Function at 0x1400594f0
Capabilities:
Check for time delay via gettickcount
Enumerate files on windows
Enumerate files recursively
Timestomp file

Disassembly:
mov qword [rsp + 0x10], rbx
mov word [rsp + 0x20], r9w
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x6b0]
sub rsp, 0x7b0
xor esi, esi
mov rbx, r8
mov rdi, rcx
mov r8, qword [0x14012fa58]
cmp byte [rbp + 0x700], sil
jne 0x140059561
cmp word [rbx], si
jne 0x140059547
mov rax, r8
mov dl, 1
mov dword [rax + 0x40], 0x57
call fcn.140040b90
xor eax, eax
jmp 0x140059aee
mov eax, dword [rbp + 0x6f0]
mov ecx, 1
test eax, eax
mov dword [r8 + 0x40], esi
cmovne ecx, eax
mov dword [rsp + 0x48], ecx
jmp 0x14005956b
mov eax, dword [rbp + 0x6f0]
mov dword [rsp + 0x48], eax
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [rbx + rax*2], si
jne 0x140059570
cmp rax, 0x104
jb 0x14005959a
mov dl, 1
mov dword [r8 + 0x40], WSAStartup
mov rcx, rdi
call fcn.140040b90
xor eax, eax
jmp 0x140059aee
mov r8d, 0x3f
lea rcx, [rbp - 0x40]
call fcn.1400cc9b8
lea rdx, [rbp + 0x4a0]
mov word [rbp + 0x3e], si
sub rdx, rbx
mov rcx, rbx
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400595c0
cmp word [rbp - 0x40], si
je 0x14005962e
xor r8d, r8d
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x40]
call fcn.1400a6050
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x14005960d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
jne 0x140059639
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14012fa58]
mov dl, 1
mov dword [rcx + 0x40], eax
mov rcx, rdi
call fcn.140040b90
xor eax, eax
jmp 0x140059aee
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea rcx, [rbp + 0x290]
sub rcx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x140059650
mov edx, 0x5c
lea rcx, [rbp + 0x290]
call fcn.1400c6d90
test rax, rax
je 0x140059690
mov word [rax + 2], si
lea rcx, [rbp + 0x290]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x140059685
jmp 0x14005969a
mov word [rbp + 0x290], si
mov rax, rsi
lea rdi, [rbp + 0x290]
mov ebx, 0x103
lea rdi, [rdi + rax*2]
sub rbx, rax
mov edx, 0x5c
mov qword [rsp + 0x70], rdi
lea rcx, [rbp + 0x4a0]
mov qword [rsp + 0x60], rbx
call fcn.1400c6d90
test rax, rax
je 0x1400596d3
add rax, 2
jmp 0x1400596da
lea rax, [rbp + 0x4a0]
mov qword [rsp + 0x68], rax
mov r8, rax
test rax, rax
je 0x140059720
movzx edx, word [rax]
test dx, dx
je 0x140059720
nop
lea rcx, [0x140116778]
mov eax, 0x3f
nop dword [rax]
cmp dx, ax
je 0x140059728
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x140059700
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x1400596f0
mov dword [rsp + 0x48], 3
lea rdx, [rbp + 0x40]
mov dword [rsp + 0x40], esi
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword gs:[0x48]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x4c], ecx
cmp rax, 0xffffffffffffffff
je 0x14005995a
movsxd rbx, dword [rsp + 0x48]
mov rdi, rax
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14012fa58]
sub eax, dword [0x14013a19c]
cmp eax, dword [rcx + 0x118]
jbe 0x1400597ca
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
lea rcx, [rbp - 0x70]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1400597b7
mov eax, dword [rsp + 0x4c]
cmp dword [0x140139538], eax
jne 0x1400597b7
mov edx, 1
or ecx, 0xffffffff
call fcn.1400018b0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14012fa58]
mov dword [0x14013a19c], eax
test byte [rbp + 0x40], 0x10
je 0x140059800
cmp word [rbp + 0x6c], 0x2e
jne 0x1400597f5
movzx eax, word [rbp + 0x6e]
test ax, ax
je 0x14005992e
cmp ax, 0x2e
jne 0x1400597f5
cmp word [rbp + 0x70], 0
je 0x14005992e
cmp rbx, 1
jne 0x14005980a
jmp 0x14005992e
cmp rbx, 2
je 0x14005992e
lea rdx, [rbp + 0x6c]
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x140059812
cmp rax, qword [rsp + 0x60]
jbe 0x140059831
mov dword [rcx + 0x40], WSAStartup
inc esi
jmp 0x14005992e
mov rdx, qword [rsp + 0x70]
lea rax, [rbp + 0x6c]
sub rdx, rax
lea rcx, [rbp + 0x6c]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140059850
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x22000000
lea rcx, [rbp + 0x290]
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400598af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14012fa58]
inc esi
mov dword [rcx + 0x40], eax
jmp 0x140059929
movzx ebx, word [rbp + 0x6e8]
test ebx, 0xffffff80
jne 0x1400598d1
mov edx, 2
mov ecx, ebx
call fcn.1400cb124
test eax, eax
je 0x1400598d1
and ebx, 0xffffffdf
movzx eax, bx
mov rcx, rdi
cmp eax, 0x41
je 0x1400598f5
xor r8d, r8d
cmp eax, 0x43
je 0x1400598eb
lea r9, [rsp + 0x50]
jmp 0x1400598fd
xor r9d, r9d
lea rdx, [rsp + 0x50]
jmp 0x1400598ff
xor r9d, r9d
lea r8, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x14005991b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14012fa58]
inc esi
mov dword [rcx + 0x40], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
lea rdx, [rbp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140059765
mov rcx, rdi
mov dword [rsp + 0x40], esi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
movzx esi, byte [rbp + 0x6f8]
test sil, sil
je 0x140059ad1
cmp rbx, 2
jbe 0x140059ad1
movabs rax, 0x2a002e002a
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x290]
mov qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140059ad1
mov rax, qword [rsp + 0x68]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400599b0
nop word [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14012fa58]
sub eax, dword [0x14013a19c]
cmp eax, dword [rcx + 0x118]
jbe 0x140059a1e
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
lea rcx, [rbp - 0x70]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140059a12
mov eax, dword [rsp + 0x4c]
cmp dword [0x140139538], eax
jne 0x140059a12
mov edx, 1
or ecx, 0xffffffff
call fcn.1400018b0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14013a19c], eax
test byte [rbp + 0x40], 0x10
je 0x140059ab3
cmp word [rbp + 0x6c], 0x2e
jne 0x140059a45
movzx eax, word [rbp + 0x6e]
test ax, ax
je 0x140059ab3
cmp ax, 0x2e
jne 0x140059a45
cmp word [rbp + 0x70], 0
je 0x140059ab3
lea rcx, [rbp + 0x6c]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140059a50
add rax, rbx
cmp rax, qword [rsp + 0x60]
jae 0x140059ab3
mov r9, qword [rsp + 0x68]
lea r8, [rbp + 0x6c]
mov rcx, qword [rsp + 0x70]
lea rdx, [0x14010ea88]
call fcn.140004f10
mov eax, dword [rsp + 0x48]
lea r8, [rbp + 0x290]
movzx r9d, word [rbp + 0x6e8]
lea rdx, [rbp - 0x40]
mov rcx, qword [rbp + 0x6d0]
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], sil
mov dword [rsp + 0x20], eax
call fcn.1400594f0
add dword [rsp + 0x40], eax
lea rdx, [rbp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400599c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp + 0x700], 0
mov ebx, dword [rsp + 0x40]
jne 0x140059aec
mov rcx, qword [rbp + 0x6d0]
mov edx, ebx
call fcn.140040c70
mov eax, ebx
mov rbx, qword [rsp + 0x7d8]
add rsp, 0x7b0
pop rdi
pop rsi
pop rbp
ret