Function at 0x402370
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x298
mov r12, qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r13, rcx
mov r15, rdx
mov qword [rsp + 0x2f0], r8
mov qword [rsp + 0x2f8], r9
lea rsi, [rsp + 0x40]
call r12
mov rdx, rsi
mov rcx, r13
movsxd rbp, eax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x402661
mov rdx, qword [0x00420040]
lea rbx, [rbp + rbp - 2]
lea rax, [r13 + rbx]
mov qword [rsp + 0x38], rax
test rdx, rdx
je 0x4023f9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, r13
call qword [sym.imp.msvcrt.dll__wremove]
test eax, eax
je 0x402650
lea rax, [r13 + rbx - 2]
mov qword [rsp + 0x30], rax
lea rbx, [rsi + 0x2c]
mov rcx, rbx
call r12
test byte [rsp + 0x41], 4
mov r14d, eax
jne 0x402550
cdqe
add rax, rbp
cmp rax, r15
jae 0x402582
lea rdx, [0x00419818]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x402550
lea rdx, [0x0041981c]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x402550
test byte [rsp + 0x40], 0x10
jne 0x4025a4
mov rcx, rbx
call r12
add eax, 1
cdqe
cmp rax, qword [rsp + 0x2f8]
jbe 0x402550
sub rax, qword [rsp + 0x2f8]
mov r8, qword [rsp + 0x2f8]
mov rdx, qword [rsp + 0x2f0]
lea rcx, [rbx + rax*2]
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x402550
mov rax, qword [rsp + 0x30]
mov r8d, 0x5c
mov rdx, rbx
mov rcx, qword [rsp + 0x38]
mov word [rax], r8w
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, str._tDBG:_File:__ls_n_tDBG:_decryption..._n
mov rdx, r13
call sub.msvcrt.dll_printf
mov rdx, qword [rsp + 0x300]
mov rcx, r13
call fcn.004017e0
test al, al
je 0x402680
mov rdx, r13
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, r13
call r12
mov rcx, qword [0x00420048]
mov ebx, eax
call r12
mov rdx, qword [rsp + 0x308]
xor ecx, ecx
sub ebx, eax
movsxd rax, ebx
mov word [rdx + rax*2], cx
mov rcx, r13
call qword [sym.imp.msvcrt.dll__wrename]
test eax, eax
jne 0x402691
lea rcx, str._t_tDBG:_File_successfully_renamed.
call sub.msvcrt.dll_puts
mov rax, qword [rsp + 0x30]
xor edx, edx
mov word [rax], dx
nop word [rax + rax]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402403
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
add rsp, 0x298
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str._tDBG:_path_too_long.
call sub.msvcrt.dll_puts
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402403
jmp 0x402564
mov rax, qword [rsp + 0x30]
lea r8d, [r14 + 1]
mov r9d, 0x5c
mov rdx, rbx
mov rcx, qword [rsp + 0x38]
mov word [rax], r9w
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov r8d, 3
mov rcx, r13
lea rdx, [0x004198a6]
call sub.msvcrt.dll_wcsncat
mov rdx, qword [rsp + 0x308]
mov rcx, r13
mov r9, qword [rsp + 0x2f8]
mov r8, qword [rsp + 0x2f0]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x300]
mov qword [rsp + 0x20], rdx
mov rdx, r15
call fcn.00402370
mov rax, qword [rsp + 0x30]
xor r10d, r10d
mov rcx, r13
lea rdx, [0x004198a6]
mov r8d, 3
mov word [rax], r10w
call sub.msvcrt.dll_wcsncat
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402403
jmp 0x402564
lea rcx, str._t_DBG__t_Requirements_file_successfully_deleted._r
call sub.msvcrt.dll_puts
jmp 0x4023f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._tDBG:_FindFirstFile_error:__lu__path:__ls_n
mov r8, r13
mov edx, eax
call sub.msvcrt.dll_printf
jmp 0x40256e
lea rcx, str._t_tDBG:_decryption_failed.
call sub.msvcrt.dll_puts
jmp 0x40253d
lea rcx, str._tDBG:_Error_on_rename_n
call sub.msvcrt.dll_perror
jmp 0x402531