Function at 0x140018098
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x9e8
mov rbp, rdx
mov rsi, rcx
mov rcx, rdx
xor edx, edx
call fcn.140006edc
lea rdi, [rsp + 0x310]
mov qword [rdi], rax
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], 0
mov rcx, rdi
mov rdx, rsi
mov r8, rbp
call fcn.140013e89
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x20], 1
lea r9, str.NTDLL.DLL
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov rdx, rsi
mov r8, rbp
call fcn.140014d95
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rdi, [rsp + 0x310]
mov rcx, rdi
call fcn.1400142f8
cmp dword [rdi], 1
jne 0x140018159
mov r15, qword [rsp + 0x318]
mov r13, qword [rsp + 0x320]
lea rcx, [rsp + 0x50]
call fcn.1400070ac
lea rcx, [rsp + 0x30]
call fcn.1400070ac
jmp 0x140018665
lea rdi, [rsp + 0x310]
mov rax, qword [rdi + 0x10]
mov rbx, qword [rdi + 8]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x578], rbx
mov qword [rsp + 0x580], rax
mov qword [rsp + 0x588], rcx
mov r8d, 0x250
mov rcx, rdi
xor edx, edx
call fcn.1400191d0
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.kernel32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140018202
mov ecx, 0x28
call fcn.1400057c0
test rax, rax
je 0x140018683
mov r13, rax
mov rax, qword [rsp + 0x40]
mov qword [r13 + 0x20], rax
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [r13 + 0x10], xmm0
mov eax, 1
mov qword [r13], rax
mov qword [r13 + 8], rax
lea rcx, [rsp + 0xb8]
lea rdx, [rsp + 0x310]
mov r8d, 0x250
call fcn.140019390
xor ebx, ebx
mov r15, rdi
jmp 0x140018217
call qword [sym.imp.kernel32.dll_GetLastError]
mov r15d, eax
shl r15, 0x20
mov ebx, 1
xor r13d, r13d
lea rcx, [rsp + 0x578]
call fcn.14000f691
lea rcx, [rsp + 0x50]
call fcn.1400070ac
cmp rdi, 0xffffffffffffffff
jne 0x14001823e
lea rcx, [rsp + 0x30]
call fcn.1400070ac
test rbx, rbx
jne 0x140018665
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rbp
lea rdi, [rsp + 0x798]
lea rbx, [rsp + 0xb8]
mov r8d, 0x250
mov rcx, rdi
mov rdx, rbx
call fcn.140019390
lea rcx, [rsp + 0x324]
mov qword [rcx - 0xc], r13
mov qword [rcx - 0x14], r15
mov r8d, 0x250
mov rdx, rdi
call fcn.140019390
mov eax, 1
mov r12, qword [sym.imp.kernel32.dll_FindNextFileW]
mov r13, qword [sym.imp.kernel32.dll_GetLastError]
movzx edi, word [rsp + 0x350]
movzx ebp, word [rsp + 0x352]
movzx esi, word [rsp + 0x354]
mov dword [rsp + 0x320], 0
cmp eax, 1
jne 0x14001833a
cmp di, 0x2e
jne 0x1400182e4
test bp, bp
je 0x14001833a
cmp bp, 0x2e
jne 0x1400182e4
test si, si
je 0x14001833a
mov r15, qword [rsp + 0x318]
lock inc qword [r15]
jle 0x14001867f
mov r13, qword [rsp + 0x324]
lea rax, [rsp + 0x324]
movups xmm0, xmmword [rax + 8]
movups xmm1, xmmword [rax + 0x18]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm1
mov eax, dword [rax + 0x28]
mov dword [rsp + 0x70], eax
mov r8d, 0x21e
lea rcx, [rsp + 0x578]
lea rdx, [rsp + 0x356]
jmp 0x1400183fa
mov r8d, 0x250
mov rcx, rbx
xor edx, edx
call fcn.1400191d0
mov rdi, qword [rsp + 0x310]
mov r15, qword [rsp + 0x318]
mov ebp, r14d
movzx esi, word [rsp + 0x2e]
mov rcx, rdi
mov rdx, rbx
call r12
test eax, eax
je 0x140018403
cmp word [rsp + 0xe4], 0x2e
jne 0x14001839c
movzx eax, word [rsp + 0xe6]
test ax, ax
je 0x140018362
cmp ax, 0x2e
jne 0x14001839c
cmp word [rsp + 0xe8], 0
je 0x140018362
lock inc qword [r15]
jle 0x14001867f
test r15, r15
je 0x140018362
mov r13, qword [rsp + 0xb8]
movups xmm0, xmmword [rbx + 8]
movups xmm1, xmmword [rbx + 0x18]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm1
mov eax, dword [rbx + 0x28]
mov dword [rsp + 0x70], eax
movzx edi, word [rsp + 0xe4]
movzx ebp, word [rsp + 0xe6]
movzx esi, word [rsp + 0xe8]
mov r8d, 0x21e
lea rcx, [rsp + 0x578]
lea rdx, [rsp + 0xea]
call fcn.140019390
xor eax, eax
jmp 0x140018426
call r13
cmp eax, 0x12
je 0x1400185cb
call r13
mov r15d, eax
shl r15, 0x20
mov eax, 1
xor r13d, r13d
movzx edi, word [rsp + 0x2c]
test rax, rax
jne 0x140018658
mov eax, dword [rsp + 0x70]
mov dword [rbx + 0x30], eax
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rbx + 0x20], xmm1
movups xmmword [rbx + 0x10], xmm0
mov word [rsp + 0xec], di
mov word [rsp + 0xee], bp
mov word [rsp + 0xf0], si
mov r8d, 0x21e
lea rcx, [rsp + 0xf2]
lea rdx, [rsp + 0x578]
call fcn.140019390
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xb8], r15
bt r13d, 0xa
mov word [rsp + 0x2e], si
jae 0x1400184ce
mov eax, dword [rsp + 0xe4]
mov ecx, 0x20000000
and eax, ecx
je 0x1400184ce
test r13b, 0x10
je 0x1400184d4
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov rdx, rbx
call fcn.140014d08
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
call fcn.140018005
jmp 0x140018539
test r13b, 0x10
jne 0x14001851a
lea rcx, [rsp + 0x88]
mov rdx, rbx
call fcn.140014d08
mov rdx, qword [rsp + 0x88]
mov r8, qword [rsp + 0x98]
lea rcx, [rsp + 0x30]
call fcn.1400142f8
cmp dword [rsp + 0x30], 1
mov r13, qword [rsp + 0x40]
mov r14, qword [rsp + 0x38]
jne 0x140018552
cmp r14b, 4
je 0x14001858d
jmp 0x1400185f2
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov rdx, rbx
call fcn.140014d08
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
call fcn.140018098
mov r15, rax
mov r13, rdx
mov rcx, rsi
call fcn.1400070ac
cmp r15b, 4
je 0x14001859a
jmp 0x14001863d
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], r13
mov qword [rsp + 0xb0], rax
mov rcx, r14
call qword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
je 0x140018600
lea rcx, [rsp + 0xa0]
call fcn.14000f691
lea rcx, [rsp + 0x88]
call fcn.1400070ac
mov word [rsp + 0x2c], di
mov r14d, ebp
mov rax, qword [rsp + 0xb8]
lock dec qword [rax]
jne 0x1400185b8
mov rcx, rbx
call fcn.1400170d8
mov eax, dword [rsp + 0x320]
mov r13, qword [sym.imp.kernel32.dll_GetLastError]
jmp 0x1400182a6
lea rcx, [rsp + 0x310]
call fcn.140018694
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
call fcn.140018005
mov r15, rax
mov r13, rdx
jmp 0x140018665
mov r15, r14
shrd r15, r13, 8
shr r13, 8
jmp 0x140018620
call qword [sym.imp.kernel32.dll_GetLastError]
mov r15d, eax
shl r15, 0x18
xor r14d, r14d
lea rcx, [rsp + 0xa0]
call fcn.14000f691
xor r13d, r13d
movzx eax, r14b
shld r13, r15, 8
shl r15, 8
or r15, rax
lea rcx, [rsp + 0x88]
call fcn.1400070ac
mov rax, qword [rsp + 0xb8]
lock dec qword [rax]
jne 0x140018658
lea rcx, [rsp + 0xb8]
call fcn.1400170d8
lea rcx, [rsp + 0x310]
call fcn.140018694
mov rax, r15
mov rdx, r13
add rsp, 0x9e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
mov ecx, 0x28
mov edx, 8
call fcn.140024446
ud2