Function at 0x1401a9780
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1680]
mov eax, 0x1780
call fcn.1401c0850
sub rsp, rax
mov rax, qword [0x140351248]
xor rax, rsp
mov qword [rbp + 0x1670], rax
mov rbx, rcx
mov qword [rbp - 0x78], rcx
mov rsi, qword [rcx + 0x10]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, rsi
cmp rax, 3
jb 0x1401a9af6
mov r12, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x1401a97f0
mov r12, qword [rcx]
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea r15, [rsi + 3]
mov edi, SafeArrayGetLBound
lea r14, [rsp + 0x28]
cmp r15, rdi
jbe 0x1401a9842
mov rdi, r15
or rdi, 0xf
cmp rdi, r13
jbe 0x1401a9825
mov rdi, r13
jmp 0x1401a9831
mov eax, SafeArrayPutElement
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
call fcn.1400b88d0
mov r14, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], rdi
mov r8, rsi
mov rdx, r12
mov rcx, r14
call fcn.1401f7750
movzx ecx, word [0x140282a98]
mov word [r14 + rsi], cx
movzx ecx, byte [0x140282a9a]
mov byte [r14 + rsi + 2], cl
mov byte [r14 + r15], 0
lea rcx, [rsp + 0x28]
call fcn.1401b5ee0
mov r15, rax
xor r12d, r12d
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov r14, qword [rbx + 0x10]
mov rsi, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1401a98a7
mov rsi, qword [rbx]
cmp r14, 0x10
jae 0x1401a98bc
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x48], xmm0
mov edi, SafeArrayGetLBound
jmp 0x1401a98e7
mov rdi, r14
or rdi, 0xf
cmp rdi, r13
cmova rdi, r13
lea rcx, [rdi + 1]
call fcn.1400b88d0
mov qword [rsp + 0x48], rax
lea r8, [r14 + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1401f7750
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], rdi
lea rcx, [rsp + 0x48]
call fcn.1401b5ee0
mov r14, rax
lea rdx, [rbp - 0x50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1401a99f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r10, [rbp + 0x215]
nop dword [rax + rax]
dec r10
mov eax, 0xcccccccd
mul r9d
shr edx, 3
movzx ecx, dl
shl cl, 2
lea r8d, [rcx + rdx]
add r8b, r8b
sub r9b, r8b
add r9b, 0x30
mov byte [r10], r9b
mov r9d, edx
test edx, edx
jne 0x1401a9930
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], SafeArrayLock
mov byte [rbp - 0x70], r12b
lea rax, [rbp + 0x215]
cmp r10, rax
je 0x1401a9993
lea r8, [rbp + 0x215]
sub r8, r10
mov rdx, r10
lea rcx, [rbp - 0x70]
call fcn.1400cf610
nop
lea r8, [rbp - 0x70]
lea rdx, str._RemoveAllFilesInFolder__FindFirstFile_failed:
lea rcx, [rsp + 0x68]
call fcn.1400b8710
mov rcx, rax
call fcn.140162100
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x1401a99ec
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401a99e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401a9aea
call fcn.1401bfb10
xor dil, dil
jmp 0x1401a9a57
movzx ecx, word [rbp - 0x24]
movzx eax, word [rbp - 0x22]
cmp cx, 0x2e
jne 0x1401a9a15
test ax, ax
je 0x1401a9a43
cmp cx, cx
jne 0x1401a9a15
cmp ax, cx
jne 0x1401a9a15
cmp word [rbp - 0x20], r12w
je 0x1401a9a43
lea r9, [rbp - 0x24]
mov r8, r14
lea rdx, str._s_s
lea rcx, [rbp + 0x220]
call qword [sym.imp.USER32.dll_wsprintfW]
test byte [rbp - 0x50], 0x10
jne 0x1401a9a43
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rbp - 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1401a99f1
mov dil, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, r15
call fcn.1401c028c
mov rcx, r14
call fcn.1401c028c
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1401a9aa7
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1401a9aa2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401a9af0
mov rcx, r8
call fcn.1401bfb10
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], SafeArrayLock
mov byte [rbx], 0
movzx eax, dil
mov rcx, qword [rbp + 0x1670]
xor rcx, rsp
call fcn.1401c0070
lea r11, [rsp + 0x1780]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
call fcn.1400cf1a0
int3