Function at 0x140040db0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x4c0
lea rdi, [rsp + 0x20]
mov ecx, pe_nt_image_headers64
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4d0]
mov rax, qword [0x1402558e8]
xor rax, rsp
mov qword [rsp + 0x4b8], rax
mov rcx, qword [rsp + 0x4d0]
call fcn.140009600
mov r9d, 0x661
lea r8, [0x1401c36c0]
lea rdx, [0x1401c3068]
mov rcx, rax
call fcn.14001ae00
mov rcx, qword [rsp + 0x4d0]
call fcn.14001b050
test rax, rax
jne 0x140040e3a
mov qword [rsp + 0x468], 1
jmp 0x140040e46
mov qword [rsp + 0x468], 0
mov r9d, 0x662
lea r8, [0x1401c3720]
lea rdx, str.IsEmptyStr__szOSDirectoryName___FALSE
mov rcx, qword [rsp + 0x468]
call fcn.14001ae00
mov rdx, qword [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call fcn.140008cf0
nop
mov dx, 0x5c
lea rcx, [rsp + 0x2a0]
call fcn.1400533c0
lea r8, [0x1401c3488]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x328]
call fcn.140058fc0
mov qword [rsp + 0x470], rax
mov rax, qword [rsp + 0x470]
mov qword [rsp + 0x478], rax
mov rcx, qword [rsp + 0x478]
call fcn.140052c70
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x308], rax
lea rcx, [rsp + 0x328]
call fcn.140004db0
cmp qword [rsp + 0x308], 0xffffffffffffffff
je 0x140041113
cmp dword [rsp + 0x4d8], 2
jne 0x140040f18
mov dword [rsp + 0x480], 0
jmp 0x140040f26
mov eax, dword [rsp + 0x4d8]
mov dword [rsp + 0x480], eax
mov eax, dword [rsp + 0x480]
mov dword [rsp + 0x310], eax
lea rcx, [rsp + 0x5c]
call fcn.140038e90
test rax, rax
jne 0x1400410ea
mov eax, dword [rsp + 0x30]
and eax, 0x10
test eax, eax
je 0x14004102a
lea r8, [rsp + 0x5c]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x388]
call fcn.140058fc0
mov qword [rsp + 0x488], rax
mov rax, qword [rsp + 0x488]
mov qword [rsp + 0x490], rax
mov rcx, qword [rsp + 0x490]
call fcn.140052c70
mov r8, qword [rsp + 0x4e0]
mov edx, dword [rsp + 0x310]
mov rcx, rax
call fcn.140040db0
test rax, rax
jne 0x140040fbe
mov dword [rsp + 0x498], 1
jmp 0x140040fc9
mov dword [rsp + 0x498], 0
movzx eax, byte [rsp + 0x498]
mov byte [rsp + 0x380], al
lea rcx, [rsp + 0x388]
call fcn.140004db0
movzx eax, byte [rsp + 0x380]
test eax, eax
je 0x140041025
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x3e0], 0
lea rcx, [rsp + 0x2a0]
call fcn.140004db0
mov rax, qword [rsp + 0x3e0]
jmp 0x1400411cc
jmp 0x1400410ea
lea r8, [rsp + 0x5c]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x3f0]
call fcn.140058fc0
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0x4a8], rax
mov rcx, qword [rsp + 0x4a8]
call fcn.140052c70
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140041083
mov dword [rsp + 0x4b0], 1
jmp 0x14004108e
mov dword [rsp + 0x4b0], 0
movzx eax, byte [rsp + 0x4b0]
mov byte [rsp + 0x3e8], al
lea rcx, [rsp + 0x3f0]
call fcn.140004db0
movzx eax, byte [rsp + 0x3e8]
test eax, eax
je 0x1400410ea
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x448], 0
lea rcx, [rsp + 0x2a0]
call fcn.140004db0
mov rax, qword [rsp + 0x448]
jmp 0x1400411cc
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140040f34
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rsp + 0x4d8], 0
je 0x140041143
mov qword [rsp + 0x450], 1
lea rcx, [rsp + 0x2a0]
call fcn.140004db0
mov rax, qword [rsp + 0x450]
jmp 0x1400411cc
cmp qword [rsp + 0x4e0], 0
je 0x14004117f
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov qword [rsp + 0x458], 1
lea rcx, [rsp + 0x2a0]
call fcn.140004db0
mov rax, qword [rsp + 0x458]
jmp 0x1400411cc
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cdqe
mov qword [rsp + 0x318], rax
cmp qword [rsp + 0x318], 0
jne 0x1400411a7
call fcn.14003dd70
mov rax, qword [rsp + 0x318]
mov qword [rsp + 0x460], rax
lea rcx, [rsp + 0x2a0]
call fcn.140004db0
mov rax, qword [rsp + 0x460]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.1400c02e0
mov rax, rdi
mov rcx, qword [rsp + 0x4b8]
xor rcx, rsp
call fcn.1400c05d0
add rsp, 0x4c0
pop rdi
ret