Function at 0x14001f670
Capabilities:
Check for time delay via gettickcount
Enumerate files on windows
Enumerate files recursively
Get file system object information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x760]
sub rsp, 0x860
mov rax, qword [0x1402cf910]
xor rax, rsp
mov qword [rbp + 0x750], rax
mov r13, r8
mov qword [rsp + 0x70], r8
mov r14, rdx
mov qword [rbp - 0x68], rdx
mov rbx, rcx
xor r15d, r15d
mov dword [rsp + 0x50], r15d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x2b8], xmm0
movups xmmword [rbp + 0x2c8], xmm0
movups xmmword [rbp + 0x2d8], xmm0
mov qword [rbp + 0x2e8], rax
lea rcx, [rbp + 0x2b8]
call fcn.140073910
nop
call fcn.14006e454
mov rcx, rax
test rax, rax
je 0x140020048
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x270], rax
lea r12, [r15 - 1]
test rbx, rbx
je 0x14001f73c
cmp rbx, 0x10000
jae 0x14001f72d
movzx edx, bx
lea rcx, [rbp + 0x270]
call fcn.140003220
jmp 0x14001f752
mov rax, r12
inc rax
cmp word [rbx + rax*2], 0
jne 0x14001f730
jmp 0x14001f73f
mov eax, r15d
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x270]
call fcn.140003400
nop
call fcn.14006e454
mov rcx, rax
test rax, rax
je 0x140020053
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x278], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x290], xmm0
movups xmmword [rbp + 0x2a0], xmm0
mov qword [rbp + 0x2b0], rax
lea rcx, [rbp + 0x290]
call fcn.1400744b0
lea rax, vtable.CSortStringArray.0
mov qword [rbp + 0x290], rax
mov qword [rbp + 0x288], r15
call fcn.14006e454
mov rcx, rax
test rax, rax
je 0x14002005e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x288], rax
lea rdi, [r13 + 0x50d8]
mov rax, qword [rdi + 0x220]
mov qword [rbp - 0x70], rax
lea rsi, [rax + 0xe8]
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x68], r14
cmp r14, 0xffffffffffff0000
jne 0x14001f86c
mov rcx, rbx
call fcn.14001f080
mov eax, dword [0x1402de170]
mov qword [rsp + 0x48], 0xffffffffffff0002
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], eax
mov r9d, dword [0x1402de174]
mov r8, rbx
mov edx, 0x23
mov rcx, rsi
call fcn.140072f50
mov qword [rsp + 0x68], rax
mov rcx, qword [0x1402de168]
test rcx, rcx
je 0x14001f85a
call qword [sym.imp.USER32.dll_DestroyIcon]
mov rcx, qword [0x1402de160]
test rcx, rcx
je 0x14001f86c
call qword [sym.imp.USER32.dll_DestroyIcon]
mov r8, rbx
mov edx, 0x104
mov rcx, rdi
call fcn.1401fa754
mov r8d, 1
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x270]
call fcn.140021120
mov rcx, qword [rax]
cmp word [rcx], 0x5c
jne 0x14001f8a7
cmp word [rcx + 2], 0
jne 0x14001f8a7
mov ebx, r15d
jmp 0x14001f8ac
sbb ebx, ebx
or ebx, 1
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001f8ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
je 0x14001f8fa
lea rdx, [0x140286c78]
mov rax, r12
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14001f8e0
mov r8d, eax
lea rcx, [rbp + 0x270]
call fcn.14000cac0
nop
mov qword [rsp + 0x60], r15
mov rbx, qword [rbp + 0x270]
lea rax, [rbx - 0x18]
mov qword [rbp - 0x60], rax
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x14001f925
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14001f93f
call fcn.14006e454
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x140020069
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x50], 2
lea r9, [0x140286bc0]
mov rax, r12
inc rax
cmp word [r9 + rax*2], 0
jne 0x14001f960
mov dword [rsp + 0x20], eax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14000c820
mov rdx, qword [rsp + 0x60]
lea rbx, [rdx - 0x18]
mov rsi, qword [rbp + 0x278]
add rsi, 0xffffffffffffffe8
cmp rbx, rsi
je 0x14001f9e9
cmp dword [rsi + 0x10], 0
jl 0x14001f9d9
mov rax, qword [rsi]
cmp qword [rbx], rax
jne 0x14001f9d9
mov rcx, rbx
call fcn.14000cbe0
mov r14, rax
mov ecx, r12d
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x14001f9cc
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r14 + 0x18]
mov qword [rbp + 0x278], rax
jmp 0x14001f9e9
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0x278]
call fcn.140003400
mov dword [rsp + 0x50], r15d
mov eax, r12d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x14001fa07
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r14, r15
mov qword [rsp + 0x58], r15
lea rdx, [rbp + 0x2f0]
mov rcx, qword [rbp + 0x278]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14001fb1e
mov rbx, qword [rbp + 0x270]
test byte [rbp + 0x2f0], 0x10
je 0x14001faac
movzx ecx, word [rbp + 0x31c]
movzx eax, word [rbp + 0x31e]
cmp cx, 0x2e
jne 0x14001fa6d
test ax, ax
je 0x14001faac
cmp cx, cx
jne 0x14001fa6d
cmp ax, cx
jne 0x14001fa6d
cmp word [rbp + 0x320], 0
je 0x14001faac
lea r9, [rbp + 0x31c]
mov r8, rbx
lea rdx, [0x140286c20]
lea rcx, [rbp + 0x288]
call fcn.1400039a0
inc dword [rdi + 0x20c]
lea r8, [rbp + 0x288]
mov rdx, qword [rbp + 0x2a0]
lea rcx, [rbp + 0x290]
call fcn.14007472c
jmp 0x14001fb01
mov ecx, dword [rbp + 0x30c]
shl rcx, 0x20
mov eax, dword [rbp + 0x310]
add rcx, rax
add r14, rcx
add qword [rdi + 0x230], rcx
inc dword [rdi + 0x208]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1402de158]
cmp eax, 0x64
jbe 0x14001fb01
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1402de158], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40f
mov rcx, qword [r13 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, [rbp + 0x2f0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001fa37
mov qword [rsp + 0x58], r14
mov rcx, qword [rbp + 0x2a0]
lea rdx, [rcx - 1]
nop dword [rax]
mov edi, r15d
mov ebx, r15d
test rdx, rdx
jle 0x14001fb69
nop dword [rax + rax]
mov edx, ebx
lea rcx, [rbp + 0x290]
call fcn.14001eb80
or edi, eax
inc ebx
mov rcx, qword [rbp + 0x2a0]
lea rdx, [rcx - 1]
movsxd rax, ebx
cmp rax, rdx
jl 0x14001fb40
test edi, edi
jne 0x14001fb30
mov r13d, r15d
test rcx, rcx
jle 0x14001feb7
mov r14, r15
nop dword [rax + rax]
mov rax, qword [rsp + 0x70]
cmp dword [rax + 0x20], 3
je 0x14001fe9d
test r14, r14
js 0x140020042
cmp r14, rcx
jge 0x140020042
mov rax, qword [rbp + 0x298]
mov rcx, qword [rax + r14*8]
sub rcx, 0x18
call fcn.14000cbe0
lea rdi, [rax + 0x18]
mov qword [rbp + 0x280], rdi
cmp dword [rax + 8], 0x104
jl 0x14001fd35
mov rcx, qword [rax]
test rcx, rcx
je 0x14001fbe3
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14001fbfd
call fcn.14006e454
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x140020085
mov rax, qword [rcx]
mov edx, 0x103
mov r8d, 2
call qword [rax]
mov r8, rax
test rax, rax
je 0x14002007f
lea rbx, [rax + 0x18]
mov qword [rbp - 0x78], rbx
cmp dword [rbx - 0xc], 0x103
jl 0x140020074
mov dword [rbx - 0x10], 0x103
mov word [rbx + 0x206], r15w
mov rcx, rbx
mov rdx, rdi
mov eax, 4
nop dword [rax + rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x14001fc50
mov eax, dword [rdx]
mov dword [rcx], eax
movzx eax, word [rdx + 4]
mov word [rcx + 4], ax
or dword [rsp + 0x50], 1
add rdi, 0xffffffffffffffe8
cmp r8, rdi
je 0x14001fd14
cmp dword [rdi + 0x10], 0
jl 0x14001fd00
mov rax, qword [rdi]
cmp qword [r8], rax
jne 0x14001fd00
mov rcx, r8
call fcn.14000cbe0
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x14001fcef
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rbp + 0x280], rax
mov rbx, qword [rbp - 0x78]
jmp 0x14001fd14
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp + 0x280]
call fcn.140003400
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001fd2e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rbp + 0x280]
mov r8, rdi
mov edx, 0x104
lea rcx, [rbp + 0x540]
call fcn.1401fa754
mov qword [0x1402de160], r15
mov qword [0x1402de168], r15
mov dword [rsp + 0x20], 0x101
mov r9d, 0x2b8
lea r8, [rbp - 0x50]
xor edx, edx
lea rcx, [rbp + 0x540]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x14001fd91
mov eax, dword [rbp - 0x48]
mov dword [0x1402de174], eax
mov rax, qword [rbp - 0x50]
mov qword [0x1402de168], rax
mov dword [rsp + 0x20], 0x103
mov r9d, 0x2b8
lea r8, [rbp - 0x50]
xor edx, edx
lea rcx, [rbp + 0x540]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x14001fdcd
mov esi, dword [rbp - 0x48]
mov dword [0x1402de170], esi
mov rax, qword [rbp - 0x50]
mov qword [0x1402de160], rax
jmp 0x14001fdd3
mov esi, dword [0x1402de170]
mov ebx, dword [0x1402de174]
lea rcx, [rbp + 0x540]
call fcn.14001f1a0
mov qword [rsp + 0x48], 0xffffffffffff0002
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], esi
mov r9d, ebx
mov r8, rax
mov edx, 0x23
mov rsi, qword [rsp + 0x78]
mov rcx, rsi
call fcn.140072f50
mov rbx, rax
mov rcx, qword [0x1402de168]
test rcx, rcx
je 0x14001fe38
call qword [sym.imp.USER32.dll_DestroyIcon]
mov rcx, qword [0x1402de160]
test rcx, rcx
je 0x14001fe4a
call qword [sym.imp.USER32.dll_DestroyIcon]
mov r8, qword [rsp + 0x70]
mov rdx, rbx
lea rcx, [rbp + 0x540]
call fcn.14001f670
add qword [rsp + 0x58], rax
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001fe7d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc r13d
inc r14
movsxd rax, r13d
mov rcx, qword [rbp + 0x2a0]
cmp rax, rcx
jl 0x14001fb80
mov r14, qword [rsp + 0x58]
jmp 0x14001febc
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40f
mov rcx, qword [rax + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14001ff9a
mov rsi, qword [rsp + 0x78]
mov rdx, r14
lea rcx, [rbp + 0x540]
call fcn.14001f510
lea r9, [rbp + 0x540]
mov rbx, qword [rsp + 0x68]
mov rdx, rbx
mov rcx, qword [rbp - 0x70]
call fcn.14003ca60
cmp r14, 0x3b9aca00
jg 0x14001ff19
imul rcx, r14, 0x1f
movabs rax, 0x112e0be826d694b3
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
sub dl, 0x20
movzx eax, dl
or rax, 0xe0ff00
jmp 0x14001ff4a
mov rax, r14
shl rax, 5
cqo
movabs rcx, 0x174876e800
idiv rcx
mov ecx, 0x1f
cmp rax, rcx
cmovg rax, rcx
not al
movzx eax, al
shl rax, 8
or rax, 0xe000ff
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8d, [r9 + 4]
mov rdx, rbx
mov rcx, rsi
call fcn.140073284
cmp qword [rbp - 0x68], 0xffffffffffff0000
jne 0x14001ff97
mov r9, rbx
mov edx, 0x1102
mov r8d, 2
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r15, r14
mov rdx, qword [rbp + 0x288]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001ffbc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp + 0x290]
call fcn.1400744d0
nop
mov rdx, qword [rbp + 0x278]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001ffeb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rbp - 0x60]
lock xadd dword [rax + 0x10], r12d
sub r12d, 1
jg 0x140020009
mov rcx, qword [rax]
mov r8, qword [rcx]
mov rdx, rax
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
lea rcx, [rbp + 0x2b8]
call fcn.140073a50
mov rax, r15
mov rcx, qword [rbp + 0x750]
xor rcx, rsp
call fcn.1401ee030
mov rbx, qword [rsp + 0x8b8]
add rsp, 0x860
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14006ddb8
nop
mov ecx, 0x80004005
call fcn.1400037e0
nop
mov ecx, 0x80004005
call fcn.1400037e0
nop
mov ecx, 0x80004005
call fcn.1400037e0
nop
mov ecx, 0x80004005
call fcn.1400037e0
nop
mov ecx, 0x80070057
call fcn.1400037e0
int3
call fcn.140003720
int3
mov ecx, 0x80004005
call fcn.1400037e0
int3