Function at 0x1401474b0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push rbp
push r13
lea rbp, [rsp - 0x7c8]
sub rsp, 0x8c8
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rbp + 0x7a0], rax
mov r13, rcx
mov edx, 0x104
lea rcx, [rbp + 0x380]
call fcn.140195db0
test al, al
je 0x1401479d1
mov qword [rsp + 0x8e8], rbx
lea rax, [rbp + 0x380]
mov qword [rsp + 0x8c0], r12
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x8b8], r14
mov qword [rsp + 0x8b0], r15
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140147520
lea rax, [rcx + 1]
xor r12d, r12d
cmp rax, 0x104
jae 0x140147585
lea rax, [rcx + 0xe]
mov edx, 0x104
lea r8, [0x14020c310]
cmp rax, rdx
ja 0x14014755d
lea rcx, [rbp + 0x380]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
jmp 0x140147585
lfence
lea rax, [rbp + 0x380]
sub rdx, rcx
mov r9d, 0x103
sub r9, rcx
lea rcx, [rax + rcx*2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov word [rbp + 0x586], r12w
lea rcx, [rbp + 0x380]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140147593
mov edx, 0x104
lea r8, [rbp + 0x380]
lea rcx, [rbp + 0x590]
cmp rax, rdx
jae 0x1401475bd
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
jmp 0x1401475d1
mov r9d, 0x103
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov word [rbp + 0x796], r12w
lea rax, [rbp + 0x590]
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x1401475e0
lea rax, [rcx + 1]
cmp rax, 0x104
jae 0x140147642
lea rax, [rcx + 6]
mov edx, 0x104
lea r8, str..zip
cmp rax, rdx
ja 0x14014761a
lea rcx, [rbp + 0x590]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
jmp 0x140147642
lfence
lea rax, [rbp + 0x590]
sub rdx, rcx
mov r9d, 0x103
sub r9, rcx
lea rcx, [rax + rcx*2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov word [rbp + 0x796], r12w
mov ecx, 4
call fcn.1401adb30
mov r14, rax
test rax, rax
je 0x14014765c
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x14014765f
mov r14, r12
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140147942
mov qword [rsp + 0x8f0], rsi
mov rsi, qword [rbp + 0x808]
mov qword [rsp + 0x8f8], rdi
nop word [rax + rax]
lea rax, [rbp + 0x380]
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x1401476b0
mov edx, 0x104
lea r8, [rbp + 0x380]
cmp rcx, rdx
lea rcx, [rbp + 0x170]
jae 0x1401476da
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
jmp 0x1401476ee
mov r9d, 0x103
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov word [rbp + 0x376], r12w
lea rax, [rbp + 0x170]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x140147700
lea rax, [rcx + 1]
cmp rax, 0x104
jae 0x140147778
lea rdx, [rsp + 0x4c]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], r12w
jne 0x140147722
inc rax
lea r8, [rsp + 0x4c]
add rax, rcx
mov edx, 0x104
cmp rax, rdx
ja 0x140147750
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
jmp 0x140147778
lfence
lea rax, [rbp + 0x170]
sub rdx, rcx
mov r9d, 0x103
sub r9, rcx
lea rcx, [rax + rcx*2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov word [rbp + 0x376], r12w
mov r11d, dword [rsi + 4]
test r11d, r11d
jne 0x14014781f
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x104
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
lea rbx, [rbp + rax*2 + 0x16e]
test rax, rax
je 0x1401477d2
movzx ecx, word [rbx]
dec rax
cmp cx, 0x2e
je 0x1401477dc
cmp cx, 0x5c
je 0x1401477d2
cmp cx, 0x2f
je 0x1401477d2
sub rbx, 2
test rax, rax
jne 0x1401477b1
cmp word [rbx], 0x2e
jne 0x14014790f
lea rcx, [rbp + 0x170]
mov rax, rbx
sub rax, rcx
mov edi, 0x104
sar rax, 1
sub rdi, rax
je 0x14014790f
lfence
lea r8, str..xml
mov rdx, rdi
mov rcx, rbx
cmp rdi, 4
jbe 0x1401478ff
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
jmp 0x14014790f
mov r9d, r12d
test r11d, r11d
je 0x14014791c
lea r10, [rsi + 8]
nop
mov r8d, dword [r10]
lea rax, [rbp + 0x170]
add r8, rsi
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140147854
add rax, 2
test ecx, ecx
jne 0x140147840
test edx, edx
je 0x140147869
inc r9d
add r10, 4
cmp r9d, r11d
jb 0x140147830
jmp 0x14014791c
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x104
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
lea rbx, [rbp + rax*2 + 0x16e]
test rax, rax
je 0x1401478c1
nop word [rax + rax]
movzx ecx, word [rbx]
dec rax
cmp cx, 0x2e
je 0x1401478c7
cmp cx, 0x5c
je 0x1401478c1
cmp cx, 0x2f
je 0x1401478c1
sub rbx, 2
test rax, rax
jne 0x1401478a0
cmp word [rbx], 0x2e
jne 0x14014790f
lea rcx, [rbp + 0x170]
mov rax, rbx
sub rax, rcx
mov edi, 0x104
sar rax, 1
sub rdi, rax
je 0x14014790f
lfence
lea r8, str..xml
mov rdx, rdi
mov rcx, rbx
cmp rdi, 4
jbe 0x1401478ff
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
jmp 0x14014790f
lea r9, [rdi - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov word [rbx + rdi*2 - 2], r12w
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1401476a0
mov rdi, qword [rsp + 0x8f8]
mov rsi, qword [rsp + 0x8f0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r15, qword [rsp + 0x8b0]
mov r12, qword [rsp + 0x8c0]
test r14, r14
je 0x140147974
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
mov rcx, r14
call qword [case.0x1401b9e8b.6]
mov rbx, qword [r13 + 0x40]
mov r14, qword [rsp + 0x8b8]
mov rcx, qword [rbx + 0x460]
test rcx, rcx
je 0x1401479ad
mov rax, qword [rcx]
mov edx, reloc.WS2_32.dll_getservbyport
mov rax, qword [rax + 0x40]
call qword [case.0x14003c8e9.0]
test eax, eax
jne 0x1401479ad
lea edx, [rax + 4]
mov rcx, rbx
call fcn.1400c6560
mov rbx, qword [rsp + 0x8e8]
xor eax, eax
mov rcx, qword [rbp + 0x7a0]
xor rcx, rsp
call fcn.1401c5190
add rsp, 0x8c8
pop r13
pop rbp
ret
xor eax, eax
jmp 0x1401479b7