Function at 0x140001520
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x6a0
mov rax, qword [0x140033018]
xor rax, rsp
mov qword [rsp + 0x690], rax
xor ecx, ecx
lea rdi, str.C:TqAgent_
nop dword [rax + rax]
movzx eax, word [rcx + rdi]
mov word [rsp + rcx + 0x480], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140001550
lea rcx, [rsp + 0x480]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140001571
mov eax, dword [0x14002c950]
mov dword [rcx], eax
movzx eax, word [0x14002c954]
mov word [rcx + 4], ax
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx + rdi]
mov word [rsp + rcx + 0x270], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400015a0
lea rcx, [rsp + 0x270]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400015c1
mov eax, dword [0x14002c958]
lea rdx, [rsp + 0x20]
mov dword [rcx], eax
lea rcx, [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001795
xor ecx, ecx
nop word [rax + rax]
movzx eax, word [rsp + rcx + 0x270]
mov word [rsp + rcx + 0x480], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140001600
nop dword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14000171e
movzx ecx, word [rsp + 0x4c]
movzx eax, word [rsp + 0x4e]
cmp cx, 0x2e
jne 0x14000165d
test ax, ax
je 0x140001620
cmp cx, cx
jne 0x14000165d
cmp ax, cx
jne 0x14000165d
cmp word [rsp + 0x50], 0
je 0x140001620
lea rax, [rsp + 0x270]
sub rax, 2
nop dword [rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140001670
lea r8, [rsp + 0x4c]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [r8 + rdx*2]
mov word [rax + rdx*2], cx
lea rdx, [rdx + 1]
test cx, cx
jne 0x140001690
test byte [rsp + 0x20], 0x10
lea rcx, [rsp + 0x270]
je 0x1400016ee
call fcn.1400010f0
test eax, eax
je 0x14000178c
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor ecx, ecx
nop
movzx eax, word [rsp + rcx + 0x480]
mov word [rsp + rcx + 0x270], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400016d0
jmp 0x140001620
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14000178c
xor ecx, ecx
nop
movzx eax, word [rsp + rcx + 0x480]
mov word [rsp + rcx + 0x270], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140001700
jmp 0x140001620
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x14000178c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x140001795
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x14000179a
lea rcx, str.C:WindowsSystem32driversTqNet.sys
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0xffffffed
jne 0x14000179a
cmp eax, 0x10
je 0x14000179a
lea rcx, str.C:WindowsSystem32driversTqProc.sys
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0xffffffed
jne 0x14000179a
cmp eax, 0x10
je 0x14000179a
xor eax, eax
jmp 0x14000179a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 5
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.1400086b0
mov rbx, qword [rsp + 0x6b0]
add rsp, 0x6a0
pop rdi
ret