Function at 0x140020cf0
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
push r12
push r13
push r14
lea rbp, [r11 - 0xf8]
sub rsp, 0x1c8
mov rax, qword [0x1400d33c0]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov qword [r11 + 0x18], rsi
mov r12, rdx
mov rbx, rcx
mov qword [r11 - 0x38], r15
xor r13d, r13d
lea r14, [0x1400c47d4]
movzx eax, byte [rbx]
test al, al
jne 0x140020ff9
cmp qword [rbx + 0x2c8], r13
je 0x14002134c
test al, al
jne 0x140020ff9
mov rcx, qword [rbx + 0x2a8]
mov rdx, qword [rbx + 0x2c8]
mov rax, r13
dec rdx
mov qword [rbp - 0x28], rcx
mov qword [rsp + 0x60], rax
test rcx, rcx
je 0x140020d85
mov r8, qword [rcx]
test r8, r8
je 0x140020d85
mov rax, qword [r8]
mov qword [rsp + 0x60], rax
add rdx, qword [rbx + 0x2c0]
mov qword [rsp + 0x70], rdx
test rax, rax
je 0x140020daf
mov rax, qword [rax]
test rax, rax
je 0x140020daf
mov rax, qword [rax]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x140020daf
mov rax, qword [rax]
jmp 0x140020db2
mov rax, r13
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 8]
lea rsi, [rbx + 0x260]
dec rcx
and rcx, rdx
mov rdx, qword [rax + rcx*8]
cmp rsi, rdx
je 0x140020ddf
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rcx, rsi
call fcn.140007850
mov rdx, qword [rbx + 0x2c8]
mov rax, qword [rbx + 0x2b8]
dec rdx
dec rax
add rdx, qword [rbx + 0x2c0]
and rdx, rax
mov rax, qword [rbx + 0x2b0]
mov rdi, qword [rax + rdx*8]
cmp qword [rdi + 0x18], 8
jb 0x140020e17
mov rcx, qword [rdi]
call fcn.1400910f4
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r13
mov word [rdi], r13w
dec qword [rbx + 0x2c8]
jne 0x140020e37
mov qword [rbx + 0x2c0], r13
lea rcx, [rbp + 0x10]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
mov qword [rbp + 0x28], 7
mov qword [rbp + 0x20], r13
mov word [rbp + 0x10], r13w
call fcn.140007850
cmp qword [rbx + 0x298], r13
jne 0x140020eb9
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 1
movaps xmm0, xmmword [rsp + 0x40]
lea r8, [rbp - 0x70]
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x10]
movdqa xmmword [rbp - 0x70], xmm0
call fcn.140005570
lea rcx, [rbp + 0x10]
cmp rcx, rax
je 0x140020ea9
lea rcx, [rbp + 0x10]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
call fcn.140007850
cmp qword [rbp + 0x88], 8
jb 0x140020f2b
mov rcx, qword [rbp + 0x70]
jmp 0x140020f26
cmp qword [rbx + 0x2a0], 8
jb 0x140020ecc
mov rcx, qword [rbx + 0x288]
jmp 0x140020ed3
lea rcx, [rbx + 0x288]
mov rax, qword [rbx + 0x298]
mov qword [rsp + 0x30], rcx
lea r8, [rbp - 0x60]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x10]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x60], xmm0
call fcn.140005570
lea rcx, [rbp + 0x10]
cmp rcx, rax
je 0x140020f1b
lea rcx, [rbp + 0x10]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
call fcn.140007850
cmp qword [rbp + 0x68], 8
jb 0x140020f2b
mov rcx, qword [rbp + 0x50]
call fcn.1400910f4
cmp qword [0x1400d8d40], r13
jne 0x140020f8d
mov ecx, 0x58
call fcn.140091088
test rax, rax
je 0x140020f50
mov rcx, rax
call fcn.140012d30
mov rdi, rax
jmp 0x140020f53
mov rdi, r13
xor eax, eax
lock cmpxchg qword [0x1400d8d40], rdi
je 0x140020f8d
test rdi, rdi
je 0x140020f8d
cmp qword [rdi + 0x50], 0x10
jb 0x140020f75
mov rcx, qword [rdi + 0x38]
call fcn.1400910f4
mov qword [rdi + 0x50], 0xf
mov qword [rdi + 0x48], r13
mov rcx, rdi
mov byte [rdi + 0x38], r13b
call fcn.1400910f4
mov rax, qword [0x1400d8d40]
lea rcx, [rbp + 0x10]
lea r15, [rbx + 4]
cmp dword [rax], 4
jl 0x140020fca
cmp qword [rbp + 0x28], 8
mov r8, r15
mov dword [rsp + 0x28], 2
cmovae rcx, qword [rbp + 0x10]
xor r9d, r9d
mov qword [rsp + 0x20], r13
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
jmp 0x140020fdd
cmp qword [rbp + 0x28], 8
mov rdx, r15
cmovae rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp qword [rbp + 0x28], 8
mov qword [rbx + 0x258], rax
mov byte [rbx], 1
jb 0x140021029
mov rcx, qword [rbp + 0x10]
call fcn.1400910f4
jmp 0x140021029
mov rcx, qword [rbx + 0x258]
lea r15, [rbx + 4]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140021029
mov rcx, qword [rbx + 0x258]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rbx + 0x258], 0xffffffffffffffff
cmp qword [rbx + 0x258], 0xffffffffffffffff
jne 0x1400210cd
lea rdi, [rbx + 0x288]
lea rax, [rbp + 0x30]
mov byte [rbx], r13b
mov qword [rbp + 0x48], 7
mov qword [rbp + 0x40], r13
mov word [rbp + 0x30], r13w
cmp rdi, rax
je 0x140020d33
cmp qword [rdi + 0x18], 8
jb 0x14002106e
mov rcx, qword [rdi]
call fcn.1400910f4
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r13
mov word [rdi], r13w
mov rcx, qword [rbp + 0x48]
cmp rcx, 8
jae 0x1400210b5
mov r8, qword [rbp + 0x40]
inc r8
je 0x1400210bc
lea rdx, [rbp + 0x30]
add r8, r8
mov rcx, rdi
call fcn.140091470
mov rcx, qword [rbp + 0x48]
mov rax, qword [rbp + 0x40]
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rcx
jmp 0x140020d33
mov rax, qword [rbp + 0x30]
mov qword [rdi], rax
mov rax, qword [rbp + 0x40]
mov qword [rdi + 0x18], rcx
mov qword [rdi + 0x10], rax
jmp 0x140020d33
lea rdi, [rbx + 0x30]
test rdi, rdi
jne 0x1400210db
mov r8, r13
jmp 0x1400210fa
cmp word [rdi], r13w
jne 0x1400210e6
mov r8, r13
jmp 0x1400210fa
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdi + r8*2], r13w
jne 0x1400210f0
mov r14d, 7
mov qword [rbp - 0x48], r8
mov qword [rbp], r13
mov word [rbp - 0x10], r13w
mov qword [rbp + 8], r14
test r8, r8
jne 0x140021124
mov rsi, r13
mov qword [rbp], r13
mov word [rbp - 0x10], r13w
jmp 0x140021138
lea rcx, [rbp - 0x10]
mov rdx, rdi
call fcn.140008160
mov r14, qword [rbp + 8]
mov rsi, qword [rbp]
lea rcx, [rbp - 0x10]
call fcn.140006420
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x1400211be
cmp rsi, rax
jb 0x1400213ca
mov rax, rsi
sub rax, rcx
cmp rax, 0xffffffffffffffff
lea rax, [rbp - 0x10]
ja 0x140021177
cmp r14, 8
mov qword [rbp], rcx
cmovae rax, qword [rbp - 0x10]
mov word [rax + rcx*2], r13w
jmp 0x1400211be
mov rdx, qword [rbp - 0x10]
cmp r14, 8
inc rsi
cmovae rax, rdx
mov r8, rsi
lea r9, [rax + rcx*2]
sub r8, rcx
je 0x1400211a9
lea rdx, [r9 - 2]
add r8, r8
mov rcx, r9
call fcn.140091470
mov r14, qword [rbp + 8]
mov rdx, qword [rbp - 0x10]
lea rax, [rbp - 0x10]
cmp r14, 8
mov qword [rbp], rsi
cmovae rax, rdx
mov word [rax + rsi*2], r13w
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.1400206c0
test al, al
jne 0x14002132c
mov qword [rsp + 0x50], rdi
test rdi, rdi
jne 0x1400211e1
mov rax, r13
jmp 0x1400211fa
cmp word [rdi], r13w
jne 0x1400211ec
mov rax, r13
jmp 0x1400211fa
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], r13w
jne 0x1400211f0
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
lea rcx, [rbx + 0x260]
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x90]
movdqa xmmword [rbp - 0x80], xmm0
call fcn.140005570
lea rcx, [rbp - 0x10]
cmp rcx, rax
je 0x14002123c
lea rcx, [rbp - 0x10]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
call fcn.140007850
cmp qword [rbp + 0xa8], 8
jb 0x140021252
mov rcx, qword [rbp + 0x90]
call fcn.1400910f4
test byte [r15], 0x10
je 0x140021323
cmp byte [rbx + 0x280], r13b
je 0x14002131a
cmp qword [rbp + 8], 8
lea rcx, [rbp - 0x10]
cmovae rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xa
jb 0x14002131a
lea rdi, [rbx + 0x2a8]
mov rax, qword [rdi + 0x20]
inc rax
cmp qword [rdi + 0x10], rax
ja 0x1400212a3
mov rcx, rdi
call fcn.140021560
mov r8, qword [rdi + 0x10]
mov rax, qword [rdi + 8]
dec r8
and qword [rdi + 0x18], r8
mov rdx, qword [rdi + 0x18]
add rdx, qword [rdi + 0x20]
and rdx, r8
lea rsi, [rdx*8]
cmp qword [rsi + rax], r13
jne 0x1400212e9
mov ecx, 0x20
call fcn.140091088
mov rcx, rax
test rax, rax
je 0x1400213d7
mov rax, qword [rdi + 8]
mov qword [rsi + rax], rcx
mov rax, qword [rdi + 8]
mov rcx, qword [rsi + rax]
test rcx, rcx
je 0x140021316
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r13
lea rdx, [rbp - 0x10]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov word [rcx], r13w
call fcn.140007850
inc qword [rdi + 0x20]
test byte [rbx + 0x284], 2
jmp 0x14002132a
test byte [rbx + 0x284], 1
jne 0x140021361
cmp qword [rbp + 8], 8
lea r14, [0x1400c47d4]
jb 0x140020d33
mov rcx, qword [rbp - 0x10]
call fcn.1400910f4
jmp 0x140020d2c
mov qword [r12 + 0x18], 7
mov qword [r12 + 0x10], r13
mov word [r12], r13w
jmp 0x140021397
mov qword [r12 + 0x18], 7
mov qword [r12 + 0x10], r13
lea rdx, [rbp - 0x10]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rcx, r12
mov word [r12], r13w
call fcn.140007850
cmp qword [rbp + 8], 8
jb 0x140021397
mov rcx, qword [rbp - 0x10]
call fcn.1400910f4
mov r15, qword [rsp + 0x1c0]
mov rsi, qword [rsp + 0x210]
mov rax, r12
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.140091a70
add rsp, 0x1c8
pop r14
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret
lea rcx, str.invalid_string_position
call fcn.14009048c
int3
call fcn.140090410
int3