Function at 0x10001de9c
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x2b0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rax, qword [0x1000a9120]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
lea rax, [0x10000bc08]
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], 0x6e6b6e75
mov dword [rcx + 0x14], 1
lock add dword [0x1000aad90], 1
lea rax, [0x100008100]
mov qword [rcx], rax
lea rax, [0x100008148]
mov qword [rcx + 8], rax
mov eax, 0x67727473
mov dword [rcx + 0x18], eax
lea rcx, [0x1000aad94]
mov qword [rdi + 0x20], rcx
mov dword [rdi + 0x28], eax
mov qword [rdi + 0x30], rcx
xor r13d, r13d
mov dword [rdi + 0x38], r13d
mov dword [rdi + 0x40], 0x74736c74
lea rax, [rdi + 0x48]
lea rdx, [0x10000d448]
mov qword [rax], rdx
mov ecx, 0x6b6e6c74
mov dword [rax + 8], ecx
mov qword [rax + 0x10], rax
mov qword [rax + 0x18], rax
mov dword [rdi + 0x68], 0x74736c74
lea rax, [rdi + 0x70]
mov qword [rax], rdx
mov dword [rax + 8], ecx
mov qword [rax + 0x10], rax
mov qword [rax + 0x18], rax
lea rcx, [rdi + 0x90]
xor edx, edx
call fcn.100055470
nop
mov qword [rdi + 0xd0], rbx
cmp rbx, r13
je 0x10001df8f
lock add dword [rbx + 0xc], 1
mov qword [rdi + 0xd8], r13
mov dword [rdi + 0xe0], r13d
mov dword [rdi + 0xe4], 0x7530
mov byte [rdi + 0xe8], r13b
mov dword [rdi + 0xec], 1
mov dword [rdi + 0xf0], 0x74736c74
lea rax, [rdi + 0xf8]
lea rcx, [0x10000d448]
mov qword [rax], rcx
mov dword [rax + 8], 0x6b6e6c74
mov qword [rax + 0x10], rax
mov qword [rax + 0x18], rax
mov byte [rdi + 0x118], 1
mov ecx, dword [rdi + 0xc8]
cmp ecx, r13d
jge 0x10001e004
xor r8d, r8d
lea rdx, [0x100007290]
call fcn.100054a08
int3
cmp word [rsi], r13w
je 0x10001e03b
lea r9, [0x1000a9be8]
mov r8, rsi
lea rdx, [0x100007850]
lea rcx, [rdi + 0x18]
call fcn.10005533c
cmp eax, r13d
jge 0x10001e062
xor r8d, r8d
lea rdx, [0x100007290]
mov ecx, eax
call fcn.100054a08
int3
lea rdx, [0x1000a9be8]
lea rcx, [rdi + 0x18]
call fcn.1000551d0
cmp eax, r13d
jge 0x10001e062
xor r8d, r8d
lea rdx, [0x100007290]
mov ecx, eax
call fcn.100054a08
int3
cmp word [str..TMP], 0x2e
jne 0x10001e093
lea rdx, str..TMP
lea rcx, [rdi + 0x28]
call fcn.1000551d0
cmp eax, r13d
jge 0x10001e0c1
xor r8d, r8d
lea rdx, [0x100007290]
mov ecx, eax
call fcn.100054a08
int3
lea r8, str..TMP
lea rdx, [0x100008060]
lea rcx, [rdi + 0x28]
call fcn.10005533c
cmp eax, r13d
jge 0x10001e0c1
xor r8d, r8d
lea rdx, [0x100007290]
mov ecx, eax
call fcn.100054a08
int3
mov dword [rsp + 0x38], 0x67727473
lea rax, [0x1000aad94]
mov qword [rsp + 0x40], rax
mov r9, qword [rdi + 0x30]
mov r8, qword [rdi + 0x20]
lea rdx, [0x1000080f0]
lea rcx, [rsp + 0x38]
call fcn.10005533c
cmp eax, r13d
jge 0x10001e105
xor r8d, r8d
lea rdx, [0x100007290]
mov ecx, eax
call fcn.100054a08
int3
or rsi, 0xffffffffffffffff
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rsi
cmp rax, r13
cmovne rbx, rax
mov qword [rsp + 0x20], rbx
cmp rbx, rsi
je 0x10001e155
cmp rbx, r13
je 0x10001e155
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r13d
jne 0x10001e137
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp rbx, r13
jne 0x10001e165
cmp eax, 2
jne 0x10001e174
cmp rbx, rsi
je 0x10001e193
cmp rbx, r13
je 0x10001e193
cmp eax, 0x12
je 0x10001e193
movzx ecx, ax
or ecx, 0x80070000
cmp eax, r13d
cmovle ecx, eax
xor r8d, r8d
lea rdx, [0x100007290]
call fcn.100054a08
nop
cmp rbx, rsi
je 0x10001e1a6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x38]
call fcn.1000551a0
nop
mov rax, rdi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.100057810
mov rbx, qword [rsp + 0x2e8]
add rsp, 0x2b0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret