Function at 0x1400331f0
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Get disk information
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb08]
sub rsp, 0xbd0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14005b010]
xor rax, rsp
mov qword [rbp + 0xac0], rax
mov rdi, rdx
mov r13, rcx
lea rbx, [rdx + 8]
cmp qword [rdx + 0x20], 8
jb 0x140033240
mov rdx, qword [rbx]
jmp 0x140033243
mov rdx, rbx
mov rcx, qword [rcx + 8]
xor r12d, r12d
test rcx, rcx
je 0x140033a60
mov rax, qword [rcx]
mov rax, qword [rax + 0x68]
call qword [case.0x140010c4b.0]
test al, al
je 0x140033a60
mov rax, qword [rdi + 0x18]
cmp qword [rdi + 0x20], 8
jb 0x140033278
mov rcx, qword [rbx]
jmp 0x14003327b
mov rcx, rbx
lea r8d, [rax + 1]
lea rdx, [rbp + 0x490]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov r14d, 7
test eax, eax
jne 0x1400332e3
mov qword [rbp + 0x160], r14
mov qword [rbp + 0x158], r12
mov word [rbp + 0x148], r12w
lea r8d, [r14 + 0xa]
lea rdx, str.GetVolumePathName
lea rcx, [rbp + 0x140]
call fcn.1400053ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea rdx, [rbp + 0x140]
call fcn.140012d24
lea rax, [rbp + 0x490]
or r15, 0xffffffffffffffff
mov rsi, r15
inc rsi
cmp word [rax + rsi*2], r12w
jne 0x1400332f1
test rsi, rsi
je 0x140033a60
cmp rsi, qword [rdi + 0x18]
ja 0x140033a0b
cmp qword [rdi + 0x20], 8
jb 0x140033318
mov rbx, qword [rbx]
mov r8, rsi
lea rdx, [rbp + 0x490]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x140033a0b
mov qword [rbp + 0x1d8], r14
mov qword [rbp + 0x1d0], r12
mov word [rbp + 0x1c0], r12w
lea rax, [rbp + 0x490]
mov r8, r15
inc r8
cmp word [rax + r8*2], r12w
jne 0x140033353
lea rdx, [rbp + 0x490]
lea rcx, [rbp + 0x1b8]
call fcn.1400053ec
nop
lea rcx, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 8
cmovae rcx, qword [rbp + 0x1c0]
mov r15d, 0x5c
mov rax, qword [rbp + 0x1d0]
cmp word [rcx + rax*2 - 2], r15w
je 0x1400333b0
mov r8d, r15d
lea edx, [r15 - 0x5b]
lea rcx, [rbp + 0x1b8]
call fcn.140017214
mov r8d, 0x104
lea rdx, [rbp + 0x6a0]
lea rcx, [rbp + 0x490]
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
mov ebx, eax
mov qword [rbp + 0x160], r14
mov qword [rbp + 0x158], r12
mov word [rbp + 0x148], r12w
mov r8d, 0x20
lea rdx, str.GetVolumeNameForVolumeMountPoint
lea rcx, [rbp + 0x140]
call fcn.1400053ec
lea rdx, [rbp + 0x140]
mov ecx, ebx
call fcn.140012d24
mov qword [rsp + 0x28], r12
mov rcx, qword [r13 + 8]
test rcx, rcx
jne 0x14003341e
mov ebx, 0x80004005
jmp 0x140033439
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
lea rdx, [rbp + 0x6a0]
mov rax, qword [rax + 0x48]
call qword [case.0x140010c4b.0]
mov ebx, eax
mov qword [rbp + 0x160], r14
mov qword [rbp + 0x158], r12
mov word [rbp + 0x148], r12w
mov r8d, 0x15
lea rdx, str.GetSnapshotDeviceName
lea rcx, [rbp + 0x140]
call fcn.1400053ec
lea rdx, [rbp + 0x140]
mov ecx, ebx
call fcn.140012d24
mov qword [rbp + 0x188], r14
mov qword [rbp + 0x180], r12
mov word [rbp + 0x170], r12w
mov rdx, qword [rsp + 0x28]
or rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rdx + r8*2], r12w
jne 0x140033498
lea rcx, [rbp + 0x168]
call fcn.1400053ec
nop
lea rcx, [rbp + 0x170]
cmp qword [rbp + 0x188], 8
cmovae rcx, qword [rbp + 0x170]
mov rax, qword [rbp + 0x180]
cmp word [rcx + rax*2 - 2], r15w
je 0x1400334e9
mov r8d, r15d
mov edx, 1
lea rcx, [rbp + 0x168]
call fcn.140017214
mov qword [rbp + 0x160], r14
mov qword [rbp + 0x158], r12
mov word [rbp + 0x148], r12w
mov r9, rbx
mov r8, rsi
mov rdx, rdi
lea rcx, [rbp + 0x140]
call fcn.140005514
nop
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x168]
call fcn.140008d3c
nop
cmp qword [rbp + 0x160], 8
jb 0x140033545
mov rcx, qword [rbp + 0x148]
call fcn.1400110f8
lea rcx, [rbp + 0x170]
cmp qword [rbp + 0x188], 8
cmovae rcx, qword [rbp + 0x170]
mov rax, qword [rbp + 0x180]
cmp word [rcx + rax*2 - 2], r15w
je 0x14003357f
mov r8d, r15d
mov edx, 1
lea rcx, [rbp + 0x168]
call fcn.140017214
lea r8, [rdi + 0x28]
lea rdx, [rbp + 0x168]
lea rcx, [rbp + 0x190]
call fcn.140008f2c
nop
lea rcx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 8
cmovae rcx, qword [rbp + 0x198]
mov r8d, 0x104
lea rdx, [rbp + 0x8b0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x140033612
mov qword [rbp + 0x160], r14
mov qword [rbp + 0x158], r12
mov word [rbp + 0x148], r12w
lea r8d, [rax + 0x18]
lea rdx, str.ExpandEnvironmentStrings
lea rcx, [rbp + 0x140]
call fcn.1400053ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea rdx, [rbp + 0x140]
call fcn.140012d24
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x8b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
mov esi, r12d
cmp rax, rbx
je 0x140033994
lea r8, [rbp + 0x26c]
lea rdx, [rbp + 0x168]
lea rcx, [rbp + 0x140]
call fcn.140008e60
nop
mov r9, rbx
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.140005514
nop
cmp qword [rbp + 0x160], 8
jb 0x14003367c
mov rcx, qword [rbp + 0x148]
call fcn.1400110f8
movzx eax, word [rbp + 0x26e]
cmp word [rbp + 0x26c], 0x2e
jne 0x1400336b4
test ax, ax
je 0x14003396b
cmp word [rbp + 0x26c], 0x2e
jne 0x1400336b4
cmp ax, 0x2e
jne 0x1400336b4
cmp word [rbp + 0x270], r12w
je 0x14003396b
test byte [rbp + 0x240], 0x10
je 0x140033803
cmp byte [rdi + 0x50], r12b
je 0x140033803
mov ebx, 7
mov qword [rbp + 0x160], rbx
mov qword [rbp + 0x158], r12
mov word [rbp + 0x148], r12w
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x140]
call fcn.140005514
nop
lea rcx, [rbp + 0x148]
cmp qword [rbp + 0x160], 8
cmovae rcx, qword [rbp + 0x148]
mov rax, qword [rbp + 0x158]
lea edx, [rbx + 0x55]
cmp word [rcx + rax*2 - 2], dx
je 0x140033737
mov r8d, edx
lea edx, [rbx - 6]
lea rcx, [rbp + 0x140]
call fcn.140017214
lea rax, [rbp + 0x26c]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r12w
jne 0x140033742
lea rdx, [rbp + 0x26c]
lea rcx, [rbp + 0x140]
call fcn.140009010
mov r9b, byte [rdi + 0x50]
lea r8, [rdi + 0x28]
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x1e0]
call fcn.1400159e8
nop
lea rdx, [rbp + 0x1e0]
mov rcx, r13
call fcn.1400331f0
add esi, eax
cmp qword [rbp + 0x228], 8
jb 0x1400337a2
mov rcx, qword [rbp + 0x210]
call fcn.1400110f8
mov qword [rbp + 0x228], rbx
mov qword [rbp + 0x220], r12
mov word [rbp + 0x210], r12w
cmp qword [rbp + 0x200], 8
jb 0x1400337ce
mov rcx, qword [rbp + 0x1e8]
call fcn.1400110f8
mov qword [rbp + 0x200], rbx
mov qword [rbp + 0x1f8], r12
mov word [rbp + 0x1e8], r12w
cmp qword [rbp + 0x160], 8
jb 0x14003396b
mov rcx, qword [rbp + 0x148]
call fcn.1400110f8
jmp 0x14003396b
mov ebx, 3
lea r8d, [rbx - 2]
mov edx, ebx
lea rcx, [rbp + 0x40]
call fcn.14000b65c
nop
lea rdx, str.deleting_file
lea rcx, [rbp + 0x50]
call fcn.14000aa8c
mov rcx, rax
lea rdx, [rbp + 0x190]
call fcn.14000acc0
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x58]
call fcn.14001097c
nop
lea edx, [rbx - 1]
lea rcx, [rbp + 0x140]
call fcn.140013160
nop
cmp qword [rbp + 0x160], 8
jb 0x14003386e
mov rcx, qword [rbp + 0x148]
call fcn.1400110f8
lea rcx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 8
cmovae rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140033941
lea r8d, [rax + 1]
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.14000b65c
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.failed_to_delete_file
lea rcx, [rsp + 0x50]
call fcn.14000aa8c
mov rcx, rax
lea rdx, [rbp + 0x190]
call fcn.14000acc0
mov rcx, rax
lea rdx, str._The_error_was:
call fcn.14000aa8c
mov rcx, rax
mov edx, ebx
call fcn.140020594
lea rdx, [rbp + 0x140]
lea rcx, [rsp + 0x58]
call fcn.14001097c
nop
mov edx, 2
lea rcx, [rbp + 0x140]
call fcn.140013160
nop
cmp qword [rbp + 0x160], 8
jb 0x140033920
mov rcx, qword [rbp + 0x148]
call fcn.1400110f8
nop
lea rcx, [rbp - 0x28]
call fcn.14000c1e4
nop
lea rax, [0x1400422a0]
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x28]
call fcn.140011e54
nop
jmp 0x140033943
inc esi
lea rcx, [rbp + 0xd8]
call fcn.14000c1e4
nop
lea rax, [0x1400422a0]
mov qword [rbp + 0xd8], rax
lea rcx, [rbp + 0xd8]
call fcn.140011e54
nop
lea rdx, [rbp + 0x240]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov rbx, 0xffffffffffffffff
jne 0x140033635
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
nop
cmp qword [rbp + 0x1b0], 8
jb 0x1400339aa
mov rcx, qword [rbp + 0x198]
call fcn.1400110f8
mov ebx, 7
mov qword [rbp + 0x1b0], rbx
mov qword [rbp + 0x1a8], r12
mov word [rbp + 0x198], r12w
cmp qword [rbp + 0x188], 8
jb 0x1400339db
mov rcx, qword [rbp + 0x170]
call fcn.1400110f8
mov qword [rbp + 0x188], rbx
mov qword [rbp + 0x180], r12
mov word [rbp + 0x170], r12w
cmp qword [rbp + 0x1d8], 8
jb 0x140033a07
mov rcx, qword [rbp + 0x1c0]
call fcn.1400110f8
mov eax, esi
jmp 0x140033a62
mov qword [rbp + 0x160], r14
mov qword [rbp + 0x158], r12
mov word [rbp + 0x148], r12w
mov r8d, AtlComPtrAssign
lea rdx, str.not_a_prefix__so_skipping
lea rcx, [rbp + 0x140]
call fcn.1400053ec
nop
xor edx, edx
lea rcx, [rbp + 0x140]
call fcn.140013160
nop
cmp qword [rbp + 0x160], 8
jb 0x140033a60
mov rcx, qword [rbp + 0x148]
call fcn.1400110f8
xor eax, eax
mov rcx, qword [rbp + 0xac0]
xor rcx, rsp
call fcn.140012560
mov rbx, qword [rsp + 0xc20]
add rsp, 0xbd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret