Function at 0x140180d40
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x128
movaps xmmword [rsp + 0x110], xmm6
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x108], rax
movaps xmm6, xmmword [0x14029ca60]
lea r14, [rsp + 0xb0]
movaps xmmword [r14 + 0x30], xmm6
movaps xmmword [r14 + 0x20], xmm6
movaps xmmword [r14 + 0x10], xmm6
movaps xmmword [r14], xmm6
lea rdx, str.Next
lea r8, str.file_enumerator_win.cc
lea r13, [rsp + 0x90]
mov rcx, r13
mov r9d, 0x8b
call fcn.140158eb0
mov rcx, r14
mov rdx, r13
xor r8d, r8d
call fcn.140181c40
lea r14, [rbx + 4]
lea rax, [rbx + 0x260]
mov qword [rsp + 0x38], rax
lea rbp, [rbx + 0x30]
lea rax, [rbx + 0x2b8]
mov qword [rsp + 0x48], rax
lea rax, [rbx + 0x2c0]
mov qword [rsp + 0x30], rax
lea rax, [rbx + 0x2a8]
mov qword [rsp + 0x50], rax
mov r12, qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp byte [rbx], 0
je 0x140181327
mov rcx, qword [rbx + 0x258]
mov rdx, r14
call rdi
test eax, eax
je 0x140181027
call r12
cmp qword [rbx + 0x258], 0xffffffffffffffff
je 0x140181044
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x80], rax
movaps xmmword [rsp + 0x70], xmm6
test rbp, rbp
je 0x1401816e9
mov r12, rsi
mov rsi, r14
mov r14, r13
mov rdi, rbp
mov rcx, rbp
call fcn.1401cc340
mov rbp, rax
movabs rax, 0x8000000000000000
lea r13, [rax - 9]
cmp rbp, r13
ja 0x1401816ec
cmp rbp, 0xa
jbe 0x140181015
mov rax, rbp
and rax, 0xfffffffffffffffc
add rax, 4
mov r15, rbp
or r15, 3
cmp r15, 0xb
cmove r15, rax
inc r15
js 0x1401816c4
lea rcx, [r15 + r15]
call fcn.1401cbbc4
mov rcx, rax
mov qword [rsp + 0x70], rax
movabs rax, 0x8000000000000000
or r15, rax
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x78], rbp
lea r15, [rcx + rbp*2]
cmp rcx, rdi
ja 0x140180ef3
cmp r15, rdi
ja 0x1401816c7
test rbp, rbp
je 0x140180f06
add rbp, rbp
mov rdx, rdi
mov r8, rbp
call fcn.1401d0030
mov word [r15], 0
movzx edx, byte [rsp + 0x87]
test dl, dl
mov rax, qword [rsp + 0x70]
mov r8, qword [rsp + 0x78]
mov r9, rdx
cmovs r9, r8
lea r10, [rsp + 0x70]
cmovs r10, rax
test r9, r9
je 0x140180f58
xor r11d, r11d
xor ecx, ecx
nop word [rax + rax]
cmp word [r10 + r11*2], 0
je 0x14018167e
add rcx, 0xfffffffffffffffe
inc r11
cmp r9, r11
jne 0x140180f40
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xa0], rax
movaps xmmword [rsp + 0x90], xmm6
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0xf0]
call fcn.140173a20
cmp byte [rsp + 0x107], 0
jns 0x14018108c
mov rbp, qword [rsp + 0xf0]
mov r15, qword [rsp + 0xf8]
cmp r15, 0xa
jbe 0x1401810c7
cmp r15, r13
ja 0x1401816ca
mov rax, r15
and rax, 0xfffffffffffffffc
add rax, 4
mov r13, r15
or r13, 3
cmp r13, 0xb
cmove r13, rax
inc r13
js 0x1401816cd
lea rcx, [r13*2]
call fcn.1401cbbc4
mov rcx, rax
mov qword [rsp + 0x90], rax
movabs rax, 0x8000000000000000
or r13, rax
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0x98], r15
mov r13, r14
jmp 0x1401810d5
mov byte [rsp + 0x87], bpl
lea rcx, [rsp + 0x70]
jmp 0x140180ee1
mov rcx, qword [rbx + 0x258]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rbx + 0x258], 0xffffffffffffffff
jmp 0x140180e2a
mov byte [rbx], 0
cmp dword [rbx + 0x298], 0
jne 0x140181071
cmp byte [rbx + 0x297], 0
js 0x1401814f0
lea rcx, [rbx + 0x280]
mov byte [rbx + 0x297], 1
mov dword [rcx], 0x2a
cmp eax, 0x12
je 0x140180e0d
cmp dword [rbx + 0x29c], 0
je 0x140180e0d
jmp 0x140181307
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0xa0], rax
movups xmm0, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x90], xmm0
mov r13, r14
mov r14, rsi
jmp 0x140181107
mov bpl, 1
cmp word [r8], 0x2e
je 0x14018115e
jmp 0x14018115c
mov byte [rsp + 0xa7], r15b
mov r13, r14
mov rcx, r14
cmp rcx, rbp
mov r14, rsi
ja 0x1401810ee
lea rax, [rcx + r15*2]
add rax, 2
cmp rax, rbp
ja 0x1401816d0
inc r15
add r15, r15
mov rdx, rbp
mov r8, r15
call fcn.1401d0030
mov rcx, rbp
call fcn.1401cbbbc
mov rsi, r12
movzx eax, byte [rsp + 0xa7]
mov edx, eax
and edx, 0x7f
test al, al
cmovs rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
mov r8, r13
cmovs r8, rcx
test rdx, rdx
js 0x1401816ef
test r8, r8
jne 0x140181148
test rdx, rdx
jne 0x1401816d3
cmp rdx, 2
je 0x1401812d8
cmp rdx, 1
je 0x1401810b4
xor ebp, ebp
test al, al
jns 0x140181167
call fcn.1401cbbbc
test bpl, bpl
jne 0x140181273
mov ebp, dword [r14]
movzx ecx, byte [rsp + 0x87]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [rsp + 0x78]
movabs rcx, 0xaaaaaaaaaaaaaaaa
mov qword [rsi + 0x10], rcx
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x70]
cmovns rcx, rdx
movups xmmword [rsi], xmm6
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rax
test rax, rax
js 0x1401816f2
test rcx, rcx
jne 0x1401811ce
test rax, rax
jne 0x1401816d6
mov rcx, qword [rsp + 0x38]
mov rdx, rsi
mov r8, r13
call fcn.140176790
mov r15d, 1
test bpl, 0x10
jne 0x140181251
test dword [rbx + 0x27c], r15d
je 0x140181265
mov eax, dword [rbx + 0x298]
test eax, eax
jne 0x140181296
cmp byte [rsp + 0x87], 0
jns 0x140181215
mov rcx, qword [rsp + 0x70]
call fcn.1401cbbbc
lea rcx, [rsp + 0xb0]
call fcn.140181760
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.1401ce5b0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x110]
add rsp, 0x128
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15d, 2
cmp byte [rbx + 0x278], 0
je 0x1401811ea
jmp 0x140181507
cmp byte [rsi + 0x17], 0
jns 0x140181273
mov rcx, qword [rsi]
call fcn.1401cbbbc
cmp byte [rsp + 0x87], 0
jns 0x140181287
mov rcx, qword [rsp + 0x70]
call fcn.1401cbbbc
mov r12, qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbp, rdi
jmp 0x140180e06
cmp eax, 1
jne 0x140181701
lea rdx, [rbx + 0x280]
cmp byte [rbx + 0x297], 0
js 0x14018170b
cmp byte [rsp + 0x87], 0
lea rcx, [rsp + 0x70]
jns 0x1401812c7
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
cmp eax, 1
je 0x140181201
jmp 0x140181265
cmp word [r8], 0x2e
jne 0x14018115c
test al, al
mov rdx, r13
cmovs rdx, rcx
cmp word [rdx + 2], 0x2e
jne 0x14018115c
test byte [rbx + 0x27c], 4
sete bpl
jmp 0x14018115e
mov ecx, eax
call fcn.1400090f0
mov dword [rbx + 0x2a0], eax
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
jmp 0x140181215
mov rax, qword [rbx + 0x2c0]
cmp qword [rbx + 0x2b8], rax
je 0x140181314
mov rcx, qword [rbx + 0x2b0]
test rax, rax
je 0x140181713
dec rax
cmp rcx, rax
jb 0x1401816f5
lea rdx, [rax + rax*2]
shl rdx, 3
add rdx, qword [rbx + 0x2a8]
mov rcx, qword [rsp + 0x38]
call fcn.1401ad2f0
mov r10, qword [rbx + 0x2b0]
mov rdx, qword [rbx + 0x2c0]
test rdx, rdx
je 0x140181649
lea rcx, [rdx - 1]
mov r8, qword [rsp + 0x30]
mov qword [r8], rcx
cmp r10, rdx
jb 0x1401816d9
cmp r10, rcx
jb 0x1401816f8
movabs r8, 0x8000000000000000
cmp rdx, r8
je 0x1401816fb
mov rdx, qword [rsp + 0x50]
mov rdx, qword [rdx]
lea rcx, [rcx + rcx*2]
cmp byte [rdx + rcx*8 + 0x17], 0
jns 0x1401813da
lea rax, [rdx + rcx*8]
mov rcx, qword [rax]
call fcn.1401cbbbc
mov r10, qword [rbx + 0x2b0]
cmp r10, 5
jae 0x140181535
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xa0], rax
movaps xmmword [rsp + 0x90], xmm6
mov eax, dword [rbx + 0x298]
test eax, eax
jne 0x14018141f
movzx eax, byte [rbx + 0x297]
test al, al
js 0x140181445
lea rcx, [rbx + 0x280]
and eax, 0x7f
jmp 0x140181453
cmp eax, 1
jne 0x14018165d
lea rax, [0x1402a926a]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
jmp 0x14018147a
mov rax, qword [rbx + 0x288]
mov rcx, qword [rbx + 0x280]
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0xf8], rax
test rax, rax
js 0x1401816fe
test rcx, rcx
jne 0x14018147a
test rax, rax
jne 0x1401816dc
mov rcx, qword [rsp + 0x38]
mov rdx, r13
lea r8, [rsp + 0xf0]
call fcn.140176790
cmp byte [rsp + 0xa7], 0
mov rcx, r13
jns 0x1401814a4
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], 0
mov edx, 1
mov r8, r14
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov qword [rbx + 0x258], rax
mov byte [rbx], 1
cmp byte [rsp + 0xa7], 0
jns 0x140180e2a
mov rcx, qword [rsp + 0x90]
call fcn.1401cbbbc
jmp 0x140180e2a
mov qword [rbx + 0x288], 1
mov rcx, qword [rbx + 0x280]
jmp 0x14018106b
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140181513
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xa
jb 0x1401811ea
mov rcx, qword [rsp + 0x50]
mov rdx, rsi
call fcn.140015c80
jmp 0x1401811ea
mov rcx, qword [rsp + 0x48]
mov r9, qword [rcx]
mov rcx, qword [rsp + 0x30]
mov r8, qword [rcx]
xor ecx, ecx
cmp r9, r8
cmova rcx, r10
sub rcx, r9
add rcx, r8
dec r10
mov rdx, r10
sub rdx, rcx
cmp rdx, rcx
jb 0x1401813e4
mov rdx, rcx
shr rdx, 2
add rdx, rcx
cmp rdx, 4
mov eax, 3
cmovae rax, rdx
cmp rax, r10
jae 0x1401813e4
inc rax
mov ecx, 0x18
mov qword [rsp + 0x60], rax
mul rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x68], rbp
jo 0x14018171b
mov qword [rsp + 0x58], r8
mov rdi, r9
lea r15, fcn.140163210
mov rcx, r15
mov rdx, qword [rsp + 0x40]
xor r8d, r8d
call fcn.140163210
mov rbp, rax
test rax, rax
jne 0x1401815da
cmp byte [0x1402deda0], 0
jne 0x14018173d
lea r9, [rsp + 0x90]
mov qword [r9], rbp
mov r15, qword [rsp + 0x60]
mov qword [r9 + 8], r15
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x50]
mov rdx, rdi
mov r8, qword [rsp + 0x58]
call fcn.140015e50
mov rdx, qword [rbx + 0x2a8]
lea rcx, fcn.140163210
xor r8d, r8d
call fcn.14015e2b0
mov qword [rbx + 0x2a8], rbp
mov qword [rbx + 0x2b0], r15
mov rbp, qword [rsp + 0x68]
mov rdi, qword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x1401813e4
lea rcx, [r10 - 1]
mov rdx, qword [rsp + 0x30]
mov qword [rdx], rcx
mov rdx, r10
jmp 0x140181398
call fcn.1402074e0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], 0
jmp 0x14018148f
cmp r10, rcx
je 0x140180f58
cmp rcx, 2
je 0x140180f58
neg rcx
sar rcx, 1
test dl, dl
jns 0x1401816b0
cmp r8, rcx
jb 0x1401816df
mov qword [rsp + 0x78], rcx
mov word [rax + rcx*2], 0
jmp 0x140180f58
cmp rcx, rdx
ja 0x1401816df
mov edx, ecx
and dl, 0x7f
lea rax, [rsp + 0x70]
mov byte [rax + 0x17], dl
jmp 0x1401816a5
int3
int3
int3
int3
int3
int3
int3
int3
int3
lea rcx, [rsp + 0x70]
call fcn.140209be0
int3
int3
int3
int3
int3
int3
int3
int3
call fcn.1402074e0
jmp 0x140181265
mov rdx, qword [rdx]
jmp 0x1401812b3
mov rax, rcx
jmp 0x140181347
int3
mov rcx, qword [rsp + 0x40]
call fcn.140214af0
test al, al
jne 0x1401815b5
jmp 0x1401815da