Function at 0x14004df90
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x610
mov rax, qword [0x140188050]
xor rax, rsp
mov qword [rsp + 0x600], rax
mov qword [rsp + 0x630], r12
lea rcx, [rsp + 0x3e0]
xor r12d, r12d
xor edx, edx
mov r8d, 0x104
mov esi, r12d
call fcn.1400082a0
xor edx, edx
lea rcx, [rsp + 0x2d0]
mov r8d, 0x104
call fcn.1400082a0
mov rcx, qword [0x1401894b0]
lea rbx, [0x1401412b0]
mov rdx, rbx
call fcn.140003af0
mov rbp, rax
test rax, rax
je 0x14004e1ef
mov qword [rsp + 0x638], r14
lea ecx, [r12 + 0x24]
mov r9d, 0x80000000
mov qword [rsp + 0x640], r15
xor r8d, r8d
mov rdx, rbx
call fcn.140004670
xor edx, edx
xor r9d, r9d
or r8d, 0xffffffff
mov r15, rax
lea ecx, [rdx + 0x24]
call fcn.140004670
xor edx, edx
xor r9d, r9d
or r8d, 0xffffffff
mov rdi, rax
lea ecx, [rdx + 0x24]
call fcn.140004670
cmp dword [reloc.WSOCK32.dll_accept], 4
mov r14, rax
mov qword [rsp + 0x40], r12
jl 0x14004e0b9
test dword [0x1401877e0], 0x100
je 0x14004e0b9
lea rax, [rsp + 0x2d0]
mov ecx, 0x100
mov qword [rsp + 0x38], rax
lea r9, str.....esif_uf_dspmgr.c
lea rax, str.SCAN_CONFIG_For_DSP_Files_NameSpace___s__Pattern__s
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea r8, str.esif_dsp_file_scan
lea edx, [r12 + 4]
mov dword [rsp + 0x20], 0x365
call fcn.140008b60
test r15, r15
je 0x14004e1c7
test rdi, rdi
je 0x14004e1c7
test r14, r14
je 0x14004e1c7
lea r9, [rsp + 0x40]
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.140009660
mov esi, eax
test eax, eax
jne 0x14004e1c7
mov eax, dword [rdi + 0x10]
cmp eax, 5
jb 0x14004e166
mov ecx, eax
lea rdx, [0x140141e98]
mov rax, qword [rdi + 4]
add rax, 0xfffffffffffffffb
add rcx, rax
call fcn.14000ba10
test eax, eax
jne 0x14004e166
mov ecx, 0x104
call fcn.140008f40
mov rbx, rax
test rax, rax
je 0x14004e138
xor edx, edx
mov r8d, 0x104
mov rcx, rax
call fcn.1400082a0
mov r8, qword [rdi + 4]
or r9, 0xffffffffffffffff
mov edx, 0x104
mov rcx, rbx
call fcn.140009db0
mov rcx, rbx
call fcn.14004c9c0
test eax, eax
je 0x14004e166
test rbx, rbx
je 0x14004e166
mov rcx, rbx
call fcn.140006db0
xor r8d, r8d
mov dword [rsp + 0x20], r12d
or r9d, 0xffffffff
mov rcx, rdi
lea edx, [r8 + 0x24]
call fcn.14000cda0
xor r8d, r8d
mov dword [rsp + 0x20], r12d
or r9d, 0xffffffff
mov rcx, r14
lea edx, [r8 + 0x24]
call fcn.14000cda0
lea r9, [rsp + 0x40]
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.140009ca0
mov esi, eax
test eax, eax
je 0x14004e0f1
lea rcx, [rsp + 0x40]
call fcn.140009590
cmp esi, 0x3ed
cmove esi, r12d
mov rcx, r15
call fcn.1400055d0
mov rcx, rdi
call fcn.1400055d0
mov rcx, r14
call fcn.1400055d0
mov r15, qword [rsp + 0x640]
mov r14, qword [rsp + 0x638]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov edx, 0x104
lea rcx, [rsp + 0x3e0]
lea r8d, [r9 + 9]
call fcn.140006c30
or r9, 0xffffffffffffffff
lea r8, str..edp
mov edx, 0x104
lea rcx, [rsp + 0x2d0]
call fcn.140009db0
cmp dword [reloc.WSOCK32.dll_accept], 4
mov r12, qword [rsp + 0x630]
jl 0x14004e292
test dword [0x1401877e0], 0x100
je 0x14004e292
lea rax, [rsp + 0x2d0]
mov edx, 4
mov qword [rsp + 0x38], rax
lea r9, str.....esif_uf_dspmgr.c
lea rax, [rsp + 0x3e0]
mov ecx, 0x100
mov qword [rsp + 0x30], rax
lea r8, str.esif_dsp_file_scan
lea rax, str.SCAN_File_System_For_DSP_Files_Path___s__Pattern__s
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x383
call fcn.140008b60
mov ecx, 0x104
call fcn.140008f40
mov rbx, rax
test rax, rax
je 0x14004e2b4
xor edx, edx
mov r8d, 0x104
mov rcx, rax
call fcn.1400082a0
test rbx, rbx
jne 0x14004e307
cmp dword [reloc.WSOCK32.dll_accept], 1
jl 0x14004e2fd
test dword [0x1401877ad], 0x100
je 0x14004e2fd
lea rax, str.Fail_to_allocate_esif_ccb_file_n
mov ecx, 0x100
mov qword [rsp + 0x28], rax
lea r9, str.....esif_uf_dspmgr.c
lea r8, str.esif_dsp_file_scan
mov dword [rsp + 0x20], 0x387
lea edx, [rbx + 1]
call fcn.140008b60
mov eax, 0x708
jmp 0x14004e41c
lea rax, [rsp + 0x2d0]
mov ecx, 0x104
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3e0]
lea rax, [0x140137674]
lea r8, [0x140137678]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x4f0]
call fcn.14004c6c0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14004e408
or r9, 0xffffffffffffffff
lea r8, [rsp + 0x7c]
mov edx, 0x104
mov rcx, rbx
call fcn.140009db0
test rbp, rbp
je 0x14004e390
mov rcx, qword [rbp + 0x84]
mov rdx, rbx
call fcn.140009920
test rax, rax
jne 0x14004e3c6
mov rcx, rbx
call fcn.14004c9c0
test eax, eax
je 0x14004e3a4
mov rcx, rbx
call fcn.140006db0
mov ecx, 0x104
call fcn.140008f40
mov rbx, rax
test rax, rax
je 0x14004e3c6
xor edx, edx
mov r8d, 0x104
mov rcx, rax
call fcn.1400082a0
lea rdx, [rsp + 0x190]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x14004e3fd
or r9, 0xffffffffffffffff
lea r8, [rsp + 0x1bc]
mov edx, 0x104
mov rcx, rbx
call fcn.140009db0
test rbx, rbx
jne 0x14004e377
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x14004e40d
mov esi, 0x3eb
test rbx, rbx
je 0x14004e41a
mov rcx, rbx
call fcn.140006db0
mov eax, esi
mov rcx, qword [rsp + 0x600]
xor rcx, rsp
call fcn.14000d260
mov rbx, qword [rsp + 0x648]
add rsp, 0x610
pop rdi
pop rsi
pop rbp
ret