Function at 0x1400195b0
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x1400b80c0]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov rbx, rdx
mov qword [rsp + 0x30], rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
mov r13d, esi
mov dword [rsp + 0x20], esi
lea r8, [0x1400a8900]
mov rdx, rcx
lea rcx, [rbp - 0x78]
call fcn.14001fe50
nop
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rcx, qword [rbp - 0x78]
lea rdx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, rax
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x140019b08
mov r11d, reloc.WLDAP32.dll_Ordinal_22
movabs r9, 0x7fffffffffffffff
lea r10, [r11 - 0x17]
movzx edx, byte [rbp - 0x24]
movzx ecx, byte [rbp - 0x23]
cmp dl, 0x2e
jne 0x140019672
test cl, cl
je 0x140019acf
cmp dl, dl
jne 0x140019672
cmp cl, dl
jne 0x140019672
cmp byte [rbp - 0x22], 0
je 0x140019acf
test byte [rbp - 0x50], 0x10
je 0x140019909
mov r15, qword [rdi + 0x10]
lea rax, [rbp - 0x24]
mov rbx, r10
inc rbx
cmp byte [rax + rbx], 0
jne 0x140019687
mov rax, r9
sub rax, r15
cmp rax, rbx
jb 0x140019b8f
mov r12, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400196ac
mov r12, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], rsi
lea r14, [rbx + r15]
mov edi, reloc.WS2_32.dll_ntohs
lea rsi, [rsp + 0x68]
cmp r14, rdi
jbe 0x14001973f
mov rdi, r14
or rdi, 0xf
cmp rdi, r9
jbe 0x1400196e1
mov rdi, r9
jmp 0x1400196e9
cmp rdi, 0x16
cmovb rdi, r11
mov rcx, rdi
add rcx, 1
cmovb rcx, r10
cmp rcx, 0x1000
jb 0x140019729
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140019b7d
mov rcx, rax
call fcn.14009452c
test rax, rax
je 0x140019af5
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14001973a
test rcx, rcx
je 0x140019738
call fcn.14009452c
mov rsi, rax
jmp 0x14001973a
xor esi, esi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], rdi
mov r8, r15
mov rdx, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsi + r15]
mov r8, rbx
lea rdx, [rbp - 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r14], 0
or r13d, 2
mov r14, qword [rsp + 0x78]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 1
jb 0x140019b89
lea r15, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae r15, qword [rsp + 0x68]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rsi, [r14 + 1]
mov edi, reloc.WS2_32.dll_ntohs
lea rbx, [rsp + 0x48]
cmp rsi, rdi
jbe 0x140019834
mov rdi, rsi
or rdi, 0xf
cmp rdi, rcx
jbe 0x1400197ca
mov rdi, rcx
jmp 0x1400197d7
cmp rdi, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rdi, rax
mov rcx, rdi
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x14001981e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140019b83
mov rcx, rax
call fcn.14009452c
test rax, rax
je 0x140019aee
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14001982f
test rcx, rcx
je 0x14001982d
call fcn.14009452c
mov rbx, rax
jmp 0x14001982f
xor ebx, ebx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov r8, r14
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r14], 0x5c
mov byte [rbx + rsi], 0
or r13d, 4
mov dword [rsp + 0x20], r13d
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x14001989a
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019895
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019aee
call fcn.140094568
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x78], xmm1
mov r8b, 1
mov rbx, qword [rsp + 0x30]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.1400195b0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140019acf
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400198ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019af5
call fcn.140094568
jmp 0x140019acf
mov r14, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rsp + 0x40], rax
cmp r14, rax
je 0x140019acf
nop
mov r8, r14
cmp qword [r14 + 0x18], 0x10
jb 0x14001992d
mov r8, qword [r14]
lea rax, [rbp - 0x24]
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140019947
inc rax
test ecx, ecx
jne 0x140019934
test edx, edx
jne 0x140019abb
mov r12, qword [rdi + 0x10]
lea rax, [rbp - 0x24]
mov rbx, r10
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140019960
mov rax, r9
sub rax, r12
cmp rax, rbx
jb 0x140019b77
mov r13, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140019985
mov r13, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], rsi
lea r15, [rbx + r12]
mov edi, reloc.WS2_32.dll_ntohs
lea rsi, [rsp + 0x68]
cmp r15, rdi
jbe 0x140019a18
mov rdi, r15
or rdi, 0xf
cmp rdi, r9
jbe 0x1400199ba
mov rdi, r9
jmp 0x1400199c2
cmp rdi, 0x16
cmovb rdi, r11
mov rcx, rdi
add rcx, 1
cmovb rcx, r10
cmp rcx, 0x1000
jb 0x140019a02
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140019b95
mov rcx, rax
call fcn.14009452c
test rax, rax
je 0x140019afc
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140019a13
test rcx, rcx
je 0x140019a11
call fcn.14009452c
mov rsi, rax
jmp 0x140019a13
xor esi, esi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], rdi
mov r8, r12
mov rdx, r13
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsi + r12]
mov r8, rbx
lea rdx, [rbp - 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r15], 0
mov r13d, dword [rsp + 0x20]
or r13d, 1
mov dword [rsp + 0x20], r13d
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140019aa0
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019a9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019afc
call fcn.140094568
mov r11d, reloc.WLDAP32.dll_Ordinal_22
lea r10, [r11 - 0x17]
movabs r9, 0x7fffffffffffffff
xor esi, esi
mov rdi, qword [rsp + 0x28]
add r14, 0x20
cmp r14, qword [rsp + 0x40]
jne 0x140019920
mov rbx, qword [rsp + 0x30]
lea rdx, [rbp - 0x50]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140019b03
mov rdi, qword [rsp + 0x28]
xor esi, esi
jmp 0x140019637
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140019b4d
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019b48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019b48
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140094568
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.140094680
mov rbx, qword [rsp + 0x250]
add rsp, 0x200
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140001350
nop
call fcn.1400012b0
nop
call fcn.1400012b0
int3
call fcn.140001350
nop
call fcn.140001350
int3
call fcn.1400012b0
int3