Function at 0x140040860
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x4c0
lea rdi, [rsp + 0x20]
mov ecx, pe_nt_image_headers64
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4d0]
mov rax, qword [0x1402558e8]
xor rax, rsp
mov qword [rsp + 0x4b8], rax
mov rcx, qword [rsp + 0x4d0]
call fcn.1400090b0
mov r9d, 0x661
lea r8, [0x1401c3580]
lea rdx, [0x1401c2f28]
mov rcx, rax
call fcn.14001a8b0
mov rcx, qword [rsp + 0x4d0]
call fcn.14001ab00
test rax, rax
jne 0x1400408ea
mov qword [rsp + 0x468], 1
jmp 0x1400408f6
mov qword [rsp + 0x468], 0
mov r9d, 0x662
lea r8, [0x1401c35e0]
lea rdx, str.IsEmptyStr__szOSDirectoryName___FALSE
mov rcx, qword [rsp + 0x468]
call fcn.14001a8b0
mov rdx, qword [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call fcn.1400087a0
nop
mov dx, 0x5c
lea rcx, [rsp + 0x2a0]
call fcn.140052e70
lea r8, [0x1401c3348]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x328]
call fcn.140058a70
mov qword [rsp + 0x470], rax
mov rax, qword [rsp + 0x470]
mov qword [rsp + 0x478], rax
mov rcx, qword [rsp + 0x478]
call fcn.140052720
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x308], rax
lea rcx, [rsp + 0x328]
call fcn.140004db0
cmp qword [rsp + 0x308], 0xffffffffffffffff
je 0x140040bc3
cmp dword [rsp + 0x4d8], 2
jne 0x1400409c8
mov dword [rsp + 0x480], 0
jmp 0x1400409d6
mov eax, dword [rsp + 0x4d8]
mov dword [rsp + 0x480], eax
mov eax, dword [rsp + 0x480]
mov dword [rsp + 0x310], eax
lea rcx, [rsp + 0x5c]
call fcn.140038940
test rax, rax
jne 0x140040b9a
mov eax, dword [rsp + 0x30]
and eax, 0x10
test eax, eax
je 0x140040ada
lea r8, [rsp + 0x5c]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x388]
call fcn.140058a70
mov qword [rsp + 0x488], rax
mov rax, qword [rsp + 0x488]
mov qword [rsp + 0x490], rax
mov rcx, qword [rsp + 0x490]
call fcn.140052720
mov r8, qword [rsp + 0x4e0]
mov edx, dword [rsp + 0x310]
mov rcx, rax
call fcn.140040860
test rax, rax
jne 0x140040a6e
mov dword [rsp + 0x498], 1
jmp 0x140040a79
mov dword [rsp + 0x498], 0
movzx eax, byte [rsp + 0x498]
mov byte [rsp + 0x380], al
lea rcx, [rsp + 0x388]
call fcn.140004db0
movzx eax, byte [rsp + 0x380]
test eax, eax
je 0x140040ad5
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x3e0], 0
lea rcx, [rsp + 0x2a0]
call fcn.140004db0
mov rax, qword [rsp + 0x3e0]
jmp 0x140040c7c
jmp 0x140040b9a
lea r8, [rsp + 0x5c]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x3f0]
call fcn.140058a70
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0x4a8], rax
mov rcx, qword [rsp + 0x4a8]
call fcn.140052720
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140040b33
mov dword [rsp + 0x4b0], 1
jmp 0x140040b3e
mov dword [rsp + 0x4b0], 0
movzx eax, byte [rsp + 0x4b0]
mov byte [rsp + 0x3e8], al
lea rcx, [rsp + 0x3f0]
call fcn.140004db0
movzx eax, byte [rsp + 0x3e8]
test eax, eax
je 0x140040b9a
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x448], 0
lea rcx, [rsp + 0x2a0]
call fcn.140004db0
mov rax, qword [rsp + 0x448]
jmp 0x140040c7c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400409e4
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rsp + 0x4d8], 0
je 0x140040bf3
mov qword [rsp + 0x450], 1
lea rcx, [rsp + 0x2a0]
call fcn.140004db0
mov rax, qword [rsp + 0x450]
jmp 0x140040c7c
cmp qword [rsp + 0x4e0], 0
je 0x140040c2f
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov qword [rsp + 0x458], 1
lea rcx, [rsp + 0x2a0]
call fcn.140004db0
mov rax, qword [rsp + 0x458]
jmp 0x140040c7c
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cdqe
mov qword [rsp + 0x318], rax
cmp qword [rsp + 0x318], 0
jne 0x140040c57
call fcn.14003d820
mov rax, qword [rsp + 0x318]
mov qword [rsp + 0x460], rax
lea rcx, [rsp + 0x2a0]
call fcn.140004db0
mov rax, qword [rsp + 0x460]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.1400bfd90
mov rax, rdi
mov rcx, qword [rsp + 0x4b8]
xor rcx, rsp
call fcn.1400c0080
add rsp, 0x4c0
pop rdi
ret