor r11d, r11d
mov qword [rsp + 0x118], rcx
lea rcx, str._removing_directory
mov qword [rax], rdx
mov qword [rax + 8], 0
mov word [rax + 0x10], r11w
call sub.msvcrt.dll_wcslen
movabs rdx, 0x3fffffffffffffff
sub rdx, qword [rsp + 0x118]
mov r8, rax
cmp rax, rdx
ja 0x44dc4a
mov rcx, qword [rsp + 0x58]
lea rdx, str._removing_directory
call fcn.0079f760
mov qword [rsp + 0x130], rdi
mov rcx, qword [rax]
lea rdx, [rax + 0x10]
cmp rcx, rdx
je 0x44db5c
mov qword [rsp + 0x130], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x140], rcx
mov rcx, qword [rax + 8]
xor r10d, r10d
mov qword [rsp + 0x138], rcx
mov rcx, rbp
mov qword [rax], rdx
mov rdx, qword [rsp + 0xb0]
mov qword [rax + 8], 0
mov r8, qword [rsp + 0xb8]
mov word [rax + 0x10], r10w
call fcn.0079f760
mov rsi, qword [rsp + 0x60]
lea rdx, [rsi + 0x10]
mov qword [rsp + 0xd0], rdx
mov rcx, qword [rax]
lea rdx, [rax + 0x10]
cmp rcx, rdx
je 0x44db79
mov qword [rsp + 0xd0], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xe0], rcx
mov rcx, qword [rax + 8]
xor r9d, r9d
mov qword [rsp + 0xd8], rcx
mov qword [rax], rdx
mov rcx, qword [rsp + 0x130]
mov qword [rax + 8], 0
mov word [rax + 0x10], r9w
cmp rcx, rdi
je 0x44d814
call fcn.007da050
mov rcx, qword [rsp + 0x110]
cmp rcx, qword [rsp + 0x48]
je 0x44d828
call fcn.007da050
mov rcx, qword [rsp + 0xf0]
add rbx, 0x10
cmp rcx, rbx
je 0x44d83e
call fcn.007da050
mov r9d, 0x10
mov rdx, qword [rsp + 0xd0]
xor ecx, ecx
lea r8, str.Error
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xd0]
add rax, 0x10
cmp rcx, rax
je 0x44d1f0
call fcn.007da050
jmp 0x44d1f0
mov rdx, qword [rsp + 0x38]
xor r8d, r8d
mov rcx, rbp
call fcn.0079f8b0
mov rcx, rax
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x140], rax
mov r8, rbx
mov rdx, rsi
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x130]
jmp 0x44d616
movzx edx, word [rsi]
mov rcx, rdi
mov word [rsp + 0x140], dx
jmp 0x44d616
movzx eax, word [rsp + 0x17c]
mov word [rcx], ax
jmp 0x44d262
movdqu xmm0, xmmword [rsp + 0x138]
mov qword [rsp + 0xb0], rax
movups xmmword [rsp + 0xb8], xmm0
jmp 0x44d35b
mov rcx, qword [rax + 0x10]
mov rbx, qword [rax + 0x18]
mov qword [rsp + 0x140], rcx
mov qword [rsp + 0x148], rbx
jmp 0x44d2c2
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x78]
xor r8d, r8d
call fcn.0079f8b0
mov rcx, rax
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xe0], rax
lea rdx, [r15 + 0x2c]
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0xd0]
jmp 0x44d480
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xb0]
add rax, 0x10
cmp rcx, rax
je 0x44d99c
call fcn.007da050
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x90]
add rax, 0x10
cmp rcx, rax
je 0x44d9b8
call fcn.007da050
nop
add rsp, 0x3a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x50]
mov rdx, rbp
call fcn.0079f7f0
mov rcx, qword [rsp + 0x130]
jmp 0x44d340
movzx eax, word [rsp + 0x17c]
mov word [rcx], ax
jmp 0x44d480
movdqu xmm0, xmmword [rsp + 0x138]
mov qword [rsp + 0xb0], rax
movups xmmword [rsp + 0xb8], xmm0
jmp 0x44d57b
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 1
call fcn.0079f930
mov rbx, qword [rsp + 0x90]
lea rax, [rbx + rsi]
jmp 0x44d063
mov rcx, qword [rax + 0x10]
mov rbx, qword [rax + 0x18]
mov qword [rsp + 0x140], rcx
mov qword [rsp + 0x148], rbx
jmp 0x44d4e0
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x70]
xor r8d, r8d
call fcn.0079f8b0
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xc0], rdx
mov rdx, rbx
mov r8, rsi
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0xb0]
jmp 0x44d137
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x150]
xor r8d, r8d
call fcn.0079f8b0
mov rdx, qword [rsp + 0x150]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0xa0], rdx
mov rdx, rdi
mov r8, rsi
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0x150]
mov rbx, qword [rsp + 0x90]
jmp 0x44d01d
mov rcx, qword [rsp + 0x50]
mov rdx, rbp
call fcn.0079f7f0
mov rcx, qword [rsp + 0x130]
jmp 0x44d560
movzx edx, word [rbx]
mov rdi, qword [rsp + 0x50]
mov word [rsp + 0xc0], dx
lea rdx, [rdi + 0x10]
jmp 0x44d137
mov rsi, qword [rsp + 0x68]
mov edi, 2
lea rbx, [rsi + 0x10]
mov rax, rsi
add rax, 0x12
jmp 0x44d063
mov r9, qword [rax + 0x10]
mov r10, qword [rax + 0x18]
mov qword [rsp + 0x120], r9
mov qword [rsp + 0x128], r10
jmp 0x44d6f1
mov r9, qword [rax + 0x10]
mov r10, qword [rax + 0x18]
mov qword [rsp + 0x140], r9
mov qword [rsp + 0x148], r10
jmp 0x44d777
mov r9, qword [rax + 0x10]
mov r10, qword [rax + 0x18]
mov qword [rsp + 0xe0], r9
mov qword [rsp + 0xe8], r10
jmp 0x44d7e3
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xb0]
add rax, 0x10
cmp rcx, rax
je 0x44dbbe
call fcn.007da050
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x90]
add rax, 0x10
cmp rcx, rax
je 0x44dbd9
call fcn.007da050
mov rcx, rbx
call fcn.0067d310
mov rbx, rax
jmp 0x44dbbe
mov rax, rbx
jmp 0x44dacf
mov rax, rdx
jmp 0x44da82
mov ecx, 7
jmp 0x44d05a
call fcn.007da050
jmp 0x44dba3
lea rcx, [0x0080e964]
call fcn.007cd940
mov rbx, rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xd0]
add rax, 0x10
cmp rcx, rax
jne 0x44dc40
jmp 0x44dba3
lea rcx, [0x0080e964]
call fcn.007cd940
nop
nop
nop word cs:[rax + rax]