Function at 0x14001f7ee
Capabilities:
Enumerate files on windows

Disassembly:
jmp 0x14002c550
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xc48
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x21a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xc68]
mov rax, qword [0x14006b028]
xor rax, rbp
mov qword [rbp + 0xc10], rax
lea rcx, [0x1400780fe]
call fcn.14001ff23
mov qword [rbp + 8], 0
lea rax, [rbp + 8]
mov qword [rbp + 0x10], rax
xor eax, eax
test eax, eax
jne 0x14002c59d
mov ecx, gethostname
call fcn.14001f096
mov qword [rbp + 0x808], rax
cmp qword [rbp + 0x808], 0
je 0x14002c5e3
mov rcx, qword [rbp + 0x808]
call fcn.14001fbb8
mov qword [rbp + 0xbf8], rax
jmp 0x14002c5ee
mov qword [rbp + 0xbf8], 0
mov rax, qword [rbp + 0xbf8]
mov qword [rbp + 0x38], rax
cmp qword [rbp + 0x38], 0
jne 0x14002c611
mov rcx, qword [rbp + 0xc40]
call fcn.14001fcfd
jmp 0x14002cbcd
mov rax, qword [rbp + 0x38]
mov rdx, qword [rbp + 0xc40]
mov rcx, rax
call fcn.14001fde3
mov rax, qword [rbp + 0x38]
mov qword [rax + 0x28], 0
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x10]
mov qword [rax + 0x30], rcx
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x38]
mov qword [rax], rcx
mov rax, qword [rbp + 0x38]
add rax, 0x28
mov qword [rbp + 0x10], rax
xor eax, eax
test eax, eax
jne 0x14002c624
cmp qword [rbp + 8], 0
je 0x14002cbc1
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2c8], rax
cmp qword [rbp + 0x2c8], 0
jne 0x14002c67e
jmp 0x14002cbc1
mov rax, qword [rbp + 0x2c8]
mov rdx, rax
lea rcx, [rbp + 0x2e8]
call fcn.14001f02d
nop
lea rax, [rbp + 0x828]
mov qword [rbp + 0x868], rax
lea rdx, [rbp + 0x2e8]
mov rcx, qword [rbp + 0x868]
call fcn.14001f02d
mov qword [rbp + 0xbf8], rax
mov rdx, qword [rbp + 0xbf8]
lea rcx, [rbp + 0x328]
call fcn.14002c2f0
nop
lea rcx, [rbp + 0x328]
call fcn.14001f519
lea rdx, [rbp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x368], rax
cmp qword [rbp + 0x368], 0xffffffffffffffff
jne 0x14002c807
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xbf4], eax
lea rcx, [rbp + 0x2e8]
call fcn.14001f519
mov qword [rbp + 0xbf8], rax
lea rdx, str.FindFirstFile_fails_in_directory__s._GetLastError___lu.
lea rcx, [rbp + 0x890]
call fcn.14001fc62
mov rcx, rax
call fcn.14001f6d1
mov ecx, dword [rbp + 0xbf4]
mov r8d, ecx
mov rcx, qword [rbp + 0xbf8]
mov rdx, rcx
mov rcx, rax
call fcn.14001f780
mov rax, qword [rbp + 0x2c8]
cmp qword [rax + 0x28], 0
je 0x14002c77e
mov rax, qword [rbp + 0x2c8]
mov rax, qword [rax + 0x28]
mov rcx, qword [rbp + 0x2c8]
mov rcx, qword [rcx + 0x30]
mov qword [rax + 0x30], rcx
jmp 0x14002c78d
mov rax, qword [rbp + 0x2c8]
mov rax, qword [rax + 0x30]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x2c8]
mov rax, qword [rax + 0x30]
mov rcx, qword [rbp + 0x2c8]
mov rcx, qword [rcx + 0x28]
mov qword [rax], rcx
xor eax, eax
test eax, eax
jne 0x14002c754
mov rax, qword [rbp + 0x2c8]
mov qword [rbp + 0x928], rax
cmp qword [rbp + 0x928], 0
je 0x14002c7de
mov edx, 1
mov rcx, qword [rbp + 0x928]
call fcn.14001f5ff
mov qword [rbp + 0xbf8], rax
jmp 0x14002c7e9
mov qword [rbp + 0xbf8], 0
lea rcx, [rbp + 0x328]
call fcn.14001fcfd
nop
lea rcx, [rbp + 0x2e8]
call fcn.14001fcfd
jmp 0x14002c659
lea rdx, [0x140061e18]
lea rcx, [rbp + 0x944]
call fcn.14001f0dc
mov rcx, rax
call fcn.14001f159
mov rdx, rax
lea rcx, [rbp + 0x8c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x14002c871
lea rdx, [0x140061e1c]
lea rcx, [rbp + 0x964]
call fcn.14001fe33
mov rcx, rax
call fcn.14001fcee
mov rdx, rax
lea rcx, [rbp + 0x8c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x14002c871
mov eax, dword [rbp + 0x60]
and eax, 0x400
test eax, eax
je 0x14002c876
jmp 0x14002cae7
mov eax, dword [rbp + 0x60]
and eax, 0x10
test eax, eax
je 0x14002c9c2
lea rcx, [rbp + 0x8c]
call fcn.14002b630
test eax, eax
je 0x14002c9c2
lea rax, [rbp + 0x988]
mov qword [rbp + 0x9c8], rax
lea rax, [rbp + 0x9e8]
mov qword [rbp + 0xa28], rax
lea rdx, [rbp + 0x8c]
mov rcx, qword [rbp + 0x9c8]
call fcn.14001f500
mov qword [rbp + 0xbf8], rax
mov rax, qword [rbp + 0xbf8]
mov qword [rbp + 0xc00], rax
lea rdx, [rbp + 0x2e8]
mov rcx, qword [rbp + 0xa28]
call fcn.14001f02d
mov qword [rbp + 0xc08], rax
mov r8, qword [rbp + 0xc00]
mov rdx, qword [rbp + 0xc08]
lea rcx, [rbp + 0x388]
call fcn.14002c020
nop
mov ecx, gethostname
call fcn.14001f096
mov qword [rbp + 0xa48], rax
cmp qword [rbp + 0xa48], 0
je 0x14002c941
mov rcx, qword [rbp + 0xa48]
call fcn.14001fbb8
mov qword [rbp + 0xbf8], rax
jmp 0x14002c94c
mov qword [rbp + 0xbf8], 0
mov rax, qword [rbp + 0xbf8]
mov qword [rbp + 0x3c8], rax
mov rax, qword [rbp + 0x3c8]
lea rdx, [rbp + 0x388]
mov rcx, rax
call fcn.14001fde3
mov rax, qword [rbp + 0x3c8]
mov qword [rax + 0x28], 0
mov rax, qword [rbp + 0x3c8]
mov rcx, qword [rbp + 0x10]
mov qword [rax + 0x30], rcx
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x3c8]
mov qword [rax], rcx
mov rax, qword [rbp + 0x3c8]
add rax, 0x28
mov qword [rbp + 0x10], rax
xor eax, eax
test eax, eax
jne 0x14002c970
lea rcx, [rbp + 0x388]
call fcn.14001fcfd
jmp 0x14002cae7
lea rcx, [rbp + 0x8c]
call fcn.14002b890
test eax, eax
je 0x14002cae7
lea rax, [rbp + 0xa68]
mov qword [rbp + 0xaa8], rax
lea rax, [rbp + 0xac8]
mov qword [rbp + 0xb08], rax
lea rdx, [rbp + 0x8c]
mov rcx, qword [rbp + 0xaa8]
call fcn.14001f500
mov qword [rbp + 0xbf8], rax
mov rax, qword [rbp + 0xbf8]
mov qword [rbp + 0xc00], rax
lea rdx, [rbp + 0x2e8]
mov rcx, qword [rbp + 0xb08]
call fcn.14001f02d
mov qword [rbp + 0xc08], rax
mov r8, qword [rbp + 0xc00]
mov rdx, qword [rbp + 0xc08]
lea rcx, [rbp + 0x3e8]
call fcn.14002c020
nop
lea rax, [rbp + 0xb28]
mov qword [rbp + 0xb68], rax
lea rdx, [rbp + 0x3e8]
mov rcx, qword [rbp + 0xb68]
call fcn.14001f02d
mov qword [rbp + 0xbf8], rax
mov rdx, qword [rbp + 0xbf8]
mov ecx, dword [rbp + 0xc48]
call fcn.14001f3f7
mov dword [rbp + 0x424], eax
cmp dword [rbp + 0x424], 0x3a98
jl 0x14002caa6
mov ecx, dword [rbp + 0xc48]
call fcn.14001faf5
lea rax, [rbp + 0xb88]
mov qword [rbp + 0xbc8], rax
lea rdx, [rbp + 0x2e8]
mov rcx, qword [rbp + 0xbc8]
call fcn.14001f02d
mov qword [rbp + 0xbf8], rax
mov rcx, qword [rbp + 0xbf8]
call fcn.14002bb70
nop
lea rcx, [rbp + 0x3e8]
call fcn.14001fcfd
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x368]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14002c807
mov rax, qword [rbp + 0x2c8]
cmp qword [rax + 0x28], 0
je 0x14002cb2a
mov rax, qword [rbp + 0x2c8]
mov rax, qword [rax + 0x28]
mov rcx, qword [rbp + 0x2c8]
mov rcx, qword [rcx + 0x30]
mov qword [rax + 0x30], rcx
jmp 0x14002cb39
mov rax, qword [rbp + 0x2c8]
mov rax, qword [rax + 0x30]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x2c8]
mov rax, qword [rax + 0x30]
mov rcx, qword [rbp + 0x2c8]
mov rcx, qword [rcx + 0x28]
mov qword [rax], rcx
xor eax, eax
test eax, eax
jne 0x14002cb00
mov rax, qword [rbp + 0x2c8]
mov qword [rbp + 0xbe8], rax
cmp qword [rbp + 0xbe8], 0
je 0x14002cb8a
mov edx, 1
mov rcx, qword [rbp + 0xbe8]
call fcn.14001f5ff
mov qword [rbp + 0xbf8], rax
jmp 0x14002cb95
mov qword [rbp + 0xbf8], 0
mov rcx, qword [rbp + 0x368]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rbp + 0x328]
call fcn.14001fcfd
nop
lea rcx, [rbp + 0x2e8]
call fcn.14001fcfd
jmp 0x14002c659
mov rcx, qword [rbp + 0xc40]
call fcn.14001fcfd
lea rcx, [rbp - 0x20]
lea rdx, [0x140061140]
call fcn.14001fc85
mov rcx, qword [rbp + 0xc10]
xor rcx, rbp
call fcn.14001f753
lea rsp, [rbp + 0xc28]
pop rdi
pop rbp
ret