Function at 0x140056470
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x780
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rsp + 0x770], rax
mov r12, r9
mov r15d, r8d
mov edi, edx
mov qword [rsp + 0x88], rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
lea rdx, str.CheckRunEnvironment::CheckMediaTypeStyle
lea rcx, [rsp + 0xb0]
call fcn.14001abe0
nop
lea r14, [0x1402a8360]
mov rcx, qword [0x1402a8360]
cmp rcx, r14
je 0x14005650f
test byte [rcx + 0x1c], 1
je 0x14005650f
lea rsi, [0x1402bbdb0]
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
lea edx, [rbx + 0x4f]
lea r8, [0x1402559c8]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
jmp 0x140056516
lea rsi, [0x1402bbdb0]
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x50], ebx
lea rcx, [rsp + 0x98]
call fcn.1401bb788
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x350]
call fcn.1401e7e40
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x100]
call fcn.1401e7e40
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1400570a1
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x78], rax
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1400570ac
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
add rax, 0x18
mov qword [rsp + 0x38], rax
call fcn.1401bb0c4
mov rcx, rax
test rax, rax
je 0x1400570b7
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x560]
call fcn.1401e7e40
lea rdx, [rsp + 0x560]
call fcn.1400d96d0
lea rcx, [rsp + 0x560]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rdx, str.InsDrv.ini
lea rcx, [rsp + 0x560]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
test edi, edi
je 0x140056674
sub edi, 1
je 0x14005664b
cmp edi, 1
jne 0x1400566a4
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0x38]
call qword [case.0x1400136d6.0]
mov rdi, rax
jmp 0x14005669b
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
call qword [case.0x1400136d6.0]
mov rdi, rax
jmp 0x14005669b
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0x28]
call qword [case.0x1400136d6.0]
mov rdi, rax
test rdi, rdi
jne 0x1400567bc
lea rdx, [rbx - 0x18]
mov r13, 0xffffffffffffffff
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400566d0
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400566fa
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x140056723
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
call fcn.1401bb8b4
nop
lea rcx, vtable.WppTrace.0
mov qword [rsp + 0xb0], rcx
cmp byte [rsp + 0xb8], 0
jne 0x14005679b
mov rcx, qword [0x1402a8360]
cmp rcx, r14
je 0x14005679b
test byte [rcx + 0x1c], 1
je 0x14005679b
lea rax, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 8
cmovae rax, qword [rsp + 0xc0]
cmp qword [0x1402bbdc8], 8
cmovae rsi, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], rax
mov r9, rsi
lea r8, [0x140252818]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
lea rcx, [rsp + 0xe0]
call fcn.1400048a0
lea rcx, [rsp + 0xc0]
call fcn.1400048a0
xor eax, eax
jmp 0x140057074
lea rcx, [rsp + 0x560]
mov r13, 0xffffffffffffffff
mov rax, r13
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400567d0
mov r8d, eax
lea rdx, [rsp + 0x560]
lea rcx, [rsp + 0x38]
call fcn.140004e60
mov rax, r13
inc rax
cmp word [rdi + rax*2], 0
jne 0x1400567f2
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140004e60
mov edx, 0x5c
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.1401e768c
test rax, rax
jne 0x140056828
mov eax, r13d
jmp 0x14005682e
sub rax, rbx
sar rax, 1
mov r8d, eax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x38]
call fcn.140004340
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400568a7
cmp dword [rbx + 0x10], 0
jl 0x140056898
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140056898
call fcn.140004d00
mov rdi, rax
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14005688d
lfence
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x1400568a7
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140004e60
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400568e0
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 0x10], 0
jl 0x140056b34
lea rdx, [0x140255530]
mov rcx, rbx
call fcn.1401e7270
test rax, rax
je 0x140056b34
sub rax, rbx
sar rax, 1
test eax, eax
jne 0x140056b34
lea edx, [rax + 0x5c]
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call fcn.1401e768c
test rax, rax
jne 0x14005692f
mov eax, r13d
jmp 0x140056935
sub rax, rdi
sar rax, 1
xor ecx, ecx
mov r14d, ecx
test eax, eax
cmovns r14d, eax
cmp r14d, dword [rdi - 0x10]
jl 0x140056960
lea rcx, [rdi - 0x18]
call fcn.140004d00
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
mov rsi, rbx
jmp 0x140056a06
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x14005697e
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
jne 0x14005699f
call fcn.1401bb0c4
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
je 0x1400570c2
lfence
mov rax, qword [rcx]
mov r8d, 2
mov edx, r14d
mov rax, qword [rax]
call qword [case.0x1400136d6.0]
test rax, rax
je 0x1400570cc
lea rbx, [rax + 0x18]
mov rsi, rbx
mov qword [rsp + 0x60], rbx
test r14d, r14d
js 0x1400570d1
cmp r14d, dword [rbx - 0xc]
jg 0x1400570d1
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
lea r8, [rax + rax]
xor eax, eax
mov word [rbx + r8], ax
mov rdi, qword [rsp + 0x38]
test r8, r8
je 0x140056a06
mov rdx, rdi
mov rcx, rbx
call fcn.1401e7770
or dword [rsp + 0x30], 2
lea rcx, [rsi - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140056a73
cmp dword [rdi + 0x10], 0
jl 0x140056a61
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140056a61
call fcn.140004d00
mov rbx, rax
mov ecx, r13d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x140056a51
lfence
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x38], rax
mov rbx, qword [rsp + 0x60]
jmp 0x140056a73
mov r8d, dword [rsi - 0x10]
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140004e60
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140056a97
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
mov rdi, qword [rsp + 0x40]
mov r9d, dword [rdi - 0x10]
add r9d, 0xfffffffd
mov r8d, 3
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.14002eaa0
or dword [rsp + 0x30], 1
mov rbx, qword [rsp + 0x68]
lea rcx, [rbx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140056b2b
cmp dword [rdi + 0x10], 0
jl 0x140056b19
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140056b19
call fcn.140004d00
mov rbx, rax
mov ecx, r13d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x140056b09
lfence
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x40], rax
mov rbx, qword [rsp + 0x68]
jmp 0x140056b2b
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140004e60
nop
lea rdx, [rbx - 0x18]
jmp 0x1400568b3
mov r9, rbx
mov r8, qword [rsp + 0x38]
lea rdx, [0x140252608]
lea rcx, [rsp + 0x350]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x350]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [rsp + 0x350]
mov rax, r13
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140056b70
mov r8d, eax
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x38]
call fcn.140004e60
mov rsi, qword [rsp + 0x38]
xor edi, edi
test r15d, r15d
jle 0x140056ba8
mov eax, edi
cmp dword [rsi - 0x10], r15d
setg al
mov dword [r12], eax
lea rdx, [0x1402557a0]
lea rcx, [rsp + 0x350]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x350]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
mov qword [rsp + 0x70], rax
cmp rax, 0xffffffffffffffff
je 0x140056f08
mov eax, 1
mov r14d, edi
mov dword [rsp + 0x4c], edi
mov edi, dword [rsp + 0x48]
test edi, edi
jne 0x140056efd
test eax, eax
je 0x140056efd
lea rdx, [0x140252314]
lea rcx, [rsp + 0x12c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140056ee7
lea rdx, [0x140255880]
lea rcx, [rsp + 0x12c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140056ee7
test byte [rsp + 0x100], 0x10
je 0x140056e16
mov rcx, qword [rsi - 0x18]
test rcx, rcx
je 0x140056c6b
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
jne 0x140056c8c
call fcn.1401bb0c4
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rcx, rax
test rax, rax
je 0x1400570dc
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x58], rdi
or dword [rsp + 0x30], 4
lea rax, [rsp + 0x12c]
mov r14, r13
inc r14
cmp word [rax + r14*2], 0
jne 0x140056cb2
movsxd r12, dword [rsi - 0x10]
lea r15d, [r12 + r14]
test r15d, r15d
js 0x1400570e7
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r15d
or eax, ecx
jge 0x140056cff
lfence
mov edx, r15d
lea rcx, [rsp + 0x58]
call fcn.140004e00
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
add r12, r12
je 0x140056d29
test rdi, rdi
jne 0x140056d1b
call fcn.1401ec568
mov dword [rax], socket
call fcn.1401ec3fc
jmp 0x140056d29
mov r8, r12
mov rdx, rsi
mov rcx, rdi
call fcn.1401e7770
movsxd r8, r14d
add r8, r8
lea rcx, [r12 + rdi]
je 0x140056d59
test rcx, rcx
jne 0x140056d4c
call fcn.1401ec568
mov dword [rax], socket
call fcn.1401ec3fc
jmp 0x140056d59
lea rdx, [rsp + 0x12c]
call fcn.1401e7770
cmp r15d, dword [rdi - 0xc]
jg 0x1400570f1
mov dword [rdi - 0x10], r15d
movsxd rax, r15d
xor ecx, ecx
mov word [rdi + rax*2], cx
lea rcx, [rdi - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140056dd7
cmp dword [rbx + 0x10], 0
jl 0x140056dc6
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140056dc6
call fcn.140004d00
mov rdi, rax
mov eax, r13d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140056db6
lfence
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x40], rax
mov rdi, qword [rsp + 0x58]
jmp 0x140056dd7
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140004e60
and dword [rsp + 0x30], 0xfffffffb
lea rdx, [rdi - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140056e00
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov r14d, dword [rsp + 0x4c]
mov r15, qword [rsp + 0x70]
jmp 0x140056e8a
lea rcx, [rsi - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x140056e82
cmp dword [rdi + 0x10], 0
jl 0x140056e6c
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140056e6c
call fcn.140004d00
mov rbx, rax
mov eax, r13d
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x140056e5c
lfence
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
add rbx, 0x18
mov qword [rsp + 0x40], rbx
mov rsi, qword [rsp + 0x38]
jmp 0x140056e82
mov r8d, dword [rsi - 0x10]
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.140004e60
mov rbx, qword [rsp + 0x40]
inc r14d
mov dword [rsp + 0x4c], r14d
cmp r14d, 2
jl 0x140056ea8
test rbx, rbx
je 0x1400570fc
mov rdx, rbx
mov rcx, rsi
call fcn.1401ecc18
test eax, eax
je 0x140056ee3
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
mov rdx, rbx
mov rax, qword [rax + 0x80]
call qword [case.0x1400136d6.0]
mov edi, eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x50], eax
lea rdx, [rsp + 0x100]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x140056bf5
mov edi, dword [rsp + 0x48]
lea rdx, [rsp + 0x100]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x140056bf5
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x140056f0c
mov edi, dword [rsp + 0x48]
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140056f31
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140056f5b
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x140056f84
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400136d6.0]
nop
jmp 0x140056f8a
lea rbx, [0x1402bbdb0]
lea r14, [0x1402a8360]
call fcn.1401bb8b4
nop
mov dl, 1
mov byte [rsp + 0xb8], dl
mov rax, qword [0x1402a8360]
cmp rax, r14
je 0x140056ff3
test byte [rax + 0x1c], dl
je 0x140056ff3
mov r9, rbx
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x50
mov dword [rsp + 0x20], edi
lea r8, [0x1402559c8]
mov rcx, qword [rax + 0x10]
call fcn.140001b40
movzx edx, byte [rsp + 0xb8]
mov rax, qword [0x1402a8360]
lea rcx, vtable.WppTrace.0
mov qword [rsp + 0xb0], rcx
test dl, dl
jne 0x140057058
cmp rax, r14
je 0x140057058
test byte [rax + 0x1c], 1
je 0x140057058
lea rcx, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 8
cmovae rcx, qword [rsp + 0xc0]
cmp qword [0x1402bbdc8], 8
cmovae rbx, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], rcx
mov r9, rbx
lea r8, [0x140252818]
mov rcx, qword [rax + 0x10]
call fcn.140006c90
lea rcx, [rsp + 0xe0]
call fcn.1400048a0
lea rcx, [rsp + 0xc0]
call fcn.1400048a0
mov eax, edi
mov rcx, qword [rsp + 0x770]
xor rcx, rsp
call fcn.1401e2900
lea r11, [rsp + 0x780]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
call fcn.1400051f0
mov ecx, 0x80070057
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
int3
mov ecx, 0x80070057
call fcn.140001470
mov ecx, 0x80070057
call fcn.140001470
nop
mov ecx, 0x80004005
call fcn.140001470
int3