Function at 0x140059da0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x1400ade58]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rdi, r8
mov r14b, dl
mov qword [rsp + 0x48], r8
xor r15d, r15d
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r15w
mov rdx, rcx
lea rcx, [rsp + 0x58]
call fcn.14000740c
nop
xor r8d, r8d
lea rdx, [0x140092a6c]
lea rcx, [rsp + 0x58]
call fcn.140059c94
nop
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rbp - 0x80]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileExW]
nop dword [rax + rax]
mov rsi, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
jne 0x140059e80
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov ebx, ecx
test ecx, ecx
jns 0x140059e83
cmp ecx, 0x80070003
jne 0x140059f60
jmp 0x140059f40
mov ebx, r15d
mov byte [rsp + 0x30], 1
mov eax, dword [rbp - 0x80]
shr eax, 4
and al, 1
test r14b, r14b
je 0x140059ebf
test al, al
je 0x140059f02
movzx eax, word [rbp - 0x52]
cmp word [rbp - 0x54], 0x2e
jne 0x140059ec3
test ax, ax
je 0x140059f02
cmp word [rbp - 0x54], 0x2e
jne 0x140059ec3
cmp ax, 0x2e
jne 0x140059ec3
cmp word [rbp - 0x50], r15w
jne 0x140059ec3
jmp 0x140059f02
test al, al
jne 0x140059f02
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x54]
mov qword [rsp + 0x40], rax
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x140059f45
mov rax, qword [rcx]
movabs r10, 0xc6f03f65785a9370
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov rax, qword [rax + 0x10]
call qword [case.0x1400620e5.0]
mov ebx, eax
test ebx, ebx
js 0x140059f60
cmp byte [rsp + 0x30], r15b
je 0x140059f60
lea rdx, [rbp - 0x80]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
nop dword [rax + rax]
test eax, eax
jne 0x140059e88
cmp byte [rsp + 0x30], r15b
je 0x140059f60
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x12
jne 0x140059f52
mov ebx, r15d
jmp 0x140059f60
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xbad_function_call_void_]
nop dword [rax + rax]
int3
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140059f7a
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
nop dword [rax + rax]
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140059f97
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
call fcn.140007d20
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r15w
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x140059fd5
mov rax, qword [rcx]
cmp rcx, rdi
setne dl
movabs r10, 0xed1dae5b305f0370
mov rax, qword [rax + 0x20]
call qword [case.0x1400620e5.0]
mov qword [rdi + 0x38], r15
mov eax, ebx
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14007c650
mov rbx, qword [rsp + 0x318]
add rsp, 0x2e0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret