Function at 0x140055790
Capabilities:
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2a8
mov rdi, rcx
test edx, edx
jle 0x140055824
movsxd r8, edx
mov eax, 1
xor r14d, r14d
jmp 0x1400557cc
lea rcx, [rax + 1]
cmp r8, rax
je 0x1400557e9
mov rax, rcx
movzx ecx, word [rdi + rax*2 - 2]
cmp cx, 0x5c
je 0x1400557dd
cmp cx, 0x2f
jne 0x1400557c0
mov r14d, eax
lea rcx, [rax + 1]
cmp r8, rax
jne 0x1400557c9
cmp edx, r14d
jle 0x140055a77
movsxd rax, r14d
lea rcx, [rdi + rax*2]
mov eax, r14d
nop dword [rax]
movzx r8d, word [rcx]
cmp r8w, 0x2a
je 0x140055830
cmp r8w, 0x3f
je 0x140055830
add eax, 1
add rcx, 2
cmp edx, eax
jne 0x140055800
xor eax, eax
jmp 0x140055a26
xor r14d, r14d
xor eax, eax
nop dword [rax]
cmp edx, eax
je 0x14005581d
movsxd rdx, edx
xor eax, eax
mov rcx, rdi
lea rbx, [rdi + rdx*2]
movzx esi, word [rbx]
mov word [rbx], ax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov word [rbx], si
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x14005581d
xor esi, esi
test r14d, r14d
jne 0x140055a3a
mov rbp, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r12, [rsp + 0x7c]
jmp 0x14005594f
movsxd rbx, ebx
mov qword [rcx + rbx*8], 0
mov r9d, 0xffffffff
mov r8, r12
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbp
lea ecx, [rax + rsi]
mov r15d, eax
movsxd rcx, ecx
call sub.msvcrt.dll_malloc
mov rbx, rax
test rax, rax
je 0x140055a18
test esi, esi
jne 0x1400559c8
movsxd rax, esi
xor edx, edx
mov dword [rsp + 0x28], r15d
mov r9d, 0xffffffff
add rax, rbx
mov r8, r12
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call rbp
movsxd rax, dword [0x1400a1660]
lea edx, [rax + 1]
mov dword [0x1400a1660], edx
mov rdx, qword [0x1400a1658]
mov qword [rdx + rax*8], rbx
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140055a18
cmp word [rsp + 0x7c], 0x2e
jne 0x14005596b
movzx eax, word [rsp + 0x7e]
test ax, ax
je 0x140055939
cmp ax, 0x2e
je 0x140055a00
mov eax, dword [0x1400a1660]
mov edx, dword [0x1400a1650]
mov rcx, qword [0x1400a1658]
lea ebx, [rax + 1]
cmp ebx, edx
jl 0x140055888
mov eax, ebx
sub eax, edx
and eax, 0xffffffc0
lea edx, [rdx + rax + 0x40]
mov dword [0x1400a1650], edx
movsxd rdx, edx
shl rdx, 3
call sub.msvcrt.dll_realloc
test rax, rax
je 0x140055a18
movsxd rbx, ebx
mov qword [0x1400a1658], rax
mov qword [rax + rbx*8], 0
jmp 0x140055893
mov dword [rsp + 0x28], esi
mov r9d, r14d
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x38], 0
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call rbp
jmp 0x1400558ea
cmp word [rsp + 0x80], 0
jne 0x14005596b
jmp 0x140055939
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x2a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0x28], 0
mov r9d, r14d
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x38], 0
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
jmp 0x140055870
mov eax, r14d
jmp 0x140055830