Function at 0x18001b420
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push r13
push r14
push r15
sub rsp, 0xb10
mov rax, qword [0x1800240b0]
xor rax, rsp
mov qword [rsp + 0xb00], rax
mov r14, rcx
xor edi, edi
mov ebx, edi
or r13, 0xffffffffffffffff
mov qword [rsp + 0x50], r13
mov r15d, edi
mov qword [rsp + 0x58], rdi
mov r12d, edi
mov esi, edi
mov qword [rsp + 0x38], rdi
mov r8, rcx
mov edx, 0x104
lea rcx, [r11 - 0x448]
call fcn.1800035e0
test eax, eax
js 0x18001b732
lea rcx, [rsp + 0x6e0]
call fcn.18001a6d0
test eax, eax
je 0x18001b732
mov r8, r14
mov r14d, 0x104
mov edx, r14d
lea rcx, [rsp + 0x4d0]
call fcn.1800035e0
test eax, eax
jns 0x18001b4cc
mov ebx, 0xd
jmp 0x18001b737
mov edx, 0x2e
lea rcx, [rsp + 0x4d0]
call sub.msvcrt.dll_wcsrchr
test rax, rax
je 0x18001b4c2
mov word [rax], di
add rax, 2
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4d0]
lea r8, [0x18001b7f0]
mov rdx, r14
lea rcx, [rsp + 0x8f0]
call fcn.18000df90
test eax, eax
js 0x18001b4c2
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x8f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r13, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
jne 0x18001b53a
mov ebx, edi
jmp 0x18001b737
mov r14d, 0x40
mov ecx, r14d
call fcn.18001f4a0
mov r15, rax
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x18001b55f
mov ebx, 8
jmp 0x18001b737
mov r8, r14
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x6e0]
mov r14d, 0x104
mov edx, r14d
lea rcx, [rsp + 0x2c0]
call fcn.1800035e0
test eax, eax
js 0x18001b4c2
mov r8d, r14d
lea rdx, [rsp + 0x9c]
lea rcx, [rsp + 0x2c0]
call fcn.18001a2a4
test eax, eax
je 0x18001b4c2
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x2c0]
mov qword [rsp + 0x20], rcx
mov r9d, eax
lea r8, [rsp + 0x2c0]
lea edx, [r14 - 4]
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_LCMapStringW]
mov rsi, rdi
mov qword [rsp + 0x38], rdi
mov r14d, edi
mov dword [rsp + 0x40], edi
cmp r14d, r12d
jae 0x18001b671
mov eax, r14d
lea rax, [r15 + rax*8]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x2c0]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jns 0x18001b664
lea eax, [r14 + 1]
mov rdx, qword [rsp + 0x48]
lea rcx, [r15 + rax*8]
cmp r12d, 8
jae 0x18001b63e
mov r8d, r12d
jmp 0x18001b64d
mov rsi, qword [r15 + 0x38]
mov qword [rsp + 0x38], rsi
mov r8d, 7
sub r8d, r14d
shl r8, 3
call qword [sym.imp.msvcrt.dll_memmove]
mov rax, qword [rsp + 0x48]
mov qword [rax], rdi
jmp 0x18001b66e
inc r14d
mov dword [rsp + 0x40], r14d
jmp 0x18001b600
cmp r14d, r12d
ja 0x18001b6c0
cmp r14d, 8
jae 0x18001b6c0
mov ecx, dword [rsp + 0x34]
add ecx, ecx
call fcn.18001f4a0
mov rcx, rax
mov eax, r14d
mov qword [r15 + rax*8], rcx
test rcx, rcx
je 0x18001b555
mov edx, dword [rsp + 0x34]
lea r8, [rsp + 0x2c0]
call fcn.1800035e0
test eax, eax
js 0x18001b4c2
cmp r12d, 8
jae 0x18001b6cd
inc r12d
mov dword [rsp + 0x60], r12d
jmp 0x18001b6cd
lea rsi, [rsp + 0x2c0]
mov qword [rsp + 0x38], rsi
test rsi, rsi
je 0x18001b71a
lea rax, [rsp + 0x2c0]
cmp rsi, rax
jne 0x18001b6e6
test byte [rsp + 0x70], 1
je 0x18001b6f4
mov edx, 0x80
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, [rsp + 0x2c0]
cmp rsi, rax
je 0x18001b71a
mov rcx, rsi
call fcn.18001f484
mov rsi, rdi
mov qword [rsp + 0x38], rdi
lea rdx, [rsp + 0x70]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18001b56c
jmp 0x18001b73b
mov ebx, 0x57
mov dword [rsp + 0x30], ebx
jmp 0x18001b757
test r15, r15
je 0x18001b783
mov r14d, edi
cmp r14d, 8
jae 0x18001b77b
mov eax, r14d
mov rcx, qword [r15 + rax*8]
test rcx, rcx
je 0x18001b776
call fcn.18001f484
inc r14d
jmp 0x18001b75f
mov rcx, r15
call fcn.18001f484
test rsi, rsi
je 0x18001b79d
lea rax, [rsp + 0x2c0]
cmp rsi, rax
je 0x18001b79d
mov rcx, rsi
call fcn.18001f484
cmp r13, 0xffffffffffffffff
je 0x18001b7ac
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
sete dil
mov eax, edi
mov rcx, qword [rsp + 0xb00]
xor rcx, rsp
call fcn.180001ac0
lea r11, [rsp + 0xb10]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret