Function at 0x140005bf0
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x678]
sub rsp, 0x750
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14003d040]
xor rax, rsp
mov qword [rbp + 0x630], rax
mov r14, rcx
mov qword [rbp - 0x80], rcx
mov qword [rbp + 0xb0], rcx
xor r15d, r15d
mov r12d, r15d
mov dword [rsp + 0x38], r15d
xorps xmm6, xmm6
movdqa xmmword [rbp + 0xc0], xmm6
lea r8d, [r15 + 2]
mov rdx, rcx
lea rcx, [rbp + 0x160]
call fcn.1400049b0
nop
cmp byte [rbp + 0x3d8], r15b
je 0x140005ccb
lea ecx, [r15 + 0x58]
call fcn.1400155f0
mov rdi, rax
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj2_struct_std::filesystem::_Dir_enum_impl_.0
mov qword [rdi], rax
lea rbx, [rdi + 0x10]
lea rdx, [rbp + 0x160]
mov rcx, rbx
call fcn.140004cb0
nop
lea r12d, [r15 + 0x20]
mov qword [rbp + 0xc0], rbx
mov qword [rbp + 0xc8], rdi
movdqa xmm6, xmmword [rbp + 0xc0]
jmp 0x140005cd8
xorps xmm0, xmm0
psrldq xmm0, 8
movq rdi, xmm0
mov ebx, dword [rbp + 0x3dc]
mov rcx, qword [rbp + 0x180]
call fcn.140014fbc
mov rdx, qword [rbp + 0x178]
cmp rdx, 7
jbe 0x140005d33
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005d2e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140015af0
mov qword [rbp + 0x170], r15
mov qword [rbp + 0x178], 7
mov word [rbp + 0x160], r15w
test ebx, ebx
jne 0x140006609
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
test rdi, rdi
je 0x140005d77
lock inc dword [rdi + 8]
mov rdi, qword [rbp + 0xc8]
movdqa xmm6, xmmword [rbp + 0xc0]
movdqa xmmword [rbp + 0xd0], xmm6
test rdi, rdi
je 0x140005d8f
lock inc dword [rdi + 8]
mov rdi, qword [rbp + 0xc8]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x148], xmm1
mov esi, 0xffffffff
test rdi, rdi
je 0x140005dd9
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140005dd9
mov rbx, qword [rbp + 0xc8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140005dd9
mov rcx, qword [rbp + 0xc8]
mov rax, qword [rcx]
call qword [rax + 8]
nop
nop dword [rax]
mov r13, qword [rbp + 0xd0]
test r13, r13
je 0x1400064f6
lea rdx, [rbp - 0x78]
mov rcx, r13
call fcn.140004840
mov rax, qword [rbp - 0x78]
mov edx, dword [rbp - 0x70]
test edx, edx
je 0x140005e16
lea ecx, [rax - 1]
test ecx, 0xfffffff7
jne 0x14000661b
cmp eax, 3
jne 0x140005e38
lea rdx, [r13 + 0x20]
lea rcx, [rbp + 0x90]
call fcn.140003d50
mov rcx, rax
call fcn.140005bf0
jmp 0x140006400
lea rdx, [rbp - 0x68]
mov rcx, r13
call fcn.140004840
mov rax, qword [rbp - 0x68]
mov edx, dword [rbp - 0x60]
test edx, edx
je 0x140005e5e
lea ecx, [rax - 1]
test ecx, 0xfffffff7
jne 0x14000662c
cmp eax, 2
jne 0x140006400
lea rdx, [r13 + 0x20]
lea rcx, [rbp + 0x100]
call fcn.140003d50
nop
xorps xmm6, xmm6
movups xmmword [rbp + 0x60], xmm6
mov r15, qword [0x14003ddd8]
mov rax, qword [0x14003dde0]
mov qword [rsp + 0x38], rax
cmp r15, rax
je 0x1400063a4
nop dword [rax + rax]
mov rdx, r15
lea rcx, [rbp + 0x120]
call fcn.1400050f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor edx, edx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rdx
lea rsi, [rbp + 0x120]
cmp qword [rbp + 0x138], 0xf
seta byte [rsp + 0x30]
mov r14, qword [rbp + 0x120]
cmova rsi, r14
mov rdi, qword [rbp + 0x130]
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x140006643
cmp rdi, 0xf
ja 0x140005f1e
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 0xf
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x40], xmm0
jmp 0x140005fb3
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x140005f3d
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140005f64
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140005f86
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000663d
mov rcx, rax
call fcn.1400155f0
mov rcx, rax
test rax, rax
je 0x1400064ae
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140005f95
test rcx, rcx
je 0x140005f92
call fcn.1400155f0
jmp 0x140005f95
mov rax, rdx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x40]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xe0]
call fcn.1400050f0
or r12d, 8
xor ebx, ebx
mov edx, ebx
cmp qword [rsp + 0x50], rbx
jbe 0x14000601c
nop dword [rax]
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rax, qword [rsp + 0x40]
movzx ecx, byte [rax + rdx]
xor cl, 0x42
lea rax, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova rax, qword [rbp + 0xe0]
mov byte [rax + rdx], cl
inc rdx
cmp rdx, qword [rsp + 0x50]
jb 0x140005fe0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140006059
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006054
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400064ae
call fcn.140015af0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
lea rax, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova rax, qword [rbp + 0xe0]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0xf0]
mov qword [rbp - 8], rax
call fcn.140014d3c
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rbp - 0x58]
call fcn.140003560
nop
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 7
cmova rcx, qword [rbp + 0x100]
mov rax, qword [rbp + 0x110]
lea rdx, [rcx + rax*2]
mov rbx, rdx
call fcn.1400036b0
cmp rax, rdx
je 0x14000611c
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x1400060f0
cmp cx, 0x2f
jne 0x1400060f9
add rax, 2
cmp rax, rdx
jne 0x1400060e1
cmp rax, rdx
je 0x14000611c
nop
lea r8, [rbx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x14000611c
cmp cx, 0x2f
je 0x14000611c
mov rbx, r8
cmp rax, r8
jne 0x140006100
mov r8d, 0x3a
mov rcx, rbx
call fcn.1400154a0
cmp rbx, rax
je 0x140006167
lea rcx, [rax - 2]
cmp rbx, rcx
je 0x140006167
cmp word [rcx], 0x2e
jne 0x14000614f
lea rdx, [rcx - 2]
cmp rbx, rdx
jne 0x14000616a
cmp word [rdx], 0x2e
jne 0x14000616a
jmp 0x140006167
sub rcx, 2
cmp rbx, rcx
je 0x140006167
cmp word [rcx], 0x2e
je 0x14000616a
sub rcx, 2
cmp rbx, rcx
jne 0x140006158
mov rcx, rax
mov qword [rbp], rcx
sub rax, rcx
sar rax, 1
mov qword [rbp + 8], rax
lea rdx, [rbp]
lea rcx, [rbp - 0x38]
call fcn.14000b820
or r12d, 7
lea rax, [rbp - 0x58]
mov rbx, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x40]
cmp rdi, 7
cmova rax, rbx
mov qword [rbp + 0x10], rax
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0x18], rax
movaps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x30], xmm0
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x38]
call fcn.140003a50
mov esi, eax
mov rdx, qword [rbp - 0x20]
cmp rdx, 7
jbe 0x140006209
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400061fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400064b5
call fcn.140015af0
mov rdi, qword [rbp - 0x40]
mov rbx, qword [rbp - 0x58]
xor eax, eax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], ax
cmp rdi, 7
jbe 0x140006256
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000624e
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400064bc
mov rcx, rbx
call fcn.140015af0
test esi, esi
jne 0x140006310
lea ecx, [rsi + 0x28]
call fcn.1400155f0
mov rbx, rax
mov qword [rbp + 0x20], rax
lea rdx, [rbp + 0x100]
mov rcx, rax
call fcn.140003d50
lea rax, [0x140005320]
mov qword [rbx + 0x20], rax
mov qword [rbp + 0x140], rbx
or r12d, 0x10
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
xor edi, edi
mov dword [rsp + 0x20], edi
mov r9, rbx
lea r8, [0x14000cb40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400064ca
mov rdx, qword [0x14003ddf8]
cmp rdx, qword [0x14003de00]
je 0x1400062fa
xorps xmm0, xmm0
movaps xmmword [rbp + 0x70], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movaps xmmword [rbp + 0x80], xmm1
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rdx], xmm1
add qword [0x14003ddf8], 0x10
jmp 0x140006305
lea r8, [rsp + 0x60]
call fcn.14000bdd0
nop
cmp dword [rsp + 0x68], 0
jne 0x1400064c3
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x140006352
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000634c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400064da
call fcn.140015af0
nop
cmp byte [rsp + 0x30], 0
je 0x140006390
mov rdx, qword [rbp + 0x138]
inc rdx
mov rax, r14
cmp rdx, 0x1000
jb 0x140006388
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400064e1
mov rcx, r14
call fcn.140015af0
add r15, 0x20
cmp r15, qword [rsp + 0x38]
jne 0x140005ea0
mov esi, 0xffffffff
psrldq xmm6, 8
movd eax, xmm6
test eax, eax
jne 0x1400064ef
mov rdx, qword [rbp + 0x118]
cmp rdx, 7
jbe 0x1400063fb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400063f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400064e8
call fcn.140015af0
xor r15d, r15d
nop
lea rdx, [rbp + 0x3e0]
mov rcx, qword [r13 + 0x40]
call fcn.140014f9c
cmp eax, 0x12
je 0x140006457
test eax, eax
jne 0x140006601
cmp word [rbp + 0x40c], 0x2e
jne 0x140006443
movzx eax, word [rbp + 0x40e]
test ax, ax
je 0x140006400
cmp ax, 0x2e
jne 0x140006443
cmp word [rbp + 0x410], 0
je 0x140006400
lea rdx, [rbp + 0x3e0]
mov rcx, r13
call fcn.140004b40
jmp 0x140005de7
mov r13, r15
mov qword [rbp + 0xd0], r15
mov rbx, qword [rbp + 0xd8]
mov qword [rbp + 0xd8], r15
test rbx, rbx
je 0x140005de7
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140005de0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140005de0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
jmp 0x140005de0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x140006537
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140006537
mov rbx, qword [rbp + 0xd8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140006537
mov rcx, qword [rbp + 0xd8]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rbp + 0xc8]
test rcx, rcx
je 0x140006576
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140006576
mov rbx, qword [rbp + 0xc8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x140006576
mov rcx, qword [rbp + 0xc8]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov r14, qword [rbp - 0x80]
mov rdx, qword [r14 + 0x18]
cmp rdx, 7
jbe 0x1400065b5
lea rdx, [rdx*2 + 2]
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x1400065b0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400065fa
mov rcx, r8
call fcn.140015af0
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], 7
mov word [r14], r15w
mov rcx, qword [rbp + 0x630]
xor rcx, rsp
call fcn.1400155d0
lea r11, [rsp + 0x750]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov edx, eax
call fcn.1400046e0
nop
mov r8, r14
mov edx, ebx
lea rcx, str.directory_iterator::directory_iterator
call fcn.1400047d0
nop
lea r8, [r13 + 0x20]
lea rcx, str.directory_entry::status
call fcn.1400047d0
int3
lea r8, [r13 + 0x20]
lea rcx, str.directory_entry::status
call fcn.1400047d0
nop
call fcn.140001370
int3
call fcn.140001410
int3