Function at 0x14006b730
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x140103540]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov rdi, rcx
mov qword [rsp + 0x70], rcx
xor r12d, r12d
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x58], r12
mov r14d, 0xf
mov qword [rbp - 0x50], r14
mov byte [rbp - 0x68], r12b
mov rcx, qword [rcx + 0x10]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, rcx
cmp rax, 3
jb 0x14006bc0e
mov r9, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14006b7b4
mov r9, qword [rdi]
mov qword [rsp + 0x30], 3
lea rax, [0x1400b11a4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r8, rdi
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x48]
call fcn.14006af90
nop
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x14006bab3
movzx ebx, byte [rsp + 0x40]
lea rax, [rbp + 0xc]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14006b830
lea rdx, [rbp + 0xc]
lea rcx, [rbp - 0x68]
call fcn.140008800
mov rcx, qword [rdi + 0x10]
mov rax, r13
sub rax, rcx
mov rdx, qword [rbp - 0x58]
cmp rax, rdx
jb 0x14006bc1a
mov r9, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14006b86b
mov r9, qword [rdi]
lea rax, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rax, qword [rbp - 0x68]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r8, rdi
movzx edx, bl
lea rcx, [rsp + 0x50]
call fcn.14006af90
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x14006b8d4
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006b8cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006bc14
call fcn.140070cd4
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rbp - 0x78], xmm1
lea rcx, [rsp + 0x78]
movq rdx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 0x10
cmovae rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x14006b928
and eax, 0xfffffffe
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rcx, qword [rsp + 0x78]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov r14, qword [rbp - 0x50]
mov rsi, qword [rbp - 0x68]
test byte [rbp - 0x20], 0x10
je 0x14006ba35
lea rax, [rbp - 0x68]
cmp r14, 0x10
setae dl
cmovae rax, rsi
mov rcx, qword [rbp - 0x58]
cmp rcx, 1
jne 0x14006b96a
cmp byte [rax], 0x2e
jne 0x14006b95d
mov eax, r12d
jmp 0x14006b962
sbb eax, eax
or eax, 1
test eax, eax
je 0x14006ba9d
lea rax, [rbp - 0x68]
test dl, dl
cmovne rax, rsi
cmp rcx, 2
jne 0x14006b997
cmp byte [rax], 0x2e
jne 0x14006b98a
cmp byte [rax + 1], 0x2e
jne 0x14006b98a
mov eax, r12d
jmp 0x14006b98f
sbb eax, eax
or eax, 1
test eax, eax
je 0x14006ba9d
mov rcx, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14006b9ca
lea rax, [rcx + 1]
mov qword [rbp - 0x78], rax
lea rax, [rsp + 0x78]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0x78]
mov word [rax + rcx], 0x5c
jmp 0x14006b9eb
mov qword [rsp + 0x20], 1
lea r9, [0x1400b10e4]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x78]
call fcn.140004a60
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
call fcn.140005690
mov rcx, rax
call fcn.14006b730
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea rcx, [0x140104eb0]
test eax, eax
je 0x14006ba2c
lea rdx, str.deleted_directory_:
jmp 0x14006ba78
lea rdx, str.could_not_delete_directory_:
jmp 0x14006ba78
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [0x140104eb0]
test eax, eax
lea rdx, str.deleted_file_:
jne 0x14006ba78
lea rdx, str.could_not_delete_file_:
call fcn.14006a3d0
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rdx, qword [rsp + 0x78]
mov rcx, rax
call fcn.14006a3d0
mov rcx, rax
call fcn.14006aa30
lea rdx, [rbp - 0x20]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x14006bab7
jmp 0x14006b820
mov rsi, qword [rbp - 0x68]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x14006bafd
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006baf8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006bc20
call fcn.140070cd4
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14006bb49
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006bb44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006bc26
call fcn.140070cd4
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
cmp r14, 0x10
jb 0x14006bb8d
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14006bb84
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006bc02
mov rcx, rsi
call fcn.140070cd4
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14006bbc3
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14006bbbe
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14006bc08
mov rcx, r8
call fcn.140070cd4
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140070fc0
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400777fc
nop
call fcn.1400777fc
nop
call fcn.140008480
nop
call fcn.1400777fc
int3
call fcn.140008480
nop
call fcn.1400777fc
nop
call fcn.1400777fc
int3