Function at 0x100012c6c
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push r13
push r14
push r15
sub rsp, 0xb80
mov rax, qword [0x100019110]
xor rax, rsp
mov qword [rsp + 0xb70], rax
mov rsi, rcx
xor ebx, ebx
mov edi, ebx
or qword [rsp + 0x48], 0xffffffffffffffff
mov r15, rbx
mov qword [r11 - 0xb18], rbx
mov r13d, ebx
mov dword [rsp + 0x34], ebx
mov r12, rbx
mov qword [rsp + 0x38], rbx
mov r8d, 0x7ffffffe
mov qword [rsp + 0xb8], r8
mov r9, rcx
mov qword [rsp + 0x88], rcx
mov r14d, 0x104
mov rdx, r14
mov qword [rsp + 0xa0], rdx
lea rax, [r11 - 0x658]
mov qword [rsp + 0x50], rax
mov r11d, ebx
mov rcx, rbx
mov qword [rsp + 0x78], rbx
cmp rdx, rbx
je 0x100012d52
cmp r8, rbx
je 0x100012d52
movzx r10d, word [r9]
cmp r10w, bx
je 0x100012d52
mov word [rax], r10w
add rax, 2
mov qword [rsp + 0x50], rax
add r9, 2
mov qword [rsp + 0x88], r9
dec rdx
mov qword [rsp + 0xa0], rdx
dec r8
mov qword [rsp + 0xb8], r8
inc rcx
mov qword [rsp + 0x78], rcx
jmp 0x100012d05
cmp rdx, rbx
jne 0x100012d6e
sub rax, 2
mov qword [rsp + 0x50], rax
dec rcx
mov qword [rsp + 0x78], rcx
mov r11d, 0x8007007a
mov word [rax], bx
cmp r11d, ebx
jl 0x100013220
lea rcx, [rsp + 0x540]
call fcn.10000fc40
mov r8, rax
lea rax, [rsp + 0x540]
cmp r8, rax
je 0x100013220
cmp word [r8 - 2], 0x5c
je 0x100012daf
cmp word [r8 - 2], 0x2f
jne 0x100013220
lea rdx, [rsp + 0x540]
lea rax, [r8 - 2]
sub rax, rdx
and rax, 0xfffffffffffffffe
cmp rax, 4
jne 0x100012de3
cmp word [rsp + 0x540], bx
je 0x100012de3
cmp word [rsp + 0x542], 0x3a
jne 0x100012de3
mov word [r8], bx
jmp 0x100012de8
mov word [r8 - 2], bx
mov r8d, 0x7ffffffe
mov qword [rsp + 0xc8], r8
mov qword [rsp + 0xb0], rsi
mov rdx, r14
mov qword [rsp + 0xd0], rdx
lea rax, [rsp + 0x750]
mov qword [rsp + 0x68], rax
mov r10d, ebx
mov rcx, rbx
mov qword [rsp + 0x58], rbx
cmp rdx, rbx
je 0x100012e6e
cmp r8, rbx
je 0x100012e6e
movzx r9d, word [rsi]
cmp r9w, bx
je 0x100012e6e
mov word [rax], r9w
add rax, 2
mov qword [rsp + 0x68], rax
add rsi, 2
mov qword [rsp + 0xb0], rsi
dec rdx
mov qword [rsp + 0xd0], rdx
dec r8
mov qword [rsp + 0xc8], r8
inc rcx
mov qword [rsp + 0x58], rcx
jmp 0x100012e21
cmp rdx, rbx
jne 0x100012e8a
sub rax, 2
mov qword [rsp + 0x68], rax
dec rcx
mov qword [rsp + 0x58], rcx
mov r10d, 0x8007007a
mov word [rax], bx
cmp r10d, ebx
jge 0x100012ea0
mov edi, 0xd
mov dword [rsp + 0x30], edi
jmp 0x100013229
mov edx, 0x2e
lea rcx, [rsp + 0x750]
call sub.msvcrt.dll_wcsrchr
cmp rax, rbx
je 0x100013215
mov word [rax], bx
add rax, 2
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x750]
lea r8, [0x100004d40]
mov rdx, r14
lea rcx, [rsp + 0x960]
call fcn.100006c78
cmp eax, ebx
jge 0x100012ef8
mov edi, 0xd
mov dword [rsp + 0x30], edi
jmp 0x100013229
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x960]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x100012f24
mov edi, ebx
mov dword [rsp + 0x30], ebx
jmp 0x100013229
mov esi, 0x40
mov r8, rsi
xor edx, edx
mov rcx, qword [0x100019848]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
mov qword [rsp + 0x80], rax
cmp rax, rbx
jne 0x100012f57
lea edi, [rsi - 0x38]
mov dword [rsp + 0x30], edi
jmp 0x100013229
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov r8d, 0x7ffffffe
mov qword [rsp + 0xa8], r8
lea r9, [rsp + 0x540]
mov qword [rsp + 0x90], r9
mov edx, 0x104
mov qword [rsp + 0x98], rdx
lea rax, [rsp + 0x330]
mov qword [rsp + 0x60], rax
mov r11d, ebx
mov rcx, rbx
mov qword [rsp + 0x70], rbx
cmp rdx, rbx
je 0x100012ff4
cmp r8, rbx
je 0x100012ff4
movzx r10d, word [r9]
cmp r10w, bx
je 0x100012ff4
mov word [rax], r10w
add rax, 2
mov qword [rsp + 0x60], rax
add r9, 2
mov qword [rsp + 0x90], r9
dec rdx
mov qword [rsp + 0x98], rdx
dec r8
mov qword [rsp + 0xa8], r8
inc rcx
mov qword [rsp + 0x70], rcx
jmp 0x100012fa7
cmp rdx, rbx
jne 0x100013010
sub rax, 2
mov qword [rsp + 0x60], rax
dec rcx
mov qword [rsp + 0x70], rcx
mov r11d, 0x8007007a
mov word [rax], bx
cmp r11d, ebx
jl 0x10001320a
xor r9d, r9d
mov r8d, 0x104
lea rdx, [rsp + 0x10c]
lea rcx, [rsp + 0x330]
call fcn.10000fb50
cmp eax, ebx
je 0x10001320a
lea rcx, [rsp + 0x330]
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_lstrlenW]
lea r14d, [rax + 1]
mov dword [rsp + 0x28], r14d
lea rax, [rsp + 0x330]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea r8, [rsp + 0x330]
mov edx, 0x100
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_LCMapStringW]
mov r12, rbx
mov qword [rsp + 0x38], rbx
mov esi, ebx
mov dword [rsp + 0x40], ebx
cmp esi, r13d
jae 0x100013113
mov eax, esi
lea r13, [r15 + rax*8]
lea rdx, [rsp + 0x330]
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, ebx
jge 0x100013103
mov eax, dword [rsp + 0x34]
cmp eax, 8
jae 0x1000130d3
sub eax, esi
mov r8d, eax
shl r8, 3
lea eax, [rsi + 1]
lea rcx, [r15 + rax*8]
mov rdx, r13
call sub.msvcrt.dll_memmove
jmp 0x1000130f8
mov r12, qword [r15 + 0x38]
mov qword [rsp + 0x38], r12
mov r8d, 7
sub r8d, esi
shl r8, 3
lea eax, [rsi + 1]
lea rcx, [r15 + rax*8]
mov rdx, r13
call sub.msvcrt.dll_memmove
mov qword [r13], rbx
mov r13d, dword [rsp + 0x34]
jmp 0x100013113
inc esi
mov dword [rsp + 0x40], esi
mov r13d, dword [rsp + 0x34]
jmp 0x10001308f
cmp esi, r13d
ja 0x100013186
cmp esi, 8
jae 0x100013186
lea r8d, [r14 + r14]
xor edx, edx
mov rcx, qword [0x100019848]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, rax
mov eax, esi
mov qword [r15 + rax*8], rcx
cmp rcx, rbx
jne 0x10001314c
mov edi, 8
mov dword [rsp + 0x30], edi
jmp 0x100013229
mov edx, r14d
lea r8, [rsp + 0x330]
call fcn.10000631c
cmp eax, ebx
jge 0x10001316e
mov edi, 0xd
mov dword [rsp + 0x30], edi
jmp 0x100013229
cmp r13d, 8
jae 0x100013193
inc r13d
mov dword [rsp + 0x34], r13d
mov dword [rsp + 0xc0], r13d
jmp 0x100013193
lea r12, [rsp + 0x330]
mov qword [rsp + 0x38], r12
cmp r12, rbx
je 0x1000131ed
lea rax, [rsp + 0x330]
cmp r12, rax
jne 0x1000131af
test byte [rsp + 0xe0], 1
je 0x1000131bd
mov edx, 0x80
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r11, [rsp + 0x330]
cmp r12, r11
je 0x1000131ed
mov r8, r12
xor edx, edx
mov rcx, qword [0x100019848]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, rbx
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0xe0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, ebx
jne 0x100012f64
jmp 0x100013229
mov edi, 0xd
mov dword [rsp + 0x30], edi
jmp 0x100013229
mov edi, 0xd
mov dword [rsp + 0x30], edi
jmp 0x100013229
mov edi, 0x57
mov dword [rsp + 0x30], edi
jmp 0x100013243
cmp r15, rbx
je 0x100013284
mov rsi, r15
mov r13d, 8
cmp qword [rsi], rbx
je 0x100013268
mov r8, qword [rsi]
xor edx, edx
mov rcx, qword [0x100019848]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsi, 8
sub r13, 1
jne 0x100013251
mov r8, r15
xor edx, edx
mov rcx, qword [0x100019848]
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r12, rbx
je 0x1000132a8
lea rax, [rsp + 0x330]
cmp r12, rax
je 0x1000132a8
mov r8, r12
xor edx, edx
mov rcx, qword [0x100019848]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x48]
cmp rax, 0xffffffffffffffff
je 0x1000132bc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, edi
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
cmp edi, ebx
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0xb70]
xor rcx, rsp
call fcn.100014800
lea r11, [rsp + 0xb80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret