Function at 0x14000f9d0
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0x2b8], rax
mov r15, rdx
lea rdx, [rsp + 0x2b0]
call fcn.140039d60
or rcx, 0xffffffffffffffff
xor bpl, bpl
mov rbx, rax
mov qword [rsp + 0x58], rax
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea rcx, [rcx + rcx + 0xa]
call fcn.14004c8b0
mov rdx, rbx
mov rsi, rax
mov qword [rsp + 0x40], rax
sub rax, rbx
nop
nop
movzx ecx, word [rdx]
add rdx, 2
test cx, cx
mov word [rax + rdx - 2], cx
jne 0x14000fa40
xor eax, eax
mov rdi, rsi
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str..]
mov r12, rsi
mov qword [rdi - 2], rax
movzx eax, word [0x140064998]
mov dword [rsp + 0x48], 1
mov word [rdi + 6], ax
nop
lea rdx, [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor r14b, r14b
cmp rax, 0xffffffffffffffff
mov r13, rax
je 0x14000fdc0
nop
lea rsi, [rsp + 0x8c]
lea rdi, [0x140064988]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x14000fd97
lea rsi, [rsp + 0x8c]
lea rdi, [0x140064980]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x14000fd97
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x8c]
mov r14b, 1
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
add rdx, rcx
lea rdi, [rdx + rdx + 0xc]
mov rcx, rdi
call fcn.14004c8b0
test rax, rax
mov rbx, rax
je 0x14000ff22
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.14004c980
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
mov rdx, r12
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 5]
mov rcx, rbx
call fcn.14004c838
mov rcx, rbx
call fcn.140036f80
cmp word [rbx + rax*2 - 2], 0x5c
je 0x14000fb72
xor eax, eax
mov rdi, rbx
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x140063c7c]
mov dword [rdi - 2], eax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x8c]
nop
nop
movzx eax, word [rdx + rcx]
add rcx, 2
test ax, ax
mov word [rdi + rcx - 4], ax
jne 0x14000fb90
test byte [rsp + 0x60], 0x10
je 0x14000fcaa
mov rcx, rbx
call fcn.140006e80
test al, al
jne 0x14000fc93
xor edi, edi
lea rcx, str..WGUARDNT
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rsi, rax
jne 0x14000fc30
mov qword [rsp + 0x30], rdi
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rsi, rax
jne 0x14000fc30
mov rsi, rdi
jmp 0x14000fc67
test rsi, rsi
je 0x14000fc67
cmp rsi, 0xffffffffffffffff
je 0x14000fc67
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x54]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rsi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x14000fe90
test rsi, rsi
je 0x14000fd8f
cmp rsi, 0xffffffffffffffff
je 0x14000fd8f
mov rcx, rsi
jmp 0x14000fd89
lea rcx, str.DeleteDirectory_dir__S_is_already_scheduled_n
mov rdx, rbx
call fcn.1400154e0
mov bpl, 1
jmp 0x14000fd8f
xor esi, esi
lea rcx, str..WGUARDNT
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
jne 0x14000fd1d
mov qword [rsp + 0x30], rsi
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
jne 0x14000fd1d
mov rdi, rsi
jmp 0x14000fd54
test rdi, rdi
je 0x14000fd54
cmp rdi, 0xffffffffffffffff
je 0x14000fd54
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000fd7b
mov rcx, rbx
call fcn.140006e80
test al, al
jne 0x14000fd78
mov rdx, r15
mov rcx, rbx
call fcn.140007ce0
mov bpl, 1
test rdi, rdi
je 0x14000fd8f
cmp rdi, 0xffffffffffffffff
je 0x14000fd8f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.14004ca6c
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000faa0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
test r14b, r14b
mov rsi, qword [rsp + 0x40]
jne 0x14000fdc3
mov bpl, 1
cmp r12, rsi
je 0x14000ffaa
lea rcx, str.DeleteDirectory:_walk_end__rename__u__dir__S_n
movzx edx, bpl
mov r8, r12
call fcn.1400154e0
test bpl, bpl
je 0x14000ff97
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
mov word [r12 + rcx*2 - 0xa], ax
mov rcx, r12
call fcn.140006e80
test al, al
jne 0x14000ff97
mov qword [rsp + 0x30], 0
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
jne 0x14000ff35
mov qword [rsp + 0x30], 0
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
jne 0x14000ff35
xor edi, edi
jmp 0x14000ff78
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
cmp r12, qword [rsp + 0x40]
mov rax, qword [str..]
mov qword [rdi - 2], rax
movzx eax, word [0x140064998]
mov word [rdi + 6], ax
je 0x14000fec1
mov rcx, r12
call fcn.14004ca6c
lea rcx, str.DeleteDirectory_new_walk_dir__S_n
mov rdx, rbx
mov r12, rbx
call fcn.1400154e0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
xor bpl, bpl
test rsi, rsi
je 0x14000fef3
cmp rsi, 0xffffffffffffffff
je 0x14000fef3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x40]
mov edi, dword [rsp + 0x48]
add edi, 1
cmp edi, 0x3e8
mov dword [rsp + 0x48], edi
jne 0x14000fa80
lea rcx, str.Giving_up_on_directory_deletion_after_1000_cycles_n
call fcn.1400154e0
xor al, al
jmp 0x140010094
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rsi, qword [rsp + 0x40]
mov r12, rsi
jmp 0x14000fef8
test rdi, rdi
je 0x14000ff78
cmp rdi, 0xffffffffffffffff
je 0x14000ff78
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x4c]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rdi
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rdx, r15
mov rcx, r12
call fcn.140007ce0
test rdi, rdi
je 0x14000ff97
cmp rdi, 0xffffffffffffffff
je 0x14000ff97
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call fcn.14004ca6c
mov r12, rsi
xor bpl, bpl
jmp 0x14000fef8
mov rcx, rsi
call fcn.14004ca6c
mov qword [rsp + 0x30], 0
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
jne 0x14001002a
mov qword [rsp + 0x30], 0
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
jne 0x14001002a
xor edi, edi
jmp 0x14001006d
test rdi, rdi
je 0x14001006d
cmp rdi, 0xffffffffffffffff
je 0x14001006d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x4c]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rdi
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, qword [rsp + 0x58]
mov rdx, r15
call fcn.140007ce0
test rdi, rdi
movzx esi, al
je 0x140010091
cmp rdi, 0xffffffffffffffff
je 0x140010091
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, sil
mov rcx, qword [rsp + 0x2b8]
xor rcx, rsp
call fcn.14004c890
mov rbx, qword [rsp + 0x310]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret