Function at 0x180039430
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get session user name
Set file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x900
mov qword [rsp + 0x8e8], 0xfffffffffffffffe
mov rax, qword [0x180284030]
xor rax, rsp
mov qword [rsp + 0x8f8], rax
mov dword [rsp + 0x6cc], 0
mov dword [rsp + 0x6c8], 0
mov qword [rsp + 0x6c0], 0
mov byte [rsp + 0x4a0], 1
mov dword [rsp + 0x250], 0
lea rax, [rsp + 0x254]
mov rdi, rax
xor eax, eax
mov ecx, 0x24c
rep stosb byte [rdi], al
mov qword [rsp + 0x8d0], 0xffffffffffffffff
xor eax, eax
mov word [rsp + 0x6d0], ax
lea rax, [rsp + 0x6d2]
mov rdi, rax
xor eax, eax
mov ecx, 0x1fe
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x40], ax
lea rax, [rsp + 0x42]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x4b0], ax
lea rax, [rsp + 0x4b2]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x910]
call fcn.180001bf4
movzx eax, al
test eax, eax
jne 0x180039525
mov byte [rsp + 0x4a0], 0
jmp 0x18003983a
mov dword [rsp + 0x6c8], 0x100
lea rdx, [rsp + 0x6c8]
lea rcx, [rsp + 0x6d0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x180039563
lea r8, [0x1801a87c0]
mov edx, 0x100
lea rcx, [rsp + 0x6d0]
call fcn.1800d9840
mov ecx, 0x430
call fcn.1800d66b0
mov qword [rsp + 0x8e0], rax
cmp qword [rsp + 0x8e0], 0
je 0x180039597
mov rcx, qword [rsp + 0x8e0]
call fcn.180040570
mov qword [rsp + 0x8f0], rax
jmp 0x1800395a3
mov qword [rsp + 0x8f0], 0
mov rax, qword [rsp + 0x8f0]
mov qword [rsp + 0x8d8], rax
mov rax, qword [rsp + 0x8d8]
mov qword [rsp + 0x6c0], rax
mov rcx, qword [rsp + 0x6c0]
call fcn.180001bf4
movzx eax, al
test eax, eax
jne 0x1800395e4
mov byte [rsp + 0x4a0], 0
jmp 0x18003983a
mov r8, qword [rsp + 0x910]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.1800d9840
lea r9, [rsp + 0x6d0]
mov r8d, 1
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x6c0]
call fcn.180040620
mov rcx, qword [rsp + 0x6c0]
call fcn.180040c30
lea r8, [0x1801a87d4]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.1800ddbd0
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x8d0], rax
cmp qword [rsp + 0x8d0], 0xffffffffffffffff
jne 0x18003967e
mov rcx, qword [rsp + 0x6c0]
call fcn.180040750
mov byte [rsp + 0x4a0], 0
jmp 0x18003983a
mov rcx, qword [rsp + 0x6c0]
call fcn.180040750
movzx eax, word [rsp + 0x27c]
cmp eax, 0x2e
jne 0x1800396ab
mov eax, dword [rsp + 0x250]
and eax, 0x10
test eax, eax
je 0x1800396ab
jmp 0x180039788
lea rax, [rsp + 0x27c]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x910]
lea r8, [0x1801a87e0]
mov edx, 0x104
lea rcx, [rsp + 0x4b0]
call fcn.1800d6e60
mov eax, dword [rsp + 0x250]
and eax, 0x10
test eax, eax
je 0x18003970f
lea rcx, [rsp + 0x4b0]
call fcn.180039430
mov byte [rsp + 0x4a0], al
movzx eax, byte [rsp + 0x4a0]
cmp eax, 1
je 0x18003970d
jmp 0x1800397a6
jmp 0x180039788
lea r9, [rsp + 0x6d0]
mov r8d, 1
lea rdx, [rsp + 0x4b0]
mov rcx, qword [rsp + 0x6c0]
call fcn.180040620
mov rcx, qword [rsp + 0x6c0]
call fcn.180040c30
mov edx, 0x80
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18003977b
mov rcx, qword [rsp + 0x6c0]
call fcn.180040750
mov byte [rsp + 0x4a0], 0
jmp 0x1800397a6
mov rcx, qword [rsp + 0x6c0]
call fcn.180040750
lea rdx, [rsp + 0x250]
mov rcx, qword [rsp + 0x8d0]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18003968b
movzx eax, byte [rsp + 0x4a0]
test eax, eax
jne 0x1800397b7
jmp 0x18003983a
lea r9, [rsp + 0x6d0]
mov r8d, 1
mov rdx, qword [rsp + 0x910]
mov rcx, qword [rsp + 0x6c0]
call fcn.180040620
mov rcx, qword [rsp + 0x6c0]
call fcn.180040c30
mov edx, 0x80
mov rcx, qword [rsp + 0x910]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rsp + 0x910]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x180039823
mov rcx, qword [rsp + 0x6c0]
call fcn.180040750
mov byte [rsp + 0x4a0], 0
jmp 0x18003983a
mov rcx, qword [rsp + 0x6c0]
call fcn.180040750
xor eax, eax
test eax, eax
jne 0x180039504
cmp qword [rsp + 0x8d0], 0xffffffffffffffff
je 0x180039853
mov rcx, qword [rsp + 0x8d0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x6c0]
call fcn.180001bf4
movzx eax, al
test eax, eax
je 0x180039874
lea rcx, [rsp + 0x6c0]
call fcn.18003d020
movzx eax, byte [rsp + 0x4a0]
mov rcx, qword [rsp + 0x8f8]
xor rcx, rsp
call fcn.1800d65d0
add rsp, 0x900
pop rdi
ret