Function at 0x18002b450
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x840]
sub rsp, 0x940
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x990], rbx
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rbp + 0x830], rax
mov r15, rdx
mov r14, rcx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
xor r12d, r12d
mov qword [rsp + 0x50], r12
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp - 0x50]
call fcn.1800abaa0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x200]
call fcn.1800abaa0
lea r8, [r14 + 0x208]
mov rdx, r14
lea rcx, [rbp + 0x200]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ecx, 0x104
lea rax, [rbp + 0x200]
cmp word [r14 + 0x24a], r12w
je 0x18002b622
nop word [rax + rax]
cmp word [rax], 0
je 0x18002b510
add rax, 2
sub rcx, 1
jne 0x18002b500
test rcx, rcx
je 0x18002b51f
mov eax, 0x104
sub rax, rcx
jmp 0x18002b522
mov rax, r12
test rcx, rcx
je 0x18002b580
mov edx, 0x104
sub rdx, rax
lea rcx, [rbp + 0x200]
lea rcx, [rcx + rax*2]
je 0x18002b571
add rax, 0x7ffffefb
add rax, rdx
lea r9, [0x1800fb150]
sub r9, rcx
nop
test rax, rax
je 0x18002b571
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x18002b571
mov word [rcx], r8w
add rcx, 2
dec rax
sub rdx, 1
jne 0x18002b550
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
lea r8, [r14 + 0x24a]
lea rcx, [rbp + 0x200]
call fcn.18002d3b0
mov ecx, 0x104
lea rax, [rbp + 0x200]
nop
cmp word [rax], 0
je 0x18002b5b0
add rax, 2
sub rcx, 1
jne 0x18002b5a0
test rcx, rcx
je 0x18002b5bf
mov eax, 0x104
sub rax, rcx
jmp 0x18002b5c2
mov rax, r12
test rcx, rcx
je 0x18002b6a1
mov edx, 0x104
sub rdx, rax
lea rcx, [rbp + 0x200]
lea rcx, [rcx + rax*2]
je 0x18002b692
add rax, 0x7ffffefb
add rax, rdx
lea r8, str...log
sub r8, rcx
test rax, rax
je 0x18002b692
movzx r9d, word [r8 + rcx]
test r9w, r9w
je 0x18002b692
mov word [rcx], r9w
add rcx, 2
dec rax
sub rdx, 1
jne 0x18002b5f7
jmp 0x18002b692
cmp word [rax], 0
je 0x18002b632
add rax, 2
sub rcx, 1
jne 0x18002b622
test rcx, rcx
je 0x18002b641
mov eax, 0x104
sub rax, rcx
jmp 0x18002b644
mov rax, r12
test rcx, rcx
je 0x18002b6a1
mov edx, 0x104
sub rdx, rax
lea rcx, [rbp + 0x200]
lea rcx, [rcx + rax*2]
je 0x18002b692
add rax, 0x7ffffefb
add rax, rdx
lea r8, str...log
sub r8, rcx
test rax, rax
je 0x18002b692
movzx r9d, word [r8 + rcx]
test r9w, r9w
je 0x18002b692
mov word [rcx], r9w
add rcx, 2
dec rax
sub rdx, 1
jne 0x18002b671
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
mov qword [r15 + 8], r12
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x200]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x18002b6d0
movups xmm0, xmmword [r15]
movups xmmword [r14 + 0x2bc], xmm0
jmp 0x18002b9e0
movabs r13, 0xc92a69c000
nop word [rax + rax]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x620]
call fcn.1800abaa0
lea r8, [rbp - 0x24]
mov rdx, r14
lea rcx, [rbp + 0x620]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edx, edx
lea r8d, [rdx + 0x2e]
lea rcx, [rbp - 0x24]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rbx, rax
test rax, rax
je 0x18002b968
mov r8d, 0x2e
lea rdx, [rax - 2]
lea rcx, [rbp - 0x24]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rdi, rax
test rax, rax
je 0x18002b968
lea rcx, [rax + 2]
cmp rcx, rbx
je 0x18002b968
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x410]
call fcn.1800abaa0
sub rbx, rdi
sar rbx, 1
dec rbx
cmp rbx, 0x7ffffffe
ja 0x18002b7c3
mov edx, 0x104
lea rax, [rbp + 0x410]
add rbx, 0xfffffffffffffefc
lea rcx, [rbp + 0x410]
sub rdi, rcx
lea rcx, [rbx + rdx]
test rcx, rcx
je 0x18002b7b4
movzx ecx, word [rdi + rax + 2]
test cx, cx
je 0x18002b7b4
mov word [rax], cx
add rax, 2
sub rdx, 1
jne 0x18002b794
lea rcx, [rax - 2]
test rdx, rdx
cmovne rcx, rax
mov word [rcx], r12w
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x34], r12d
mov dword [rsp + 0x38], r12d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
lea rdx, str._d__d__d
lea rcx, [rbp + 0x410]
call fcn.18002d350
cmp eax, 3
jne 0x18002b968
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
movzx eax, word [rsp + 0x30]
mov word [rbp - 0x60], ax
movzx eax, word [rsp + 0x34]
mov word [rbp - 0x5e], ax
movzx eax, word [rsp + 0x38]
mov word [rbp - 0x5a], ax
lea rdx, [rsp + 0x58]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0x68]
sub rax, qword [rsp + 0x70]
cqo
idiv r13
cmp eax, dword [r14 + 0x2b8]
jl 0x18002b968
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r12w
lea rax, [rbp + 0x620]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18002b8b0
lea rdx, [rbp + 0x620]
lea rcx, [rbp - 0x80]
call fcn.18002c0b0
nop
mov rdx, qword [rsp + 0x48]
cmp qword [rsp + 0x50], rdx
je 0x18002b908
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x70]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r12w
add qword [rsp + 0x48], 0x20
jmp 0x18002b917
lea r8, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.18002c8f0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18002b957
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002b952
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002ba63
call fcn.18008f874
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r12w
lea rdx, [rbp - 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18002b6e0
movups xmm0, xmmword [r15]
movups xmmword [r14 + 0x2bc], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdi, r12
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
sub rax, rcx
sar rax, 5
test rax, rax
je 0x18002b9e0
mov rbx, r12
nop
add rcx, rbx
cmp qword [rcx + 0x18], 8
jb 0x18002b9bd
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
inc rdi
add rbx, 0x20
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
sub rax, rcx
sar rax, 5
cmp rdi, rax
jb 0x18002b9b0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18002ba39
mov rdx, qword [rsp + 0x48]
call fcn.18002caf0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002ba26
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002ba69
call fcn.18008f874
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov rcx, qword [rbp + 0x830]
xor rcx, rsp
call fcn.18008f850
mov rbx, qword [rsp + 0x990]
add rsp, 0x940
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800aee30
nop
call fcn.1800aee30
int3