Function at 0x140001580
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x140010040]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov r12, rcx
mov rsi, qword [rcx + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 2
jb 0x140001c2c
mov r15, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x1400015e8
mov r15, qword [r12]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea r14, [rsi + 2]
mov ebx, 0xf
lea rdi, [rsp + 0x30]
movabs rax, 0x8000000000000000
mov edx, 0x16
cmp r14, rbx
jbe 0x140001686
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000164d
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.140009d00
test rax, rax
je 0x1400016fb
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001681
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140001661
xor edi, edi
jmp 0x140001681
cmp rcx, 0x1000
jb 0x140001679
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001c20
jmp 0x14000162e
call fcn.140009d00
mov rdi, rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rdi + rsi], 0x2a5c
mov byte [rdi + r14], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r13, rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001707
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001702
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001702
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d3c
movdqa xmm0, xmmword [0x14000ca20]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
cmp r13, 0xffffffffffffffff
je 0x140001bce
xor r14d, r14d
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], r14
lea rax, [rbp + 0xc]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001750
movabs r15, 0x7fffffffffffffff
cmp rbx, r15
ja 0x140001c26
cmp rbx, 0xf
ja 0x140001799
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], 0xf
mov r8, rbx
lea rdx, [rbp + 0xc]
lea rcx, [rsp + 0x78]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x78], 0
jmp 0x140001830
mov rdi, rbx
or rdi, 0xf
cmp rdi, r15
jbe 0x1400017b8
mov rdi, r15
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400017e9
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x1400017d3
mov rsi, r14
jmp 0x140001810
cmp rcx, 0x1000
jb 0x140001808
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001c32
mov rcx, rax
call fcn.140009d00
test rax, rax
je 0x140001c13
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001810
call fcn.140009d00
mov rsi, rax
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], rdi
mov r8, rbx
lea rdx, [rbp + 0xc]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rbp - 0x70]
cmp rax, 0xf
cmova rdx, rcx
mov r8, qword [rbp - 0x78]
cmp r8, 1
jne 0x140001859
cmp byte [rdx], 0x2e
je 0x140001b80
lea rdx, [rsp + 0x78]
cmp rax, 0xf
cmova rdx, rcx
cmp r8, 2
jne 0x140001877
cmp word [rdx], 0x2e2e
je 0x140001b80
mov rsi, qword [r12 + 0x10]
mov rax, r15
sub rax, rsi
cmp rax, 1
jb 0x140001c1a
mov r15, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x14000189b
mov r15, qword [r12]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
lea r14, [rsi + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x50]
cmp r14, rbx
jbe 0x140001949
mov rbx, r14
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x1400018ed
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14000191d
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140001907
xor edi, edi
jmp 0x140001944
cmp rcx, 0x1000
jb 0x14000193c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001c38
mov rcx, rax
call fcn.140009d00
test rax, rax
je 0x140001bfe
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001944
call fcn.140009d00
mov rdi, rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0x5c
mov byte [rdi + r14], 0
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
lea rcx, [rsp + 0x50]
call fcn.140002590
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xor r14d, r14d
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400019f5
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c05
call fcn.140009d3c
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
test byte [rbp - 0x20], 7
je 0x140001b2c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x48]
call fcn.140001e60
nop
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova rcx, qword [rsp + 0x78]
mov rdx, qword [rbp - 0x78]
add rdx, rcx
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova rcx, qword [rsp + 0x78]
mov dword [rsp + 0x20], 0x10
lea r9, [rbp - 0x48]
call fcn.140002fe0
movzx ebx, al
lea rcx, [rbp - 0x48]
call fcn.140002510
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140001a96
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rax, rax
je 0x140001a96
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
test bl, bl
je 0x140001b2c
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140001ad0
and eax, 0xfffffff8
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova rcx, qword [rbp - 0x68]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
lea rdx, str.Deleted:
jne 0x140001afd
lea rdx, str.Failed_to_delete:
call fcn.140002720
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
mov r8, qword [rbp - 0x58]
cmova rdx, qword [rbp - 0x68]
mov rcx, rax
call fcn.1400031a0
lea rdx, [0x140002900]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
test byte [rbp - 0x20], 0x10
je 0x140001b3c
lea rcx, [rbp - 0x68]
call fcn.140001580
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140001b77
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c0c
call fcn.140009d3c
mov rcx, qword [rsp + 0x78]
mov rax, qword [rbp - 0x70]
cmp rax, 0xf
jbe 0x140001bb0
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001bab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c13
call fcn.140009d3c
lea rdx, [rbp - 0x20]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140001730
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140009ce0
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400011b0
nop
call fcn.140001110
int3
call fcn.1400011b0
int3
call fcn.1400011b0
int3
call fcn.140001110
nop
call fcn.140001110
int3