Function at 0x140185140
Capabilities:
Enumerate files on windows
Get common file path
Set current directory

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x580
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rsp + 0x570], rax
mov esi, r9d
mov r15, r8
mov qword [rsp + 0x70], r8
mov rbx, rdx
mov r13, rcx
xor r14d, r14d
mov dword [rsp + 0x48], r14d
lea rdx, str.CBaseInfFile::EnumInf
lea rcx, [rsp + 0xc0]
call fcn.14001abe0
nop
lea rdi, [0x1402a8360]
mov rcx, qword [0x1402a8360]
lea r12, [0x1402bbdb0]
cmp rcx, rdi
je 0x14018521e
test byte [rcx + 0x1c], 1
je 0x1401851e1
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
lea edx, [r14 + 0x13]
lea r8, [0x140267488]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
mov rcx, qword [0x1402a8360]
cmp rcx, rdi
je 0x14018521e
test byte [rcx + 0x1c], 1
je 0x14018521e
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, socket
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
lea r8, [0x140267488]
mov rcx, qword [rcx + 0x10]
call fcn.14002fbe0
xor edx, edx
mov r8d, 0x224
lea rcx, [rsp + 0x13c]
call fcn.1401e7e40
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x140185ca3
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x40], rax
test rbx, rbx
je 0x14018529c
cmp rbx, 0x10000
jae 0x14018527e
movzx edx, bx
lea rcx, [rsp + 0x40]
call fcn.1400041d0
mov r14, 0xffffffffffffffff
jmp 0x1401852b7
mov r14, 0xffffffffffffffff
mov rax, r14
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140185290
jmp 0x1401852a6
mov eax, r14d
mov r14, 0xffffffffffffffff
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140004e60
nop
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x140185cae
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x50], rax
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x140185cb9
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x60], rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x360]
call fcn.1401e7e40
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov edx, dword [r13 + 8]
mov rax, qword [rax + 0x28]
call qword [case.0x1400136d6.0]
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0x360]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r8d, 1
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x40]
call fcn.1400044a0
nop
lea rdx, [0x1402672ac]
mov rcx, rax
call fcn.14003b790
movzx edi, al
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov ecx, r14d
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14018539e
lfence
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x1400136d6.0]
test dil, dil
je 0x1401853b4
lea rdx, [0x1402672ac]
lea rcx, [rsp + 0x40]
call fcn.14018abe0
mov rdi, qword [rsp + 0x40]
mov r8d, 1
sub r8d, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 0x103
or eax, r8d
jge 0x1401853e4
mov edx, 0x103
lea rcx, [rsp + 0x40]
call fcn.140004e00
mov rdi, qword [rsp + 0x40]
lea rcx, [r13 + 0x23a8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x1401855bf
mov rcx, qword [0x1402a8360]
lea r15, [0x1402a8360]
cmp rcx, r15
je 0x140185469
test byte [rcx + 0x1c], 2
je 0x140185469
mov rbx, r12
cmp qword [0x1402bbdc8], 8
cmovae rbx, qword [0x1402bbdb0]
lea rcx, [rsp + 0xc0]
call fcn.14001b0b0
mov edx, socket
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, [0x140267488]
mov rcx, qword [0x1402a8360]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
mov rcx, qword [0x1402a8360]
mov byte [rsp + 0xc8], 1
cmp rcx, r15
je 0x1401854ad
test byte [rcx + 0x1c], 1
je 0x1401854ad
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, socket
mov dword [rsp + 0x20], 0xffffffff
lea r8, [0x140267488]
mov rcx, qword [rcx + 0x10]
call fcn.140001b40
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401854d7
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140185501
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14018552b
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
lea rax, vtable.WppTrace.0
mov qword [rsp + 0xc0], rax
cmp byte [rsp + 0xc8], 0
jne 0x14018559d
mov rcx, qword [0x1402a8360]
cmp rcx, r15
je 0x14018559d
test byte [rcx + 0x1c], 1
je 0x14018559d
lea r8, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae r8, qword [rsp + 0xd0]
cmp qword [0x1402bbdc8], 8
cmovae r12, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], r8
mov r9, r12
lea r8, [0x140252818]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
lea rcx, [rsp + 0xf0]
call fcn.1400048a0
lea rcx, [rsp + 0xd0]
call fcn.1400048a0
mov eax, r14d
jmp 0x140185c80
mov qword [rsp + 0x110], 0x927
xor r15d, r15d
mov qword [rsp + 0x118], r15
mov qword [rsp + 0x120], r15
mov dword [rsp + 0x128], r15d
mov dword [rsp + 0x12c], 0xffffffff
mov qword [rsp + 0x130], r15
mov dword [rsp + 0x138], r15d
lea rdx, [rsp + 0x110]
test esi, esi
lea rcx, [0x1402672b0]
jne 0x14018561b
lea rcx, str..inf
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
mov qword [rsp + 0x58], rax
lea rcx, [r13 + 0x58]
mov r8, r14
xor edx, edx
call fcn.1401c921c
lea rcx, [r13 + 0x30]
mov r8, r14
xor edx, edx
call fcn.1401d4274
mov eax, r15d
cmp rbx, 0xffffffffffffffff
setne al
mov rsi, qword [rsp + 0x50]
test eax, eax
je 0x140185ab5
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x14018567a
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
jne 0x14018569e
call fcn.1401bb0c4
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
je 0x140185cc4
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
or dword [rsp + 0x48], 1
lea rax, [rsp + 0x13c]
inc r14
cmp word [rax + r14*2], 0
jne 0x1401856c1
movsxd r12, dword [rdi - 0x10]
lea r15d, [r12 + r14]
test r15d, r15d
js 0x140185ccf
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r15d
or eax, ecx
jge 0x14018570e
lfence
mov edx, r15d
lea rcx, [rsp + 0x68]
call fcn.140004e00
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x68]
add r12, r12
je 0x140185738
test rbx, rbx
jne 0x14018572a
call fcn.1401ec568
mov dword [rax], socket
call fcn.1401ec3fc
jmp 0x140185738
mov r8, r12
mov rdx, rdi
mov rcx, rbx
call fcn.1401e7770
movsxd r8, r14d
add r8, r8
lea rcx, [r12 + rbx]
je 0x140185768
test rcx, rcx
jne 0x14018575b
call fcn.1401ec568
mov dword [rax], socket
call fcn.1401ec3fc
jmp 0x140185768
lea rdx, [rsp + 0x13c]
call fcn.1401e7770
cmp r15d, dword [rbx - 0xc]
jg 0x140185cd9
mov dword [rbx - 0x10], r15d
movsxd rax, r15d
xor ecx, ecx
mov word [rbx + rax*2], cx
lea rcx, [rbx - 0x18]
add rsi, 0xffffffffffffffe8
cmp rcx, rsi
je 0x1401857ed
cmp dword [rsi + 0x10], 0
jl 0x1401857dc
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x1401857dc
call fcn.140004d00
mov rbx, rax
mov r14, 0xffffffffffffffff
mov ecx, r14d
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x1401857cc
lfence
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x50], rax
mov rbx, qword [rsp + 0x68]
jmp 0x1401857f4
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140004e60
mov r14, 0xffffffffffffffff
and dword [rsp + 0x48], 0xfffffffe
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14018581d
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
lea rcx, [rsp + 0x13c]
mov rax, r14
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140185830
mov r8d, eax
lea rdx, [rsp + 0x13c]
lea rcx, [rsp + 0x60]
call fcn.140004e60
mov rcx, qword [0x1402a8360]
lea rdi, [0x1402a8360]
cmp rcx, rdi
je 0x1401858ad
test byte [rcx + 0x1c], 4
je 0x1401858ad
lea r12, [0x1402bbdb0]
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, reloc.WSOCK32.dll_socket
mov r15, qword [rsp + 0x70]
mov qword [rsp + 0x28], r15
mov rsi, qword [rsp + 0x50]
mov qword [rsp + 0x20], rsi
lea r8, [0x140267488]
mov rcx, qword [rcx + 0x10]
call fcn.14002fbe0
jmp 0x1401858be
mov rsi, qword [rsp + 0x50]
lea r12, [0x1402bbdb0]
mov r15, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
mov r8, r15
mov rdx, rsi
mov rax, qword [rax + 0x68]
call qword [case.0x1400136d6.0]
mov ebx, eax
mov rcx, qword [0x1402a8360]
cmp rcx, rdi
je 0x14018591f
test byte [rcx + 0x1c], 4
je 0x14018591f
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x18
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rsi
lea r8, [0x140267488]
mov rcx, qword [rcx + 0x10]
call fcn.14002fbe0
test ebx, ebx
je 0x140185a95
mov ecx, 0x328
call fcn.1401baa78
mov rcx, rax
mov qword [rsp + 0x90], rax
lea rdi, [r13 + 0x28]
lea rbx, [r13 + 0x10]
test rax, rax
je 0x14018596d
lea rax, [r13 + 0x20]
lea r9, [r13 + 0x18]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x60]
call fcn.140183e50
mov r14, rax
jmp 0x140185970
mov r14, rax
mov r10, qword [0x1402a8360]
lea r15, [0x1402a8360]
cmp r10, r15
je 0x140185a2c
test byte [r10 + 0x1c], 4
je 0x140185a2c
mov r15, r12
cmp qword [0x1402bbdc8], 8
cmovae r15, qword [0x1402bbdb0]
mov rax, qword [rbx]
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, 0x64
or ecx, edx
jge 0x1401859ce
mov edx, 0x64
mov rcx, rbx
call fcn.140004e00
mov r10, qword [0x1402a8360]
mov rbx, qword [rbx]
mov rax, qword [rdi]
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, 0x64
or ecx, edx
jge 0x1401859fa
mov edx, 0x64
mov rcx, rdi
call fcn.140004e00
mov r10, qword [0x1402a8360]
mov rax, qword [rdi]
mov edx, 0x19
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x13c]
mov qword [rsp + 0x20], rax
mov r9, r15
lea r8, [0x140267488]
mov rcx, qword [r10 + 0x10]
call fcn.14001d060
mov rax, qword [r14]
lea rcx, [r13 + 0x380]
lea r10, [r13 + 0x358]
lea r9, [r13 + 0x330]
lea r8, [r13 + 0x308]
lea rdx, [r13 + 0x2e0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r10
mov rcx, r14
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov r8, r14
mov rdx, qword [r13 + 0x40]
lea rcx, [r13 + 0x30]
call fcn.1401d4224
lea r8, [rsp + 0x13c]
mov rdx, qword [r13 + 0x68]
lea rcx, [r13 + 0x58]
call fcn.1401c91a0
mov r14, 0xffffffffffffffff
lea rdx, [rsp + 0x110]
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rdi, qword [rsp + 0x40]
jmp 0x140185654
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [0x1402a8360]
lea rdi, [0x1402a8360]
cmp rcx, rdi
je 0x140185b07
test byte [rcx + 0x1c], 4
je 0x140185b07
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x1a
mov eax, dword [r13 + 0x68]
mov dword [rsp + 0x20], eax
lea r8, [0x140267488]
mov rcx, qword [rcx + 0x10]
call fcn.140001b40
lea rcx, [rsp + 0x360]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x140185b27
lea rcx, [rsp + 0x360]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov byte [rsp + 0xc8], 1
mov rcx, qword [0x1402a8360]
cmp rcx, rdi
je 0x140185b71
test byte [rcx + 0x1c], 1
je 0x140185b71
mov r9, r12
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x1b
mov eax, dword [r13 + 0x68]
mov dword [rsp + 0x20], eax
lea r8, [0x140267488]
mov rcx, qword [rcx + 0x10]
call fcn.140001b40
mov ebx, dword [r13 + 0x68]
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140185b9f
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140185bc9
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140185bf2
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
lea rax, vtable.WppTrace.0
mov qword [rsp + 0xc0], rax
cmp byte [rsp + 0xc8], 0
jne 0x140185c64
mov rcx, qword [0x1402a8360]
cmp rcx, rdi
je 0x140185c64
test byte [rcx + 0x1c], 1
je 0x140185c64
lea r8, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae r8, qword [rsp + 0xd0]
cmp qword [0x1402bbdc8], 8
cmovae r12, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], r8
mov r9, r12
lea r8, [0x140252818]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
lea rcx, [rsp + 0xf0]
call fcn.1400048a0
lea rcx, [rsp + 0xd0]
call fcn.1400048a0
mov eax, ebx
mov rcx, qword [rsp + 0x570]
xor rcx, rsp
call fcn.1401e2900
add rsp, 0x580
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
int3
mov ecx, 0x80070057
call fcn.140001470
mov ecx, 0x80070057
call fcn.140001470
int3