Function at 0x140085ec0
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Get common file path
Get file attributes
Hash data with md5
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa90]
sub rsp, 0xb90
mov r13, rcx
lea rax, [rbp - 8]
mov qword [rbp - 0x18], rax
xor r14d, r14d
mov dword [rbp - 0x10], r14d
mov dword [rbp - 0xc], 0x104
mov word [rbp - 8], r14w
lea rcx, [0x1401b7690]
mov qword [rbp - 0x20], rcx
lea rax, [rbp + 0x218]
mov qword [rbp + 0x208], rax
mov dword [rbp + 0x210], r14d
mov dword [rbp + 0x214], 0x104
mov word [rbp + 0x218], r14w
mov qword [rbp + 0x200], rcx
lea rdi, [rsp + 0x48]
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosd dword [rdi], eax
lea rdi, [rbp - 0x78]
mov ecx, 4
rep stosd dword [rdi], eax
mov byte [rbp - 0x68], al
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r14 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140085fb0
mov edx, dword [rbp - 0xc]
call fcn.14003c814
mov dword [rbp - 0x10], eax
jmp 0x140085fb4
mov dword [rbp - 0x10], r14d
mov r9, qword [rbp + 0x208]
test r9, r9
je 0x14008603a
mov edx, dword [0x1401f33b0]
mov eax, dword [rbp + 0x214]
cmp edx, eax
jb 0x140085fd3
lea edx, [rax - 1]
mov r10, qword [0x1401f33a8]
lea eax, [rdx + rdx]
mov r8d, eax
mov ecx, eax
shr rcx, 2
mov rdi, r9
mov rsi, r10
rep movsd dword [rdi], dword [rsi]
mov ecx, eax
and ecx, 3
je 0x140086003
and r8, 0xfffffffffffffffc
lea rsi, [r8 + r10]
lea rdi, [r8 + r9]
rep movsb byte [rdi], byte [rsi]
mov dword [rbp + 0x210], edx
mov ecx, edx
mov rax, qword [rbp + 0x208]
mov word [rax + rcx*2], r14w
mov r9, qword [rbp + 0x208]
test r9, r9
je 0x14008603a
mov edx, dword [rbp + 0x210]
inc edx
mov rcx, r9
call fcn.140041c70
mov r9, qword [rbp + 0x208]
mov byte [rbp - 0x68], 0
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
mov eax, dword [rbp + 0x210]
lea r8d, [rax + rax]
mov rdx, r9
lea rcx, [rsp + 0x30]
call fcn.140072a10
movzx r8d, byte [rbp - 0x68]
test r8b, r8b
jne 0x1400862be
lea rdi, [rbp + 0xac0]
lea rsi, [rsp + 0x40]
mov ecx, 2
rep movsd dword [rdi], dword [rsi]
mov edx, dword [rsp + 0x40]
mov ecx, edx
shr ecx, 3
and ecx, 0x3f
mov eax, 0x78
sub eax, ecx
mov r15d, 0x38
sub r15d, ecx
cmp ecx, 0x38
cmovae r15d, eax
mov ebx, 0x40
cmp r15d, 1
jb 0x1400861ba
lea eax, [r15*8]
add edx, eax
mov dword [rsp + 0x40], edx
cmp edx, eax
mov edx, dword [rsp + 0x44]
jae 0x1400860e5
inc edx
mov eax, r15d
shr eax, 0x1d
add edx, eax
mov dword [rsp + 0x44], edx
mov r14d, ebx
sub r14d, ecx
lea r12, [0x1401f2e70]
cmp r15d, r14d
jb 0x140086170
mov edx, r14d
mov eax, ecx
lea r8, [rsp + 0x48]
add r8, rax
mov ecx, r14d
shr rcx, 2
mov rsi, r12
mov rdi, r8
rep movsd dword [rdi], dword [rsi]
mov ecx, r14d
and ecx, 3
je 0x140086135
and rdx, 0xfffffffffffffffc
lea rsi, [rdx + r12]
lea rdi, [rdx + r8]
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.140071d80
lea eax, [r14 + 0x3f]
cmp eax, r15d
jae 0x14008616c
nop dword [rax]
mov edx, r14d
add rdx, r12
lea rcx, [rsp + 0x30]
call fcn.140071d80
add r14d, ebx
lea eax, [r14 + 0x3f]
cmp eax, r15d
jb 0x140086150
xor ecx, ecx
jmp 0x140086173
xor r14d, r14d
sub r15d, r14d
mov edx, r15d
mov r8d, r14d
add r8, r12
mov eax, ecx
lea r9, [rsp + 0x48]
add r9, rax
mov ecx, r15d
shr rcx, 2
mov rdi, r9
mov rsi, r8
rep movsd dword [rdi], dword [rsi]
mov ecx, r15d
and ecx, 3
je 0x1400861ae
and rdx, 0xfffffffffffffffc
lea rsi, [rdx + r8]
lea rdi, [rdx + r9]
rep movsb byte [rdi], byte [rsi]
xor r14d, r14d
mov edx, dword [rsp + 0x40]
movzx r8d, byte [rbp - 0x68]
test r8b, r8b
jne 0x140086299
mov ecx, edx
shr ecx, 3
and ecx, 0x3f
add edx, ebx
mov dword [rsp + 0x40], edx
cmp edx, ebx
jae 0x1400861d9
inc dword [rsp + 0x44]
sub ebx, ecx
cmp ebx, 8
ja 0x140086256
mov edx, ebx
mov eax, ecx
lea r8, [rsp + 0x48]
add r8, rax
mov ecx, ebx
shr rcx, 2
lea rsi, [rbp + 0xac0]
mov rdi, r8
rep movsd dword [rdi], dword [rsi]
mov ecx, ebx
and ecx, 3
je 0x140086219
and rdx, 0xfffffffffffffffc
lea rsi, [rbp + 0xac0]
add rsi, rdx
lea rdi, [rdx + r8]
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.140071d80
lea eax, [rbx + 0x3f]
cmp eax, 8
jae 0x140086251
mov eax, ebx
lea rdx, [rbp + 0xac0]
add rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140071d80
add ebx, 0x40
lea eax, [rbx + 0x3f]
cmp eax, 8
jb 0x140086230
mov ecx, r14d
jmp 0x140086259
mov ebx, r14d
mov edx, 8
sub edx, ebx
mov eax, ebx
lea r8, [rbp + 0xac0]
add r8, rax
mov eax, ecx
lea r9, [rsp + 0x48]
add r9, rax
mov ecx, edx
shr rcx, 2
mov rdi, r9
mov rsi, r8
rep movsd dword [rdi], dword [rsi]
mov ecx, edx
and ecx, 3
je 0x140086299
and rdx, 0xfffffffffffffffc
lea rsi, [rdx + r8]
lea rdi, [rdx + r9]
rep movsb byte [rdi], byte [rsi]
lea rdi, [rbp - 0x78]
lea rsi, [rsp + 0x30]
mov ecx, 4
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x48]
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosd dword [rdi], eax
mov r8b, 1
mov byte [rbp - 0x68], r8b
mov r12d, dword [rbp + 0x214]
mov r15, qword [rbp + 0x208]
mov rbx, 0xffffffffffffffff
test r15, r15
je 0x14008632c
test r8b, r8b
je 0x140086328
cmp r12d, 0x21
jb 0x140086328
mov esi, r14d
lea r14, [rbp - 0x78]
nop word [rax + rax]
lea ecx, [rsi + rsi]
movzx edi, byte [r14]
mov edx, r12d
sub edx, ecx
lea rcx, [r15 + rcx*2]
mov dword [rsp + 0x20], edi
lea r9, str._02X
mov r8, rbx
call fcn.140003dd0
inc esi
lea r14, [r14 + 1]
cmp esi, 0x10
jb 0x1400862f0
xor r14d, r14d
mov word [r15 + 0x40], r14w
jmp 0x14008632c
mov word [r15], r14w
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140086366
mov edx, dword [rbp - 0x10]
lea eax, [rdx + 0xc]
cmp eax, dword [rbp - 0xc]
jae 0x140086366
lea rdi, [rcx + rdx*2]
lea rsi, str.MetaQuotes_
mov ecx, 6
rep movsd dword [rdi], dword [rsi]
mov eax, dword [rbp - 0x10]
add eax, 0xc
mov dword [rbp - 0x10], eax
mov ecx, eax
mov rax, qword [rbp - 0x18]
mov word [rax + rcx*2], r14w
mov rcx, qword [r13 + 0xa8]
add rcx, 0xa64
lea rdx, str.terminal
call fcn.14003e940
mov rcx, qword [r13 + 0xa8]
test eax, eax
jne 0x14008640d
lea r9, [rcx + 0xa64]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400864d9
test r9, r9
je 0x1400864d9
mov r8, rbx
nop
inc r8
cmp word [r9 + r8*2], 0
jne 0x1400863b0
test r8d, r8d
je 0x1400864d9
mov edx, dword [rbp - 0x10]
lea eax, [rdx + r8]
cmp eax, dword [rbp - 0xc]
jae 0x1400864dc
lea eax, [r8 + r8]
mov r10d, eax
lea rdx, [rcx + rdx*2]
mov ecx, eax
shr rcx, 2
mov rdi, rdx
mov rsi, r9
rep movsd dword [rdi], dword [rsi]
mov ecx, eax
and ecx, 3
je 0x140086402
and r10, 0xfffffffffffffffc
lea rsi, [r10 + r9]
lea rdi, [r10 + rdx]
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rbp - 0x10]
add eax, r8d
jmp 0x1400864c7
mov eax, dword [rcx + 0x858]
cmp eax, 1
jne 0x14008644e
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400864d9
mov edx, dword [rbp - 0x10]
lea eax, [rdx + 0x1a]
cmp eax, dword [rbp - 0xc]
jae 0x1400864dc
lea rsi, str.MetaTrader_5_Administrator
lea rdi, [rcx + rdx*2]
mov ecx, recv
rep movsd dword [rdi], dword [rsi]
mov eax, dword [rbp - 0x10]
add eax, 0x1a
jmp 0x1400864c7
cmp eax, 9
jne 0x140086470
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400864d9
mov edx, dword [rbp - 0x10]
lea eax, [rdx + 0x1a]
cmp eax, dword [rbp - 0xc]
jae 0x1400864dc
lea rsi, str.MetaTrader_4_Administrator
jmp 0x14008643b
cmp eax, 2
jne 0x140086492
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400864d9
mov edx, dword [rbp - 0x10]
lea eax, [rdx + 0x14]
cmp eax, dword [rbp - 0xc]
jae 0x1400864dc
lea rsi, str.MetaTrader_5_Manager
jmp 0x1400864b6
cmp eax, 0xa
jne 0x140086870
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400864d9
mov edx, dword [rbp - 0x10]
lea eax, [rdx + 0x14]
cmp eax, dword [rbp - 0xc]
jae 0x1400864dc
lea rsi, str.MetaTrader_4_Manager
lea rdi, [rcx + rdx*2]
mov ecx, 0xa
rep movsd dword [rdi], dword [rsi]
mov eax, dword [rbp - 0x10]
add eax, 0x14
mov dword [rbp - 0x10], eax
mov ecx, eax
mov rax, qword [rbp - 0x18]
mov word [rax + rcx*2], r14w
mov rcx, qword [rbp - 0x18]
mov edx, dword [rbp - 0x10]
test rcx, rcx
je 0x140086528
lea eax, [rdx + 1]
cmp eax, dword [rbp - 0xc]
jae 0x140086528
mov eax, edx
lea rdx, [rcx + rax*2]
lea rsi, [0x1401b7674]
mov rdi, rdx
xor ecx, ecx
rep movsd dword [rdi], dword [rsi]
lea rsi, [0x1401b7674]
mov rdi, rdx
mov ecx, 2
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rbp - 0x10]
inc eax
mov dword [rbp - 0x10], eax
mov ecx, eax
mov rax, qword [rbp - 0x18]
mov word [rax + rcx*2], r14w
mov edx, dword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
mov r8, qword [rbp + 0x208]
test rcx, rcx
je 0x14008659d
test r8, r8
je 0x14008659d
nop dword [rax]
inc rbx
cmp word [r8 + rbx*2], 0
jne 0x140086540
test ebx, ebx
je 0x14008659d
lea eax, [rdx + rbx]
cmp eax, dword [rbp - 0xc]
jae 0x14008659d
lea r9d, [rbx + rbx]
mov eax, edx
lea rdx, [rcx + rax*2]
mov ecx, r9d
shr rcx, 2
mov rdi, rdx
mov rsi, r8
rep movsd dword [rdi], dword [rsi]
mov ecx, r9d
and ecx, 3
je 0x140086586
and r9, 0xfffffffffffffffc
lea rsi, [r9 + r8]
lea rdi, [r9 + rdx]
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rbp - 0x10]
add eax, ebx
mov dword [rbp - 0x10], eax
mov ecx, eax
mov rax, qword [rbp - 0x18]
mov word [rax + rcx*2], r14w
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140086870
lea rax, [0x1401b7738]
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x50], r14d
mov dword [rbp - 0x4c], reloc.WS2_32.dll_recv
mov word [rbp - 0x48], r14w
mov edx, reloc.WS2_32.dll_recv
lea rbx, [0x1401c71d8]
mov rcx, rbx
call fcn.14003c814
mov r8, rax
mov eax, dword [rbp - 0x4c]
cmp r8d, eax
jb 0x1400865f2
lea r8d, [rax - 1]
lea edx, [r8 + r8]
mov rax, qword [rbp - 0x58]
mov ecx, edx
shr rcx, 2
mov rsi, rbx
mov rdi, rax
rep movsd dword [rdi], dword [rsi]
mov ecx, edx
and ecx, 3
je 0x14008661d
and rdx, 0xfffffffffffffffc
lea rsi, [rdx + rbx]
lea rdi, [rdx + rax]
rep movsb byte [rdi], byte [rsi]
mov dword [rbp - 0x50], r8d
mov ecx, r8d
mov rax, qword [rbp - 0x58]
mov word [rax + rcx*2], r14w
lea rax, [0x1401c4660]
mov qword [rbp - 0x60], rax
lea rax, [rbp + 0x438]
mov qword [rbp + 0x428], rax
mov dword [rbp + 0x430], r14d
mov dword [rbp + 0x434], 0x200
mov word [rbp + 0x438], r14w
lea rax, [0x1401b8178]
mov qword [rbp + 0x420], rax
mov dil, 1
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0x10]
cmp eax, 1
jb 0x14008683b
test rcx, rcx
je 0x14008683b
cmp word [rcx], 0
je 0x14008683b
cmp eax, 3
jbe 0x14008683b
mov r9, qword [rbp - 0x58]
mov r8, rcx
lea rdx, [0x1401c0df0]
lea rcx, [rbp + 0x420]
call fcn.1400038c0
lea rdx, [rbp + 0x840]
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140086835
nop word [rax + rax]
test byte [rbp + 0x840], 0x10
je 0x1400867a8
movzx edx, word [rbp + 0x86c]
movzx ecx, word [rbp + 0x86e]
cmp dx, 0x2e
jne 0x140086722
test cx, cx
je 0x140086813
cmp dx, dx
jne 0x140086722
cmp cx, dx
jne 0x140086722
cmp word [rbp + 0x870], 0
je 0x140086813
lea r9, [rbp + 0x86c]
mov r8, qword [rbp - 0x18]
lea rdx, [0x1401c0df0]
lea rcx, [rbp + 0x420]
call fcn.1400038c0
mov r8d, 1
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x420]
call fcn.14001ebe0
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140086813
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140086810
lea edx, [rax + 0x7b]
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edx, r14d
test eax, eax
movzx ecx, dil
cmovne edx, ecx
movzx edi, dl
jmp 0x140086813
lea r9, [rbp + 0x86c]
mov r8, qword [rbp - 0x18]
lea rdx, [0x1401c0df0]
lea rcx, [rbp + 0x420]
call fcn.1400038c0
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140086813
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140086810
lea edx, [rax + 0x7b]
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, r14d
test eax, eax
movzx ecx, dil
cmovne edx, ecx
movzx edi, dl
jmp 0x140086813
xor dil, dil
lea rdx, [rbp + 0x840]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400866e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rcx, qword [rbp - 0x18]
jmp 0x14008683e
xor dil, dil
test dil, dil
je 0x140086870
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140086870
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140086870
lea edx, [rax + 0x7b]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop
lea rdi, [rbp - 0x78]
xor eax, eax
mov ecx, 4
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x30]
mov ecx, 4
rep stosd dword [rdi], eax
lea r11, [rsp + 0xb90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret