Function at 0x1400c4a70
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x7a8]
sub rsp, 0x870
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x1402e7d18]
xor rax, rsp
mov qword [rbp + 0x740], rax
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x78], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp + 0x370]
call fcn.140145ad0
lea rcx, [rbp + 0x370]
call fcn.140034b20
nop
mov r8, rbx
mov rdx, rsi
lea rcx, [rbp + 0x370]
call fcn.140034d70
test al, al
jne 0x1400c4b36
lea rax, [0x1402eb3e0]
mov rcx, qword [0x1402eb3e0]
cmp rcx, rax
je 0x1400c4b2b
test byte [rcx + 0x44], 2
je 0x1400c4b2b
cmp byte [rcx + 0x41], 4
jb 0x1400c4b2b
lea edx, [r14 + 0x29]
mov r9, rbx
lea r8, [0x140273448]
mov rcx, qword [rcx + 0x38]
call fcn.140034a00
mov r14d, 0x57
jmp 0x1400c54f4
mov eax, 0xb0
mov ecx, 0x20af0
test edi, edi
cmovne eax, ecx
lea rcx, [rax + rsi]
mov qword [rbp - 0x60], rcx
lea rcx, [rsi + 0x6f0]
add rcx, rax
call fcn.1400a1200
lea rcx, [rbp + 0x370]
call fcn.140035290
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r14w
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400c4b80
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140007240
nop
lea r13, [0x1402eb3e0]
mov rcx, qword [0x1402eb3e0]
cmp rcx, r13
je 0x1400c4bda
test byte [rcx + 0x44], 2
je 0x1400c4bda
cmp byte [rcx + 0x41], 4
jb 0x1400c4bda
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r9, qword [rbp + 0x10]
mov edx, 0x2a
lea r8, [0x140273448]
mov rcx, qword [rcx + 0x38]
call fcn.140033550
mov r15, qword [rbp + 0x20]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r15
cmp rax, 2
jb 0x1400c553d
lea r12, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r12, qword [rbp + 0x10]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r14
lea rsi, [r15 + 2]
mov ebx, 7
lea rdi, [rsp + 0x28]
lea eax, [rbx + 3]
movabs rdx, 0x7fffffffffffffff
cmp rsi, rbx
jbe 0x1400c4c76
mov rbx, rsi
or rbx, 7
cmp rbx, rcx
jbe 0x1400c4c41
mov rbx, rcx
jmp 0x1400c4c48
cmp rbx, rax
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, rdx
ja 0x1400c5543
lfence
add rcx, rcx
call fcn.140008ed0
mov rdi, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rbx
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r12
mov rcx, rdi
call fcn.140145e60
mov dword [rbx + rdi], 0x2a005c
mov word [rdi + rsi*2], r14w
mov dword [rsp + 0x20], 2
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
lea rdx, [rbp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
mov qword [rbp - 0x58], rax
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x1400c4d0d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4d08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c5549
call fcn.1401544b8
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r14w
cmp rdi, 0xffffffffffffffff
je 0x1400c54a7
mov rcx, qword [0x1402eb3e0]
cmp rcx, r13
je 0x1400c4d58
test byte [rcx + 0x44], 2
je 0x1400c4d58
cmp byte [rcx + 0x41], 4
jb 0x1400c4d58
mov edx, 0x2b
lea r8, [0x140273448]
mov rcx, qword [rcx + 0x38]
call fcn.140024250
lea r12, [0x1402a07c4]
lea r15, [0x140273620]
movzx ebx, byte [rsp + 0x24]
mov rsi, 0xffffffffffffffff
mov qword [rbp], r14
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r14w
lea rax, [rbp + 0x51c]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400c4d90
lea rdx, [rbp + 0x51c]
lea rcx, [rbp - 0x10]
call fcn.140007240
nop
lea r8, [rbp - 0x10]
mov r9, qword [rbp - 0x10]
mov r10, qword [rbp + 8]
cmp r10, 8
cmovae r8, r9
mov r11, qword [rbp]
cmp r11, 1
jne 0x1400c4dec
mov rdx, r11
mov rcx, r12
sub r8, r12
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x1400c4dec
add rcx, 2
sub rdx, 1
jne 0x1400c4dd3
jmp 0x1400c5425
lea r8, [rbp - 0x10]
cmp r10, 8
cmovae r8, r9
cmp r11, 2
jne 0x1400c4e28
mov rdx, r11
mov rax, r15
sub r8, r15
nop word [rax + rax]
movzx ecx, word [rax]
cmp word [rax + r8], cx
jne 0x1400c4e28
add rax, 2
sub rdx, 1
jne 0x1400c4e10
mov al, 1
jmp 0x1400c4e2a
xor al, al
test al, al
jne 0x1400c5425
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r14w
mov r8d, 1
lea rdx, [0x14029a0b0]
lea rcx, [rbp - 0x50]
call fcn.140007240
nop
mov r15, qword [rbp - 0x78]
mov r8, 0xffffffffffffffff
mov rdi, r8
nop dword [rax + rax]
inc rdi
cmp word [r15 + rdi*2 + 0x68], 0
jne 0x1400c4e70
mov rcx, qword [rbp + 0x20]
mov qword [rbp - 0x70], rcx
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, rcx
cmp rax, rdi
jb 0x1400c5573
lea rax, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rax, qword [rbp + 0x10]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r14
lea r13, [rcx + rdi]
mov esi, 7
lea r12, [rsp + 0x68]
cmp r13, rsi
jbe 0x1400c4f1a
mov rsi, r13
or rsi, 7
cmp rsi, rdx
jbe 0x1400c4edc
mov rsi, rdx
jmp 0x1400c4ee9
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
mov rcx, rsi
add rcx, 1
cmovb rcx, r8
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400c5555
lfence
add rcx, rcx
call fcn.140008ed0
mov r12, rax
mov qword [rsp + 0x68], rax
lfence
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], rsi
add rdi, rdi
mov r8, rdi
lea rdx, [r15 + 0x68]
mov rcx, r12
call fcn.140145e60
lea rcx, [r12 + rdi]
mov r8, qword [rbp - 0x70]
add r8, r8
mov rdx, qword [rbp - 0x68]
call fcn.140145e60
mov word [r12 + r13*2], r14w
mov edi, dword [rsp + 0x20]
or edi, 4
lea r9, [rbp - 0x50]
lea r8, [rsp + 0x68]
movzx edx, bl
lea rcx, [rbp - 0x30]
call fcn.1400c0be0
nop
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rdx, qword [rbp - 0x10]
mov r8, qword [rbp]
lea rcx, [rbp - 0x30]
call fcn.14001aa90
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
or edi, 0x18
mov dword [rsp + 0x20], edi
lea rcx, [rbp - 0x10]
call fcn.140007180
movups xmmword [rbp - 0x10], xmm6
movups xmmword [rbp], xmm7
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1400c4ff8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4ff3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c555b
call fcn.1401544b8
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400c504a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c5045
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c5561
call fcn.1401544b8
mov word [rsp + 0x68], r14w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x1400c5090
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c508b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c5567
call fcn.1401544b8
mov word [rbp - 0x50], r14w
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp + 0x1f0]
call fcn.140145ad0
lea rcx, [rbp + 0x1f0]
call fcn.140034b20
nop
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rdx, qword [rbp - 0x10]
xor r8d, r8d
lea rcx, [rbp + 0x1f0]
call fcn.140035390
test al, al
je 0x1400c53b5
lfence
mov rcx, qword [0x1402eb3e0]
lea r13, [0x1402eb3e0]
cmp rcx, r13
je 0x1400c5120
test byte [rcx + 0x44], 2
je 0x1400c5120
cmp byte [rcx + 0x41], 4
jb 0x1400c5120
lea r9, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae r9, qword [rbp - 0x10]
mov edx, 0x2c
lea r8, [0x140273448]
mov rcx, qword [rcx + 0x38]
call fcn.140033550
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0x40]
call fcn.14009e920
lea rax, vtable.MigratingFile.0
mov qword [rbp + 0x40], rax
mov dword [rbp + 0xb8], r14d
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xc0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xd0], xmm1
mov rdi, qword [rbp - 0x60]
mov qword [rbp + 0xe0], rdi
lea rax, vtable.SparseFragmentsFilter.0
mov qword [rbp + 0x30], rax
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x40]
call fcn.14009e980
mov r8b, 1
lea rdx, [rbp + 0x40]
mov rcx, rdi
call fcn.1400a29d0
test eax, eax
je 0x1400c535f
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0xf0]
call fcn.140145ad0
mov edx, 1
lea rcx, [rbp + 0xf0]
call fcn.140005bf0
nop
lea rdx, str.File
lea rcx, [rbp + 0x100]
call fcn.140008650
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rdx, qword [rbp - 0x10]
mov r8, qword [rbp]
mov rcx, rax
call fcn.1400143e0
mov rcx, rax
lea rdx, str._cannot
call fcn.140008650
lea rdx, str.be_placed__n
lea rcx, [rbp + 0x100]
call fcn.140008650
mov rcx, qword [0x1402eb3e0]
cmp rcx, r13
je 0x1400c52f9
test byte [rcx + 0x44], 2
je 0x1400c52f9
cmp byte [rcx + 0x41], 5
jb 0x1400c52f9
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r14w
mov edi, dword [rsp + 0x20]
or edi, 0x40
mov dword [rsp + 0x20], edi
mov edx, dword [rbp + 0x178]
test dl, 2
jne 0x1400c5282
mov rax, qword [rbp + 0x148]
mov r8, qword [rax]
test r8, r8
je 0x1400c5282
mov rax, qword [rbp + 0x128]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0x170]
cmovb r8, qword [rbp + 0x170]
sub r8, rdx
jmp 0x1400c52b3
test dl, 4
jne 0x1400c52c7
mov rax, qword [rbp + 0x140]
mov r9, qword [rax]
test r9, r9
je 0x1400c52c7
mov rax, qword [rbp + 0x120]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x158]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, r9
sar r8, 1
lea rcx, [rsp + 0x48]
call fcn.140007240
mov rcx, qword [0x1402eb3e0]
and edi, 0xffffffbf
or edi, 0x21
mov dword [rsp + 0x20], edi
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r9, qword [rsp + 0x48]
mov edx, 0x2d
lea r8, [0x140273448]
mov rcx, qword [rcx + 0x38]
call fcn.140033550
jmp 0x1400c52fd
mov edi, dword [rsp + 0x20]
test dil, 1
je 0x1400c5352
and edi, 0xfffffffe
mov dword [rsp + 0x20], edi
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1400c534c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c5347
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c556d
call fcn.1401544b8
mov word [rsp + 0x48], r14w
lea rcx, [rbp + 0xf0]
call fcn.140005060
nop
lea rcx, [rbp + 0xd8]
call fcn.140034180
lea rcx, [rbp + 0xd0]
call fcn.140034180
lea rcx, [rbp + 0xc8]
call fcn.140034180
lea rcx, [rbp + 0xc0]
call fcn.140034180
lea rcx, [rbp + 0x78]
call fcn.140034640
lea rcx, [rbp + 0x68]
call fcn.140034640
lea rcx, [rbp + 0x58]
call fcn.140034640
lea rcx, [rbp + 0x48]
call fcn.140034640
jmp 0x1400c53f8
mov rcx, qword [0x1402eb3e0]
lea r13, [0x1402eb3e0]
cmp rcx, r13
je 0x1400c53f8
test byte [rcx + 0x44], 2
je 0x1400c53f8
cmp byte [rcx + 0x41], 4
jb 0x1400c53f8
lea r9, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae r9, qword [rbp - 0x10]
mov edx, 0x2e
lea r8, [0x140273448]
mov rcx, qword [rcx + 0x38]
call fcn.140033550
nop
lea rcx, [rbp + 0x1f0]
call fcn.140036cb0
mov r10, qword [rbp + 8]
mov r9, qword [rbp - 0x10]
mov rdi, qword [rbp - 0x58]
mov rsi, 0xffffffffffffffff
lea r15, [0x140273620]
lea r12, [0x1402a07c4]
cmp r10, 8
jb 0x1400c5460
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x1400c5458
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c5537
mov rcx, r9
call fcn.1401544b8
lea rdx, [rbp + 0x4f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x1400c4d72
mov rcx, qword [0x1402eb3e0]
cmp rcx, r13
je 0x1400c54a7
test byte [rcx + 0x44], 2
je 0x1400c54a7
cmp byte [rcx + 0x41], 4
jb 0x1400c54a7
mov edx, 0x2f
lea r8, [0x140273448]
mov rcx, qword [rcx + 0x38]
call fcn.140024250
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x1400c54e3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c54de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c554f
call fcn.1401544b8
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r14w
lea rcx, [rbp + 0x370]
call fcn.140036cb0
mov eax, r14d
mov rcx, qword [rbp + 0x740]
xor rcx, rsp
call fcn.140154650
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400e3a60
nop
call fcn.140002830
int3
call fcn.140002700
int3
call fcn.1400e3a60
nop
call fcn.1400e3a60
nop
call fcn.140002700
nop
call fcn.1400e3a60
nop
call fcn.1400e3a60
nop
call fcn.1400e3a60
nop
call fcn.1400e3a60
nop
call fcn.140002830
int3