Function at 0x14009ae90
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2c8]
sub rsp, 0x3a0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402a98a8]
xor rax, rsp
mov qword [rbp + 0x290], rax
mov r13, rcx
xor ebx, ebx
mov edi, ebx
mov dword [rsp + 0x30], ebx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x1401e5030]
movdqu xmmword [rbp + 0x30], xmm1
mov word [rbp + 0x20], bx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7d8
mov rcx, qword [rcx + 8]
call fcn.14000fa10
lea r9, [rax - 0x104]
mov qword [rsp + 0x20], rax
mov r8d, 0x105
lea rdx, [rbp + 0x40]
mov rcx, qword [r13 + 8]
call fcn.140112f80
lea rax, [rbp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140013d82
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.140006d70
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], rbx
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], 7
mov word [rbp - 0x20], bx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1401e5030]
movdqu xmmword [rbp + 0x10], xmm1
mov word [rbp], bx
lea r8, [rbp]
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x20]
call fcn.140011d20
test al, al
je 0x1400142d5
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bx
lea rdx, [rbp]
lea rcx, [rsp + 0x60]
call fcn.1400118d0
nop
lea r8, [0x1401e62d0]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x40]
call fcn.140001cc0
nop
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400141da
mov r15d, ebx
nop
inc r15d
cmp r15d, 0x7d0
ja 0x1400140dd
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], bx
lea rax, [rbp + 0x6c]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140013e83
lea rdx, [rbp + 0x6c]
lea rcx, [rbp - 0x60]
call fcn.140006d70
nop
or edi, 1
mov dword [rsp + 0x30], edi
lea r8, [rbp - 0x60]
mov rsi, qword [rbp - 0x60]
mov r14, qword [rbp - 0x48]
cmp r14, 8
cmovae r8, rsi
cmp qword [rbp - 0x50], 1
jne 0x140013ef3
mov edx, 1
lea rax, [0x1401e5cd0]
mov rcx, rax
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140013ef3
add rcx, 2
sub rdx, 1
jne 0x140013ed0
mov r10, qword [rbp - 0x68]
mov r9, qword [rbp - 0x80]
mov bl, 1
jmp 0x140013f8a
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], bx
lea rax, [rbp + 0x6c]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140013f20
lea rdx, [rbp + 0x6c]
lea rcx, [rbp - 0x80]
call fcn.140006d70
nop
or edi, 2
mov dword [rsp + 0x30], edi
lea r8, [rbp - 0x80]
mov r9, qword [rbp - 0x80]
mov r10, qword [rbp - 0x68]
cmp r10, 8
cmovae r8, r9
cmp qword [rbp - 0x70], 2
jne 0x140013f88
mov edx, 2
lea rax, [0x1401e62d8]
mov rcx, rax
sub r8, rax
nop dword [rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140013f88
add rcx, 2
sub rdx, 1
jne 0x140013f70
mov bl, 1
jmp 0x140013f8a
xor bl, bl
test dil, 2
je 0x140013fe4
and edi, 0xfffffffd
mov dword [rsp + 0x30], edi
cmp r10, 8
jb 0x140013fd2
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x140013fca
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400143ff
mov rcx, r9
call fcn.1401812c4
xor eax, eax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], ax
test dil, 1
je 0x14001403e
and edi, 0xfffffffe
mov dword [rsp + 0x30], edi
cmp r14, 8
jb 0x14001402c
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140014024
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014405
mov rcx, rsi
call fcn.1401812c4
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], ax
test bl, bl
jne 0x1400140c6
cmp qword [rsp + 0x50], 0
je 0x140014065
mov r8d, 1
lea rdx, [0x1401e4760]
lea rcx, [rsp + 0x40]
call fcn.140006aa0
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.140006aa0
lea rax, [rbp + 0x6c]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140014090
lea rdx, [rbp + 0x6c]
lea rcx, [rsp + 0x40]
call fcn.140006aa0
test byte [rbp + 0x40], 0x10
je 0x1400140c6
mov r8d, 1
lea rdx, [0x1401e62c8]
lea rcx, [rsp + 0x40]
call fcn.140006aa0
lea rdx, [rbp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor ebx, ebx
test eax, eax
jne 0x140013e50
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x140014127
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014122
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400143f9
call fcn.1401812c4
movdqa xmm0, xmmword [0x1401e5030]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], bx
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14001417a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014175
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001440b
call fcn.1401812c4
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], bx
xor r9d, r9d
mov edx, 0x83a
lea r8d, [r9 + 0xa]
mov rcx, qword [r13 + 8]
call fcn.14000fa10
xor r9d, r9d
mov edx, 0x843
lea r8d, [r9 + 1]
mov rcx, qword [r13 + 8]
call fcn.14000fa10
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r8, qword [rsp + 0x40]
mov rdx, qword [rbp - 0x10]
mov rcx, qword [r13 + 8]
call fcn.14011be20
jmp 0x140014280
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14001421a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014215
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014411
call fcn.1401812c4
movdqa xmm0, xmmword [0x1401e5030]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], bx
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14001426d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014268
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014417
call fcn.1401812c4
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], bx
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400142c2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400142bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001441d
call fcn.1401812c4
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bx
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x140014315
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014310
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014423
call fcn.1401812c4
movdqa xmm0, xmmword [0x1401e5030]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], bx
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x140014366
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014361
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014429
call fcn.1401812c4
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], 7
mov word [rbp - 0x20], bx
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x1400143b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400143ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400143f3
call fcn.1401812c4
movdqa xmm0, xmmword [0x1401e5030]
movdqu xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x20], bx
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.1401813e0
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1401a2d8c
nop
call fcn.1401a2d8c
nop
call fcn.1401a2d8c
nop
call fcn.1401a2d8c
nop
call fcn.1401a2d8c
nop
call fcn.1401a2d8c
nop
call fcn.1401a2d8c
nop
call fcn.1401a2d8c
nop
call fcn.1401a2d8c
nop
call fcn.1401a2d8c
int3
mov rdx, rcx
lea rax, [rcx + 0x6f0]
mov r8d, 0x328
mov ecx, 0x1e0
cmp qword [rdx + 0x8d0], rax
cmovne ecx, r8d
add rcx, rdx
jmp 0x140013ce0