Function at 0x140035b99
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
test rdx, rdx
je 0x140036133
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x350], rbx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rbx, rcx
mov qword [rsp + 0x60], 7
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov word [rsp + 0x48], r14w
cmp word [rdx], r14w
jne 0x140035bf6
mov r8d, r14d
jmp 0x140035c0a
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], r14w
jne 0x140035c00
lea rcx, [rsp + 0x48]
call fcn.140003a80
nop
cmp qword [rsp + 0x58], 0
je 0x1400360f1
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], r14
mov word [rsp + 0x28], r14w
xor r8d, r8d
lea rdx, [0x140079378]
lea rcx, [rsp + 0x28]
call fcn.140003a80
nop
test rbx, rbx
je 0x140035ceb
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], r14
mov word [rsp + 0x68], r14w
cmp word [rbx], 0
jne 0x140035c71
mov r8, r14
jmp 0x140035c80
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x140035c75
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140003a80
nop
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x140035cab
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.140003ec0
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], r14
mov word [rsp + 0x28], r14w
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.140003d10
nop
mov r8, qword [rbp - 0x80]
cmp r8, 8
jb 0x140035ceb
inc r8
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.140003ec0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140035db3
lea rax, [rsp + 0x28]
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x40]
cmp r8, 8
cmovae rax, rdx
cmp word [rax + rcx*2 - 2], 0x5c
je 0x140035d31
lea rax, [rsp + 0x28]
cmp r8, 8
cmovae rax, rdx
cmp word [rax + rcx*2 - 2], 0x2f
jne 0x140035db3
mov r9, qword [rsp + 0x38]
dec r9
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.14000d690
mov rbx, rax
lea rax, [rsp + 0x28]
cmp rax, rbx
je 0x140035d97
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x140035d75
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.140003ec0
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], r14
mov word [rsp + 0x28], r14w
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140003d10
nop
mov r8, qword [rbp - 0x80]
cmp r8, 8
jb 0x140035db3
inc r8
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.140003ec0
mov r9, qword [rsp + 0x58]
mov r10, r9
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x60]
cmp r8, 8
cmovae rax, rdx
cmp word [rax + r9*2 - 2], 0x5c
je 0x140035df5
lea rax, [rsp + 0x48]
cmp r8, 8
cmovae rax, rdx
cmp word [rax + r9*2 - 2], 0x2f
jne 0x140035e84
dec r9
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.14000d690
mov rbx, rax
lea rax, [rsp + 0x48]
cmp rax, rbx
je 0x140035e56
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x140035e34
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.140003ec0
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r14
mov word [rsp + 0x48], r14w
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140003d10
nop
mov r8, qword [rbp - 0x80]
cmp r8, 8
jb 0x140035e72
inc r8
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.140003ec0
mov r9, qword [rsp + 0x58]
mov r10, r9
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
mov rcx, r14
mov r15d, 0x5c
test r9, r9
je 0x140035ed0
lea rax, [rsp + 0x48]
cmp r8, 8
cmovae rax, rdx
cmp word [rax + rcx*2], 0x2f
jne 0x140035ec2
lea rax, [rsp + 0x48]
cmp r8, 8
cmovae rax, rdx
mov word [rax + rcx*2], r15w
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
inc rcx
cmp rcx, r10
jb 0x140035e92
nop word [rax + rax]
xor sil, sil
mov edx, r15d
or r8, 0xffffffffffffffff
lea rcx, [rsp + 0x48]
call fcn.140039730
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400360c0
cmp rax, qword [rsp + 0x38]
je 0x1400360c0
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.14000d690
nop
lea r8, str..
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x78]
call fcn.14000e2d0
nop
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rcx, qword [rbp - 0x78]
lea rdx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140036078
movzx edx, word [rbp - 0x24]
movzx ecx, word [rbp - 0x22]
cmp dx, word [0x14007bbdc]
jne 0x140035f68
cmp cx, word [0x14007bbde]
je 0x140035f87
cmp dx, word [0x14007bbe0]
jne 0x140035fe2
cmp cx, word [0x14007bbe2]
jne 0x140035fe2
movzx eax, word [rbp - 0x20]
cmp ax, word [0x14007bbe4]
jne 0x140035fe2
mov al, 1
movzx edi, al
nop dword [rax]
test al, al
je 0x140035fe5
lea rdx, [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140035f90
movzx ecx, word [rbp - 0x24]
movzx eax, word [rbp - 0x22]
cmp cx, word [0x14007bbdc]
jne 0x140035fbf
cmp ax, word [0x14007bbde]
je 0x140035fde
cmp cx, word [0x14007bbe0]
jne 0x140035fe2
cmp ax, word [0x14007bbe2]
jne 0x140035fe2
movzx eax, word [rbp - 0x20]
cmp ax, word [0x14007bbe4]
jne 0x140035fe2
mov al, 1
jmp 0x140035f90
xor dil, dil
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
test dil, dil
je 0x140036026
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x140036026
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.140003bd0
mov sil, 1
mov r8, qword [rbp - 0x60]
cmp r8, 8
jb 0x140036040
inc r8
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp - 0x78]
call fcn.140003ec0
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], r14
mov word [rbp - 0x78], r14w
mov r8, qword [rbp - 0x80]
cmp r8, 8
jb 0x14003606d
inc r8
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.140003ec0
test sil, sil
jne 0x140035ed0
jmp 0x1400360c0
mov r8, qword [rbp - 0x60]
cmp r8, 8
jb 0x140036092
inc r8
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp - 0x78]
call fcn.140003ec0
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], r14
mov word [rbp - 0x78], r14w
mov r8, qword [rbp - 0x80]
cmp r8, 8
jb 0x1400360c0
inc r8
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.140003ec0
nop
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x1400360dd
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.140003ec0
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], r14
mov word [rsp + 0x28], r14w
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x14003610e
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.140003ec0
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.14003a3d0
mov rbx, qword [rsp + 0x350]
add rsp, 0x310
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret