Function at 0x140029ee8
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x140054108]
xor rax, rsp
mov qword [rbp + 0x1c8], rax
xor edi, edi
mov qword [rsp + 0x60], rdx
mov r13, rcx
test rdx, rdx
jne 0x140029949
call fcn.14001ae38
lea ebx, [rdi + 0x16]
mov dword [rax], ebx
call fcn.14001acf0
mov eax, ebx
jmp 0x140029d1a
xorps xmm0, xmm0
mov qword [rdx], rdi
mov rax, qword [rcx]
movdqu xmmword [rsp + 0x30], xmm0
mov r14, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x40], rdi
test rax, rax
je 0x140029bb9
lea rdx, [rbp + 0x1c0]
mov dword [rbp + 0x1c0], 0x3f002a
mov rcx, rax
mov word [rbp + 0x1c4], di
movabs rbx, 0x200000000801
call fcn.14002c14c
mov r15, qword [r13]
mov rcx, rax
test rax, rax
jne 0x1400299d2
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.140029d5c
mov rsi, qword [rsp + 0x30]
mov r15d, eax
test eax, eax
jne 0x140029b42
mov r14, qword [rsp + 0x38]
jmp 0x140029b35
cmp rax, r15
je 0x1400299f6
movzx eax, word [rcx]
sub ax, 0x2f
cmp ax, 0x2d
ja 0x1400299ed
movzx eax, ax
bt rbx, rax
jb 0x1400299f6
sub rcx, 2
cmp rcx, r15
jne 0x1400299d7
movzx edx, word [rcx]
cmp dx, 0x3a
jne 0x140029a22
lea rax, [r15 + 2]
cmp rcx, rax
je 0x140029a22
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.140029d5c
mov r12d, eax
jmp 0x140029b26
sub dx, 0x2f
cmp dx, 0x2d
ja 0x140029a37
movzx eax, dx
bt rbx, rax
mov al, 1
jb 0x140029a3a
mov al, dil
sub rcx, r15
mov dword [rsp + 0x28], edi
sar rcx, 1
lea r8, [rsp + 0x70]
inc rcx
mov qword [rsp + 0x20], rdi
neg al
sbb r12, r12
xor r9d, r9d
and r12, rcx
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x48], r12
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140029a08
sub r14, rsi
sar r14, 3
mov qword [rsp + 0x50], r14
cmp word [rbp - 0x64], 0x2e
jne 0x140029a9b
cmp word [rbp - 0x62], di
je 0x140029abb
cmp word [rbp - 0x62], 0x2e
jne 0x140029a9b
cmp word [rbp - 0x60], di
je 0x140029abb
lea r9, [rsp + 0x30]
mov r8, r12
mov rdx, r15
lea rcx, [rbp - 0x64]
call fcn.140029d5c
mov r12d, eax
test eax, eax
jne 0x140029b1d
mov r12, qword [rsp + 0x48]
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140029a81
mov r14, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdx, r14
mov rax, qword [rsp + 0x50]
sub rdx, rsi
sar rdx, 3
cmp rax, rdx
jne 0x140029af6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x140029b35
sub rdx, rax
lea rcx, [rsi + rax*8]
lea r9, [0x1400298e0]
mov r8d, 8
call fcn.140032000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r12d, edi
jmp 0x140029b30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r14, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
test r12d, r12d
jne 0x140029b80
add r13, 8
mov rax, qword [r13]
jmp 0x140029967
mov rbx, qword [rsp + 0x38]
mov r14, rsi
sub rbx, rsi
add rbx, 7
shr rbx, 3
cmp rsi, qword [rsp + 0x38]
cmova rbx, rdi
test rbx, rbx
je 0x140029c53
mov rcx, qword [r14]
call fcn.14002511c
inc rdi
lea r14, [r14 + 8]
cmp rdi, rbx
jne 0x140029b67
jmp 0x140029c53
mov rbx, r14
mov r15, rsi
sub rbx, rsi
add rbx, 7
shr rbx, 3
cmp rsi, r14
cmova rbx, rdi
test rbx, rbx
je 0x140029bb1
mov rcx, qword [r15]
call fcn.14002511c
inc rdi
lea r15, [r15 + 8]
cmp rdi, rbx
jne 0x140029b9d
mov r15d, r12d
jmp 0x140029c53
mov rax, r14
mov qword [rsp + 0x48], rdi
sub rax, rsi
mov r9, rdi
mov r12, rax
mov rcx, rsi
sar r12, 3
mov rdx, rdi
inc r12
lea r15, [rax + 7]
shr r15, 3
cmp rsi, r14
cmova r15, rdi
test r15, r15
je 0x140029c13
mov r10, qword [rcx]
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], di
jne 0x140029bf2
inc r9
add rcx, 8
add r9, rax
inc rdx
cmp rdx, r15
jne 0x140029beb
mov qword [rsp + 0x48], r9
mov r8d, 2
mov rdx, r9
mov rcx, r12
call fcn.14001ebf8
mov rbx, rax
test rax, rax
jne 0x140029c63
xor ecx, ecx
call fcn.14002511c
mov rbx, rsi
test r15, r15
je 0x140029c4f
mov rcx, qword [rbx]
call fcn.14002511c
inc rdi
lea rbx, [rbx + 8]
cmp rdi, r15
jne 0x140029c3b
or r15d, 0xffffffff
mov rcx, rsi
call fcn.14002511c
mov eax, r15d
jmp 0x140029d1a
lea rdx, [rax + r12*8]
mov r12, rsi
mov qword [rsp + 0x58], rdx
mov rcx, rdx
mov qword [rbp + 0x1c0], rdx
cmp rsi, r14
je 0x140029ce5
sub rax, rsi
mov qword [rsp + 0x50], rax
mov r8, qword [r12]
or r13, 0xffffffffffffffff
inc r13
cmp word [r8 + r13*2], di
jne 0x140029c8e
mov rax, rcx
inc r13
sub rax, rdx
mov r9, r13
mov rdx, qword [rsp + 0x48]
sar rax, 1
sub rdx, rax
call fcn.14001afe8
test eax, eax
jne 0x140029d44
mov rcx, qword [rbp + 0x1c0]
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov qword [r12 + rax], rcx
add r12, 8
lea rcx, [rcx + r13*2]
mov qword [rbp + 0x1c0], rcx
cmp r12, r14
jne 0x140029c86
mov rax, qword [rsp + 0x60]
xor ecx, ecx
mov qword [rax], rbx
call fcn.14002511c
mov rbx, rsi
test r15, r15
je 0x140029d10
mov rcx, qword [rbx]
call fcn.14002511c
inc rdi
lea rbx, [rbx + 8]
cmp rdi, r15
jne 0x140029cfc
mov rcx, rsi
call fcn.14002511c
xor eax, eax
mov rcx, qword [rbp + 0x1c8]
xor rcx, rsp
call fcn.140013600
mov rbx, qword [rsp + 0x320]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14001ad40
int3
jmp 0x1400298f4