Function at 0x140036520
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x3a0], rbx
mov rax, qword [0x14027ef78]
xor rax, rsp
mov qword [rbp + 0x250], rax
mov rsi, rdx
mov rbx, rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
lea r8, [0x14022a854]
lea rcx, [rsp + 0x28]
call fcn.14002cd80
cmp qword [rax + 0x18], 8
jb 0x14003658d
mov rax, qword [rax]
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov rdi, rax
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x1400365ba
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.14000c430
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r14w
cmp rdi, 0xffffffffffffffff
jne 0x1400365f0
mov rcx, qword [rbp - 0x40]
mov qword [rbx], rcx
mov rcx, qword [rbp - 0x38]
mov qword [rbx + 8], rcx
mov rcx, qword [rbp - 0x30]
mov qword [rbx + 0x10], rcx
jmp 0x1400368e9
movabs r15, 0x7fffffffffffffff
nop word [rax + rax]
lea r8, [0x140223690]
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.14002cd80
nop
lea r8, [rbp + 0x2c]
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140039b10
nop
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x140036682
inc rax
mov rcx, qword [rsp + 0x48]
cmp rax, r15
ja 0x140036869
add rax, rax
cmp rax, 0x1000
jb 0x14003667d
test cl, 0x1f
jne 0x140036863
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14003685d
sub rcx, rax
cmp rcx, 8
jb 0x140036857
cmp rcx, 0x27
ja 0x140036851
mov rcx, rax
call fcn.14017dea8
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r14w
test byte [rbp], 0x10
je 0x1400366fb
mov rax, qword [rbp - 0x10]
cmp rax, 8
jb 0x14003683b
inc rax
mov rcx, qword [rbp - 0x28]
cmp rax, r15
ja 0x140036887
add rax, rax
cmp rax, 0x1000
jb 0x140036836
test cl, 0x1f
jne 0x140036881
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14003687b
sub rcx, rax
cmp rcx, 8
jb 0x140036875
cmp rcx, 0x27
ja 0x14003686f
jmp 0x140036833
lea rax, [rsp + 0x68]
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r14w
mov r8d, 5
lea rdx, str..json
lea rcx, [rsp + 0x68]
call fcn.140009360
nop
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r14w
lea rax, [rbp + 0x2c]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140036750
lea rdx, [rbp + 0x2c]
lea rcx, [rbp - 0x78]
call fcn.140009360
nop
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x78]
call fcn.140036a90
test al, al
jne 0x1400367d7
mov rax, qword [rbp - 0x10]
cmp rax, 8
jb 0x14003683b
inc rax
mov rcx, qword [rbp - 0x28]
cmp rax, r15
ja 0x1400368a5
add rax, rax
cmp rax, 0x1000
jb 0x140036836
test cl, 0x1f
jne 0x14003689f
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140036899
sub rcx, rax
cmp rcx, 8
jb 0x140036893
cmp rcx, 0x27
ja 0x14003688d
jmp 0x140036833
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x40]
call fcn.14003a020
nop
mov rax, qword [rbp - 0x10]
cmp rax, 8
jb 0x14003683b
inc rax
mov rcx, qword [rbp - 0x28]
cmp rax, r15
ja 0x1400368c3
add rax, rax
cmp rax, 0x1000
jb 0x140036836
test cl, 0x1f
jne 0x1400368bd
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400368b7
sub rcx, rax
cmp rcx, 8
jb 0x1400368b1
cmp rcx, 0x27
ja 0x1400368ab
mov rcx, rax
call fcn.14017dea8
lea rdx, [rbp]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
je 0x1400368c9
jmp 0x140036600
call fcn.14018bf78
int3
call fcn.14018bf78
int3
call fcn.14018bf78
int3
call fcn.14018bf78
int3
call fcn.14018bf78
nop
call fcn.14018bf78
int3
call fcn.14018bf78
int3
call fcn.14018bf78
int3
call fcn.14018bf78
int3
call fcn.14018bf78
int3
call fcn.14018bf78
int3
call fcn.14018bf78
int3
call fcn.14018bf78
int3
call fcn.14018bf78
int3
call fcn.14018bf78
int3
call fcn.14018bf78
int3
call fcn.14018bf78
int3
call fcn.14018bf78
int3
call fcn.14018bf78
int3
call fcn.14018bf78
int3
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
mov rax, qword [rbp - 0x40]
mov qword [rbx], rax
mov rax, qword [rbp - 0x38]
mov qword [rbx + 8], rax
mov rax, qword [rbp - 0x30]
mov qword [rbx + 0x10], rax
mov rax, rbx
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.14017e000
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x360
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret