Function at 0x140040240
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x4c0
lea rdi, [rsp + 0x20]
mov ecx, pe_nt_image_headers64
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4d0]
mov rax, qword [0x1402548e8]
xor rax, rsp
mov qword [rsp + 0x4b8], rax
mov rcx, qword [rsp + 0x4d0]
call fcn.140007c60
mov r9d, 0x661
lea r8, [0x1401c1f10]
lea rdx, [0x1401c18b8]
mov rcx, rax
call fcn.14001a290
mov rcx, qword [rsp + 0x4d0]
call fcn.14001a4e0
test rax, rax
jne 0x1400402ca
mov qword [rsp + 0x468], 1
jmp 0x1400402d6
mov qword [rsp + 0x468], 0
mov r9d, 0x662
lea r8, [0x1401c1f70]
lea rdx, str.IsEmptyStr__szOSDirectoryName___FALSE
mov rcx, qword [rsp + 0x468]
call fcn.14001a290
mov rdx, qword [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call fcn.1400068c0
nop
mov dx, 0x5c
lea rcx, [rsp + 0x2a0]
call fcn.140052850
lea r8, [0x1401c1cd8]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x328]
call fcn.140058450
mov qword [rsp + 0x470], rax
mov rax, qword [rsp + 0x470]
mov qword [rsp + 0x478], rax
mov rcx, qword [rsp + 0x478]
call fcn.140052100
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x308], rax
lea rcx, [rsp + 0x328]
call fcn.140006b30
cmp qword [rsp + 0x308], 0xffffffffffffffff
je 0x1400405a3
cmp dword [rsp + 0x4d8], 2
jne 0x1400403a8
mov dword [rsp + 0x480], 0
jmp 0x1400403b6
mov eax, dword [rsp + 0x4d8]
mov dword [rsp + 0x480], eax
mov eax, dword [rsp + 0x480]
mov dword [rsp + 0x310], eax
lea rcx, [rsp + 0x5c]
call fcn.140038320
test rax, rax
jne 0x14004057a
mov eax, dword [rsp + 0x30]
and eax, 0x10
test eax, eax
je 0x1400404ba
lea r8, [rsp + 0x5c]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x388]
call fcn.140058450
mov qword [rsp + 0x488], rax
mov rax, qword [rsp + 0x488]
mov qword [rsp + 0x490], rax
mov rcx, qword [rsp + 0x490]
call fcn.140052100
mov r8, qword [rsp + 0x4e0]
mov edx, dword [rsp + 0x310]
mov rcx, rax
call fcn.140040240
test rax, rax
jne 0x14004044e
mov dword [rsp + 0x498], 1
jmp 0x140040459
mov dword [rsp + 0x498], 0
movzx eax, byte [rsp + 0x498]
mov byte [rsp + 0x380], al
lea rcx, [rsp + 0x388]
call fcn.140006b30
movzx eax, byte [rsp + 0x380]
test eax, eax
je 0x1400404b5
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x3e0], 0
lea rcx, [rsp + 0x2a0]
call fcn.140006b30
mov rax, qword [rsp + 0x3e0]
jmp 0x14004065c
jmp 0x14004057a
lea r8, [rsp + 0x5c]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x3f0]
call fcn.140058450
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0x4a8], rax
mov rcx, qword [rsp + 0x4a8]
call fcn.140052100
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140040513
mov dword [rsp + 0x4b0], 1
jmp 0x14004051e
mov dword [rsp + 0x4b0], 0
movzx eax, byte [rsp + 0x4b0]
mov byte [rsp + 0x3e8], al
lea rcx, [rsp + 0x3f0]
call fcn.140006b30
movzx eax, byte [rsp + 0x3e8]
test eax, eax
je 0x14004057a
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x448], 0
lea rcx, [rsp + 0x2a0]
call fcn.140006b30
mov rax, qword [rsp + 0x448]
jmp 0x14004065c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400403c4
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rsp + 0x4d8], 0
je 0x1400405d3
mov qword [rsp + 0x450], 1
lea rcx, [rsp + 0x2a0]
call fcn.140006b30
mov rax, qword [rsp + 0x450]
jmp 0x14004065c
cmp qword [rsp + 0x4e0], 0
je 0x14004060f
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov qword [rsp + 0x458], 1
lea rcx, [rsp + 0x2a0]
call fcn.140006b30
mov rax, qword [rsp + 0x458]
jmp 0x14004065c
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cdqe
mov qword [rsp + 0x318], rax
cmp qword [rsp + 0x318], 0
jne 0x140040637
call fcn.14003d200
mov rax, qword [rsp + 0x318]
mov qword [rsp + 0x460], rax
lea rcx, [rsp + 0x2a0]
call fcn.140006b30
mov rax, qword [rsp + 0x460]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.1400bf760
mov rax, rdi
mov rcx, qword [rsp + 0x4b8]
xor rcx, rsp
call fcn.1400bfa50
add rsp, 0x4c0
pop rdi
ret