Function at 0x140095ee0
Capabilities:
Check for time delay via queryperformancecounter
Enumerate files on windows
Get disk size

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x7a0
movaps xmmword [r11 - 0x38], xmm6
mov rax, qword [0x1400c1008]
xor rax, rsp
mov qword [rsp + 0x780], rax
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
mov rax, qword [rsp + 0x808]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x810]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x818]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x820]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x828]
mov qword [rsp + 0xa8], rax
xor ecx, ecx
mov r12d, ecx
mov qword [r11 - 0x708], rcx
mov r15d, ecx
mov qword [r11 - 0x700], rcx
mov r13d, ecx
mov qword [r11 - 0x748], rcx
mov qword [rsp + 0x38], rcx
mov eax, ecx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x40], ecx
mov qword [r11 - 0x6d8], rcx
mov qword [r11 - 0x6c0], rcx
mov qword [r11 - 0x6c8], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], rcx
mov qword [r11 - 0x6b8], rcx
mov qword [rsp + 0x58], rcx
xor edx, edx
mov r8d, 0x250
lea rcx, [r11 - 0x698]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x3fc
lea rcx, [rsp + 0x380]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov qword [rsp + 0x118], rax
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x120], rax
mov rax, 0xffffffffffffffff
test rbx, rbx
cmovne rax, rbx
mov qword [rsp + 0xd0], rax
mov rcx, 0xffffffffffffffff
mov rax, qword [rsp + 0x7f0]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0xd8], rcx
mov rcx, 0xffffffffffffffff
mov rax, qword [rsp + 0x7f8]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0xe0], rcx
mov ecx, 0xffffffff
mov eax, dword [rsp + 0x800]
test eax, eax
cmovne ecx, eax
mov dword [rsp + 0x44], ecx
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rdi
mov r8d, 0x1fe
lea rdx, [rsp + 0x380]
lea rcx, [rsp + 0x110]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
test eax, eax
jne 0x14009652f
cmp word [rsp + 0x380], ax
je 0x14009652f
lea rcx, [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x140096523
cmp qword [rsp + 0xf8], r13
je 0x140096523
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1400960fa
mov ebx, r13d
mov eax, r13d
jmp 0x140096539
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x100], 0
lea r9, [rsp + 0x100]
lea r8, [rsp + 0x108]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x380]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x140096157
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
jmp 0x140096539
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x38], rax
cmp rax, rsi
ja 0x140096173
mov rbx, qword [rsp + 0x30]
jmp 0x140096539
xor eax, eax
mov qword [rsp + 0x50], rax
xor esi, esi
mov qword [rsp + 0xb0], rsi
mov rcx, qword [rsp + 0x110]
nop dword [rax]
cmp rax, rcx
jae 0x1400961b5
cmp word [rsp + rax*2 + 0x380], 0x5c
jne 0x1400961ab
inc rsi
mov qword [rsp + 0xb0], rsi
inc rax
mov qword [rsp + 0x50], rax
jmp 0x140096190
mov qword [rsp + 0xb8], rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
lea rcx, [rsp + 0x380]
call fcn.1400012e0
cmp eax, 1
jne 0x1400961f1
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
jmp 0x140096539
xor r14d, r14d
mov qword [rsp + 0xe8], r14
xor edi, edi
mov dword [rsp + 0x48], edi
movsd xmm6, qword [0x1400b6f60]
nop word [rax + rax]
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x130]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x3fc
lea rcx, [rsp + 0x380]
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx + r14*8]
mov qword [rsp + 0x20], rax
lea r9, [0x1400ffbe8]
mov edx, 0x1fe
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x380]
call fcn.140001140
movsxd rcx, eax
xor eax, eax
mov qword [rsp + 0x50], rax
xor r13d, r13d
mov qword [rsp + 0x80], r13
nop dword [rax]
cmp rax, rcx
jae 0x1400962a5
cmp word [rsp + rax*2 + 0x380], 0x5c
jne 0x14009629b
inc r13
mov qword [rsp + 0x80], r13
inc rax
mov qword [rsp + 0x50], rax
jmp 0x140096280
cmp r13, rsi
cmova rsi, r13
mov qword [rsp + 0xb8], rsi
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x380]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
mov qword [rsp + 0x30], rax
cmp rax, 0xffffffffffffffff
jne 0x1400962e2
mov rax, qword [rsp + 0x38]
jmp 0x140096539
mov eax, dword [rsp + 0x130]
test eax, 0x11440
jne 0x14009644e
test al, 0x10
je 0x14009638e
mov edx, 0x104
lea rcx, [rsp + 0x15c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rbx, rax
mov r8, rax
lea rdx, [rsp + 0x15c]
lea rcx, [0x1400fe0c4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x1400963be
mov r8, rbx
lea rdx, [rsp + 0x15c]
lea rcx, [0x1400fea9c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x1400963be
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x70]
mov r9, qword [r9 + r14*8]
mov rax, qword [rsp + 0x78]
mov r8, qword [rax + r14*8]
mov rdx, rbx
lea rcx, [rsp + 0x15c]
call fcn.1400012e0
cmp eax, 1
jne 0x1400963be
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
jmp 0x140096539
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x14c]
mov dword [rsp + 0x5c], eax
add r12, qword [rsp + 0x58]
mov qword [rsp + 0xc0], r12
inc r15
mov qword [rsp + 0xc8], r15
jmp 0x1400963c3
mov rbx, qword [rsp + 0x30]
lea rcx, [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1400963e4
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
jmp 0x140096539
mov rax, qword [rsp + 0x118]
sub rax, qword [rsp + 0x120]
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
mulsd xmm1, xmm6
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0xf8]
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x40], eax
cmp r12, qword [rsp + 0xd0]
jae 0x140096443
cmp r15, qword [rsp + 0xd8]
jae 0x140096443
cmp rsi, qword [rsp + 0xe0]
jae 0x140096443
cmp eax, dword [rsp + 0x44]
jb 0x14009644e
mov edi, 1
mov dword [rsp + 0x48], edi
jmp 0x140096489
test edi, edi
jne 0x140096489
lea rdx, [rsp + 0x130]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400962e2
test edi, edi
jne 0x140096489
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x140096489
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
jmp 0x140096539
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
jne 0x1400964a5
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
jmp 0x140096539
xor ebx, ebx
mov qword [rsp + 0x30], rbx
inc r14
mov qword [rsp + 0xe8], r14
test edi, edi
jne 0x1400964c6
cmp r14, qword [rsp + 0x68]
jb 0x140096210
lea rcx, [rsp + 0x68]
call fcn.14008e510
cmp eax, 1
jne 0x1400964dc
mov rax, qword [rsp + 0x38]
jmp 0x140096539
mov rcx, qword [rsp + 0x88]
mov qword [rcx], r12
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x90]
mov qword [rcx], rax
mov rax, qword [rsp + 0x98]
mov qword [rax], r15
mov rax, qword [rsp + 0xa0]
mov qword [rax], r13
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xa8]
mov dword [rcx], eax
xor eax, eax
jmp 0x1400965ae
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
jmp 0x140096539
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
nop
mov rcx, qword [rsp + 0x88]
mov qword [rcx], r12
mov rcx, qword [rsp + 0x90]
mov qword [rcx], rax
mov rax, qword [rsp + 0x98]
mov qword [rax], r15
mov rax, qword [rsp + 0xa0]
mov qword [rax], r13
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xa8]
mov dword [rcx], eax
lea rcx, [rbx - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140096591
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x68]
call fcn.14008e510
mov eax, 1
jmp 0x1400965ae
mov rcx, qword [rsp + 0x780]
xor rcx, rsp
call fcn.140001ea0
lea r11, [rsp + 0x7a0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret