Function at 0x1400199f0
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
movaps xmmword [rsp + 0x170], xmm7
movaps xmmword [rsp + 0x160], xmm6
mov qword [rsp + 0x38], rdx
mov rdi, rcx
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x158], rax
movaps xmm6, xmmword [0x140146a10]
lea rsi, [rsp + 0xb0]
movaps xmmword [rsi + 0x40], xmm6
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
lea rdx, str.Next
lea r8, str..._.._base_files_file_enumerator_win.cc
lea rbx, [rsp + 0x130]
mov rcx, rbx
mov r9d, 0x83
call fcn.140003270
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.140014670
lea r12, [rdi + 4]
lea r13, [rdi + 0x2a8]
lea r14, [rdi + 0x260]
lea rax, [rdi + 0x280]
mov qword [rsp + 0x30], rax
lea rbp, [rdi + 0x30]
xorps xmm7, xmm7
lea rsi, [rsp + 0x90]
cmp byte [rdi], 0
je 0x140019ae8
mov rcx, qword [rdi + 0x258]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140019cbe
mov rcx, qword [rdi + 0x258]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rdi + 0x258], 0xffffffffffffffff
jmp 0x140019cbe
mov rax, qword [rdi + 0x2c0]
cmp qword [rdi + 0x2b8], rax
je 0x14001a0ab
test rax, rax
mov rcx, qword [rdi + 0x2b0]
mov rdx, rax
cmove rdx, rcx
dec rdx
cmp rcx, rdx
jb 0x14001a1a6
mov rcx, qword [r13]
lea rbx, [rdx + rdx*2]
lea rdx, [rcx + rbx*8]
cmp r14, rdx
lea rsi, [rsp + 0x130]
je 0x140019b53
movzx r8d, byte [rdx + 0x17]
test r8b, r8b
jns 0x140019b44
mov r8, qword [rcx + rbx*8 + 8]
mov rdx, qword [rdx]
mov rcx, r14
call fcn.14001d2fe
mov rax, qword [rdi + 0x2c0]
mov rdx, qword [rdi + 0x2b0]
test rax, rax
je 0x140019b74
lea rcx, [rax - 1]
mov qword [rdi + 0x2c0], rcx
cmp rdx, rax
jae 0x140019b82
jmp 0x14001a1af
lea rcx, [rdx - 1]
mov qword [rdi + 0x2c0], rcx
mov rax, rdx
cmp rdx, rcx
jb 0x14001a1a9
movabs rdx, 0x8000000000000000
cmp rax, rdx
je 0x14001a1ac
mov rax, qword [r13]
lea rcx, [rcx + rcx*2]
cmp byte [rax + rcx*8 + 0x17], 0
jns 0x140019bb9
lea rax, [rax + rcx*8]
mov rcx, qword [rax]
call fcn.14010b880
mov rcx, r13
call fcn.14009af50
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x140], rax
movaps xmmword [rsp + 0x130], xmm6
mov eax, dword [rdi + 0x298]
cmp eax, 1
je 0x140019c1a
test eax, eax
jne 0x140019c4a
movzx eax, byte [rdi + 0x297]
test al, al
mov rcx, qword [rdi + 0x280]
cmovns rcx, qword [rsp + 0x30]
mov qword [rsp + 0x118], rcx
cmovs rax, qword [rdi + 0x288]
mov qword [rsp + 0x120], rax
jmp 0x140019c35
lea rax, [0x14014d71a]
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x120], 1
mov rcx, r14
mov rdx, rsi
lea r8, [rsp + 0x118]
call fcn.140028c70
jmp 0x140019c5e
movaps xmmword [rsp + 0x130], xmm7
mov qword [rsp + 0x140], 0
cmp byte [rsp + 0x147], 0
jns 0x140019c70
mov rsi, qword [rsp + 0x130]
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov edx, 1
mov r8, r12
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov qword [rdi + 0x258], rax
mov byte [rdi], 1
cmp byte [rsp + 0x147], 0
lea rsi, [rsp + 0x90]
jns 0x140019cbe
mov rcx, qword [rsp + 0x130]
call fcn.14010b880
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rdi + 0x258], 0xffffffffffffffff
je 0x140019cff
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xa0], rax
movaps xmmword [rsp + 0x90], xmm6
mov qword [rsp + 0x80], rbp
test rbp, rbp
je 0x140019d41
mov rcx, rbp
call fcn.14010b924
jmp 0x140019d43
mov r15d, eax
mov byte [rdi], 0
cmp dword [rdi + 0x298], 0
jne 0x140019d25
mov r8d, 1
mov rcx, qword [rsp + 0x30]
lea rdx, [0x14014d71a]
call fcn.14001d2fe
cmp r15d, 0x12
je 0x140019aae
cmp dword [rdi + 0x29c], 0
je 0x140019aae
jmp 0x14001a09d
xor eax, eax
mov qword [rsp + 0x88], rax
mov rcx, rsi
lea rdx, [rsp + 0x80]
call fcn.1400473f0
mov rcx, rdi
mov rdx, rsi
call fcn.140024c30
test al, al
je 0x140019d7d
cmp byte [rsp + 0xa7], 0
js 0x140019f2e
jmp 0x140019aae
mov bl, byte [rdi + 4]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmmword [rsp + 0x60], xmm6
mov rcx, r14
lea rdx, [rsp + 0x60]
mov r8, rsi
call fcn.140028c10
mov r15d, 1
test bl, 0x10
je 0x140019ddf
mov r15d, 2
cmp byte [rdi + 0x278], 0
je 0x140019ddf
cmp byte [rsp + 0x77], 0
lea rcx, [rsp + 0x60]
jns 0x140019dcf
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xa
jae 0x140019f40
test dword [rdi + 0x27c], r15d
lea rsi, [rsp + 0x130]
je 0x140019f07
mov eax, dword [rdi + 0x298]
cmp eax, 1
je 0x140019e0c
test eax, eax
jne 0x140019f07
jmp 0x14001a06d
movaps xmmword [rsp + 0x140], xmm6
movaps xmmword [rsp + 0x130], xmm6
lea rax, str.api_ms_win_downlevel_shlwapi_l1_1_0.dll
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], 0x27
lea rbx, [rsp + 0x118]
mov rcx, rbx
lea rdx, [rsp + 0x108]
call fcn.1400473f0
mov rcx, rsi
mov rdx, rbx
call fcn.1400a5970
cmp byte [rsp + 0x12f], 0
jns 0x140019e71
mov rcx, qword [rsp + 0x118]
call fcn.14010b880
cmp qword [rsp + 0x138], 0
je 0x140019ec1
mov rcx, rsi
lea rdx, [0x14014d79c]
call fcn.140104100
test rax, rax
je 0x140019ec1
mov rdx, qword [rsp + 0x30]
cmp byte [rdx + 0x17], 0
jns 0x140019ea3
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
cmp byte [rsp + 0xa7], 0
lea rcx, [rsp + 0x90]
jns 0x140019ebd
mov rcx, qword [rsp + 0x90]
call rax
jmp 0x140019ef4
mov rdx, qword [rsp + 0x30]
cmp byte [rdx + 0x17], 0
jns 0x140019ed4
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax]
cmp byte [rsp + 0xa7], 0
lea rcx, [rsp + 0x90]
jns 0x140019eee
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
mov ebx, eax
mov rcx, rsi
call fcn.1401040c0
cmp ebx, 1
je 0x14001a06d
cmp byte [rsp + 0x77], 0
jns 0x140019f18
mov rcx, qword [rsp + 0x60]
call fcn.14010b880
cmp byte [rsp + 0xa7], 0
lea rsi, [rsp + 0x90]
jns 0x140019aae
mov rcx, qword [rsp + 0x90]
call fcn.14010b880
jmp 0x140019aae
mov rcx, r13
call fcn.1400193e0
mov rax, qword [rdi + 0x2c0]
cmp qword [rdi + 0x2b0], rax
jb 0x14001a1b2
mov rcx, qword [r13]
lea r8, [rax + rax*2]
lea rsi, [rcx + r8*8]
movups xmmword [rsi], xmm7
mov qword [rsi + 0x10], 0
cmp byte [rsp + 0x77], 0
js 0x140019f90
mov rax, qword [rsp + 0x70]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi], xmm0
jmp 0x14001a02e
mov rbx, qword [rsp + 0x68]
movabs rax, 0x8000000000000000
add rax, 0xffffffffffffffef
cmp rbx, rax
ja 0x14001a1b5
mov rdx, qword [rsp + 0x60]
cmp rbx, 0xb
jb 0x14001a014
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
lea rbx, [rax + 8]
and rbx, 0xfffffffffffffff8
mov qword [rsp + 0x50], rcx
lea rcx, [rbx + rbx]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x48], r8
call fcn.14010b888
mov rdx, qword [rsp + 0x58]
mov qword [rsi], rax
movabs rcx, 0x8000000000000000
or rbx, rcx
mov rcx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov qword [rcx + rsi*8 + 0x10], rbx
mov rbx, qword [rsp + 0x40]
mov qword [rcx + rsi*8 + 8], rbx
mov rsi, rax
jmp 0x14001a01c
mov byte [rsi + 0x17], bl
test rbx, rbx
je 0x14001a028
lea r8, [rbx + rbx]
mov rcx, rsi
call fcn.1401107e0
mov word [rsi + rbx*2], 0
mov rax, qword [rdi + 0x2b0]
mov rcx, qword [rdi + 0x2c0]
lea rdx, [rax - 1]
lea rbx, [rcx + 1]
cmp rcx, rdx
mov ecx, 0
cmovne rcx, rbx
mov qword [rdi + 0x2c0], rcx
test rcx, rcx
cmove rcx, rax
dec rcx
cmp rax, rcx
jae 0x140019ddf
int3
xorps xmm0, xmm0
mov rdi, qword [rsp + 0x38]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
cmp byte [rsp + 0x77], 0
js 0x14001a0c3
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rdi], xmm0
jmp 0x14001a14b
mov ecx, r15d
call fcn.140028200
mov dword [rdi + 0x2a0], eax
xorps xmm0, xmm0
mov rdi, qword [rsp + 0x38]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
jmp 0x14001a162
mov rbx, qword [rsp + 0x68]
movabs rax, 0x8000000000000000
add rax, 0xffffffffffffffef
cmp rbx, rax
ja 0x14001a1bd
mov r14, qword [rsp + 0x60]
cmp rbx, 0xb
jb 0x14001a11a
lea rbp, [rbx + 8]
and rbp, 0xfffffffffffffff8
mov rcx, rbp
add rcx, rbp
call fcn.14010b888
mov rsi, rax
mov qword [rdi], rax
movabs rax, 0x8000000000000000
or rbp, rax
mov qword [rdi + 0x10], rbp
mov qword [rdi + 8], rbx
jmp 0x14001a125
mov byte [rdi + 0x17], bl
mov rsi, rdi
test rbx, rbx
je 0x14001a134
lea r8, [rbx + rbx]
mov rcx, rsi
mov rdx, r14
call fcn.1401107e0
mov word [rsi + rbx*2], 0
cmp byte [rsp + 0x77], 0
jns 0x14001a14b
mov rcx, qword [rsp + 0x60]
call fcn.14010b880
cmp byte [rsp + 0xa7], 0
jns 0x14001a162
mov rcx, qword [rsp + 0x90]
call fcn.14010b880
lea rcx, [rsp + 0xb0]
call fcn.14000a640
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.14010e4a0
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x160]
movaps xmm7, xmmword [rsp + 0x170]
add rsp, 0x188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
int3
int3
int3
int3
int3
mov rcx, rsi
call fcn.1400786f8
mov rcx, rdi
call fcn.1400786f8
int3