Function at 0x18007dafc
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Get common file path
Get file attributes
Move file

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xd60
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0xd50], rax
mov ebx, edx
mov rdi, rcx
call fcn.18007d7ec
xor r12d, r12d
cmp eax, r12d
je 0x18007e050
mov rcx, rdi
call fcn.18007d84c
cmp eax, r12d
je 0x18007e050
mov dword [rsp + 0x30], r12d
mov word [rsp + 0x520], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x522]
call fcn.18009e990
lea rdx, [rsp + 0x520]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.180051898
mov r8d, eax
lea rdx, str.___08x
lea rcx, [rsp + 0x48]
call fcn.180053a60
cmp qword [rax + 0x20], 8
jb 0x18007dbb7
mov rdx, qword [rax + 8]
jmp 0x18007dbbb
lea rdx, [rax + 8]
lea rcx, [rsp + 0x520]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp qword [rsp + 0x68], 8
jb 0x18007dbdb
mov rcx, qword [rsp + 0x50]
call fcn.18009a864
lea rcx, [rsp + 0x520]
call fcn.180050488
cmp eax, r12d
je 0x18007e03d
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, r12d
je 0x18007e03d
lea rdx, [rsp + 0x520]
mov rcx, rdi
call fcn.1800927fc
cmp eax, r12d
jne 0x18007e03d
mov dword [rsp + 0x38], ebx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x520]
lea r14, [0x18007e080]
mov r13d, 1
cmp r14, r12
je 0x18007ddeb
cmp word [rsp + 0x522], 0x3a
je 0x18007dcad
cmp word [rsp + 0x522], 0x5c
je 0x18007dcad
mov word [rsp + 0x940], r12w
xor edx, edx
mov r8d, 0x40e
lea rcx, [rsp + 0x942]
call fcn.18009e990
lea rdx, [rsp + 0x940]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x520]
lea rcx, [rsp + 0x940]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rbx, [rsp + 0x940]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ebp, 0xffffffff
cmp eax, ebp
je 0x18007ddeb
test al, 0x10
je 0x18007ddeb
mov rdx, rbx
lea rcx, [rsp + 0x730]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x1800d1804]
lea rcx, [rsp + 0x730]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x730]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18007ddeb
lea rdx, [0x1800d34d8]
lea rcx, [rsp + 0xec]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, r12d
je 0x18007ddc8
lea rdx, [0x1800d1a48]
lea rcx, [rsp + 0xec]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, r12d
je 0x18007ddc8
cmp dword [rsp + 0xc0], ebp
je 0x18007ddc8
mov rdx, rbx
lea rcx, [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xec]
lea rcx, [rsp + 0x310]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [rsp + 0xc0], 0x10
je 0x18007ddad
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x38]
mov r8, r14
mov edx, r13d
lea rcx, [rsp + 0x310]
call fcn.18004fd0c
cmp eax, 2
je 0x18007dde2
jmp 0x18007ddc8
xor r8d, r8d
mov edx, dword [rsp + 0x38]
lea rcx, [rsp + 0x310]
call fcn.18007e0a4
mov rcx, qword [rsp + 0x40]
or dword [rcx], eax
lea rdx, [rsp + 0xc0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r12d
jne 0x18007dd12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rsp + 0x30], r12d
je 0x18007e03d
mov word [rsp + 0x310], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x312]
call fcn.18009e990
mov rdx, rdi
lea rcx, [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov rbx, rax
cmp rax, r12
je 0x18007de57
lea rdx, str..rar
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea rcx, str..zip
cmp eax, r12d
cmovne rcx, rbx
mov rbx, rcx
call fcn.180051898
mov r8d, eax
mov r9, rbx
lea rdx, str..._08x._s
lea rcx, [rsp + 0x48]
call fcn.180053a60
cmp qword [rax + 0x20], 8
jb 0x18007de80
mov rdx, qword [rax + 8]
jmp 0x18007de84
lea rdx, [rax + 8]
lea rcx, [rsp + 0x310]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp qword [rsp + 0x68], 8
jb 0x18007dea4
mov rcx, qword [rsp + 0x50]
call fcn.18009a864
mov r9d, r13d
xor r8d, r8d
lea rdx, [rsp + 0x520]
lea rcx, [rsp + 0x80]
call fcn.180050248
nop
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x48]
call fcn.1800817e8
nop
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x310]
call fcn.180091db4
cmp eax, r12d
sete bpl
mov rax, qword [rsp + 0x70]
mov rbx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x70]
mov qword [rax + 8], rax
mov qword [rsp + 0x78], r12
mov r14d, 7
mov rcx, qword [rsp + 0x70]
cmp rbx, rcx
je 0x18007df4b
mov rsi, qword [rbx]
cmp qword [rbx + 0x30], 8
jb 0x18007df29
mov rcx, qword [rbx + 0x18]
call fcn.18009a864
mov qword [rbx + 0x30], r14
mov qword [rbx + 0x28], r12
mov word [rbx + 0x18], r12w
mov rcx, rbx
call fcn.18009a864
mov rbx, rsi
mov rcx, qword [rsp + 0x70]
cmp rsi, rcx
jne 0x18007df16
call fcn.18009a864
mov qword [rsp + 0x70], r12
mov rcx, qword [rsp + 0x48]
call fcn.18009a864
cmp bpl, r12b
je 0x18007dfc0
mov ebx, r12d
mov r8d, r13d
mov rdx, rdi
lea rcx, [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, r12d
jne 0x18007df95
mov r8d, r13d
mov rdx, rdi
lea rcx, [rsp + 0x310]
call fcn.18007d52c
jmp 0x18007df98
mov eax, r13d
cmp eax, r12d
jne 0x18007dfc5
mov ecx, reloc.WS2_32.dll_sendto
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, r13d
cmp ebx, 5
jl 0x18007df67
lea rcx, [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x18007dfc5
mov dword [rsp + 0x30], r12d
mov rcx, qword [rsp + 0x98]
cmp rcx, r12
je 0x18007e018
mov rdi, qword [rsp + 0xa0]
cmp rcx, rdi
je 0x18007e013
lea rbx, [rcx + 0x20]
cmp qword [rbx], 8
jb 0x18007dff2
mov rcx, qword [rbx - 0x18]
call fcn.18009a864
mov qword [rbx], r14
mov qword [rbx - 8], r12
mov word [rbx - 0x18], r12w
add rbx, 0x28
lea rax, [rbx - 0x20]
cmp rax, rdi
jne 0x18007dfe3
mov rcx, qword [rsp + 0x98]
call fcn.18009a864
mov qword [rsp + 0x98], r12
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xa8], r12
mov rcx, qword [rsp + 0x80]
call fcn.18009a864
lea rcx, [rsp + 0x520]
call fcn.180051064
mov eax, dword [rsp + 0x30]
jmp 0x18007e052
xor eax, eax
mov rcx, qword [rsp + 0xd50]
xor rcx, rsp
call fcn.180099fe0
lea r11, [rsp + 0xd60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret