Function at 0x18005d740
Capabilities:
Enumerate files on windows
Set file attributes
Timestomp file

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x22c0
call fcn.1800d50b0
sub rsp, rax
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x22f8], rbx
mov qword [rsp + 0x2300], rbp
mov qword [rsp + 0x2308], rsi
mov rax, qword [0x18010e350]
xor rax, rsp
mov qword [rsp + 0x22b0], rax
mov byte [rsp + 0x41], r8b
mov byte [rsp + 0x40], dl
mov rbp, rcx
test dl, dl
je 0x18005d7a8
lea r13, [rcx + 0x6a6]
mov qword [rsp + 0x50], r13
jmp 0x18005d7b4
lea r13, [rcx + 0x8c]
mov qword [rsp + 0x50], r13
mov word [rsp + 0x1a80], 0
xor edx, edx
mov r8d, 0x820
lea rcx, [rsp + 0x1a82]
call fcn.180086e90
mov r9, qword [str..cdf]
mov r8, r13
lea rdx, [0x1800d8790]
lea rcx, [rsp + 0x1a80]
call fcn.180089d50
xor r12d, r12d
mov dword [rsp + 0x90], r12d
xor edx, edx
mov r8d, 0x24c
lea rcx, [rsp + 0x94]
call fcn.180086e90
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x1a80]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
mov qword [rsp + 0x70], rax
mov esi, r12d
cmp rax, 0xffffffffffffffff
setne sil
test esi, esi
je 0x18005dbf4
mov word [rsp + 0x1250], 0
xor edx, edx
mov r8d, 0x820
lea rcx, [rsp + 0x1252]
call fcn.180086e90
mov dil, 1
xor eax, eax
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0xa4]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x48], r12d
xor eax, eax
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
xor r11d, r11d
mov dword [rsp + 0x64], r11d
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x64], eax
xor eax, eax
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x94]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0x60]
mov r12, rax
sub r12, qword [rsp + 0x68]
mov r15d, dword [rsp + 0x90]
shr r15d, 1
and r15b, dil
movzx r14d, r11b
je 0x18005d92c
movabs rcx, 0x1792f8648000
cmp r12, rcx
jle 0x18005d904
xor dil, dil
mov r14b, 1
xor eax, eax
jmp 0x18005d932
cmp byte [rsp + 0x41], r11b
jne 0x18005d930
mov rcx, qword [rsp + 0x58]
movabs rdx, 0x861c46800
add rdx, rcx
movzx edi, dil
cmp rax, rdx
mov rax, r11
cmovl edi, eax
jmp 0x18005d932
xor eax, eax
jmp 0x18005d932
xor eax, eax
cmp byte [rbp + 0xf48], r11b
jne 0x18005d942
mov esi, eax
xor dil, dil
jmp 0x18005d947
test dil, dil
jne 0x18005d950
test r14b, r14b
je 0x18005dbc6
lea r9, [rsp + 0xbc]
mov r8, r13
lea rdx, [0x1800d8790]
lea rcx, [rsp + 0x1250]
call fcn.180089d50
lea rdx, [rsp + 0x1250]
mov rcx, rbp
call fcn.180055aa0
mov r13, rax
test rax, rax
je 0x18005dbbc
lea rcx, [rsp + 0x1250]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x18005dbe9
lea rdx, [rbp + 0xd28]
mov r8b, 1
lea rcx, [rsp + 0x2e0]
call fcn.18005d2f0
nop
mov rdx, rbx
lea rcx, [rsp + 0x2e0]
call fcn.18005bdb0
test dil, dil
je 0x18005d9f6
test eax, eax
jne 0x18005d9fe
mov r8, rbx
mov rdx, qword [rbp + 0xf40]
lea rcx, [rsp + 0x2e0]
call qword [rbp + 0xf38]
test eax, eax
je 0x18005db1a
cmp eax, 1
je 0x18005db10
cmp eax, 0x800700a2
jne 0x18005da19
xor r12d, r12d
mov esi, r12d
jmp 0x18005db13
cmp eax, 0x80040301
jne 0x18005da2b
xor r12d, r12d
mov esi, r12d
jmp 0x18005db13
cmp eax, 0x80040302
jne 0x18005da3d
xor r12d, r12d
mov esi, r12d
jmp 0x18005db13
cmp eax, 0x80040303
jne 0x18005da4f
xor r12d, r12d
mov esi, r12d
jmp 0x18005db13
cmp eax, 0x80004004
je 0x18005db0b
test r15b, r15b
je 0x18005da72
movabs rax, 0x58028e44000
cmp r12, rax
jg 0x18005db1f
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r12 + 3]
lea rcx, [rsp + 0x1250]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18005dae7
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsp + 0x90]
or edx, 2
lea rcx, [rsp + 0x1250]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x18005db13
cmp byte [rsp + 0x40], r12b
jne 0x18005db13
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x18005db13
lea rdx, [rsp + 0x1250]
mov rcx, rbp
call fcn.180058720
jmp 0x18005db13
xor r12d, r12d
jmp 0x18005db13
xor r12d, r12d
test r14b, r14b
je 0x18005db77
jmp 0x18005db22
xor r12d, r12d
jmp 0x18005db22
xor r12d, r12d
lea rcx, [rsp + 0x2e0]
call fcn.1800566a0
mov r11d, dword [rsp + 0x90]
bts r11d, 0x1a
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 7]
lea rcx, [rsp + 0x1250]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x18005db77
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dl, 1
lea rcx, [rsp + 0x2e0]
call fcn.18005cde0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x2e0]
call fcn.180055f00
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rbx, qword [rsp + 0x70]
mov r13, qword [rsp + 0x50]
jmp 0x18005dbc9
mov r13, qword [rsp + 0x50]
xor r12d, r12d
jmp 0x18005dbc9
xor r12d, r12d
test esi, esi
je 0x18005dbf4
lea rdx, [rsp + 0x90]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
test eax, eax
je 0x18005dbf4
jmp 0x18005d842
mov ecx, 0x8007000e
call fcn.1800012c4
int3
cmp rbx, 0xffffffffffffffff
je 0x18005dc03
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x22b0]
xor rcx, rsp
call fcn.180086e60
lea r11, [rsp + 0x22c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret