Function at 0x7ff7c15b366c
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1f8]
sub rsp, 0x2c0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x7ff7c1620328]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rsi, r8
xor r14d, r14d
mov edi, r14d
lea r8, [0x7ff7c15f9134]
mov rdx, qword [rdx]
lea rcx, [rsp + 0x30]
call fcn.7ff7c15af034
mov rbx, qword [rax]
call fcn.7ff7c15abfac
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x7ff7c15b3702
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [0x7ff7c15f6588]
cmp r12, 0xffffffffffffffff
jne 0x7ff7c15b3729
call fcn.7ff7c15abfac
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x7ff7c15b3a00
mov rax, qword [0x7ff7c161b338]
lea rcx, [0x7ff7c161b338]
mov rax, qword [rax + 0x18]
call qword [0x7ff7c15f6588]
lea r15, [rax + 0x18]
mov qword [rsp + 0x20], r15
mov byte [rsp + 0x28], r14b
mov dword [rsp + 0x2c], r14d
mov ebx, r14d
test ebx, ebx
jne 0x7ff7c15b395f
cmp word [rbp - 0x74], 0x2e
jne 0x7ff7c15b3784
movzx eax, word [rbp - 0x72]
test ax, ax
je 0x7ff7c15b395f
cmp ax, 0x2e
jne 0x7ff7c15b3784
cmp word [rbp - 0x70], r14w
je 0x7ff7c15b395f
lea rdx, [rbp - 0x74]
lea rcx, [rsp + 0x38]
call fcn.7ff7c15a41ec
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.7ff7c15a4168
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x7ff7c15b37c7
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x7ff7c15f6588]
mov r13d, dword [rsp + 0x60]
mov r14d, r13d
shr r14d, 4
and r14b, 1
mov byte [rsp + 0x28], r14b
mov dword [rsp + 0x2c], r13d
mov rdx, qword [rsi + 8]
lea rax, [rsp + 0x20]
cmp rax, rdx
jae 0x7ff7c15b37fd
lea rax, [rsp + 0x20]
cmp qword [rsi], rax
ja 0x7ff7c15b37fd
mov al, 1
jmp 0x7ff7c15b37ff
xor al, al
mov r9, qword [rsi + 0x10]
test al, al
je 0x7ff7c15b38c4
lea rbx, [rsp + 0x20]
sub rbx, qword [rsi]
mov rcx, qword [rsi]
mov r14, rdx
cmp rdx, r9
jne 0x7ff7c15b3888
mov rax, r9
sub rax, rdx
sar rax, 4
cmp rax, 1
jae 0x7ff7c15b3888
sub rdx, rcx
sar rdx, 4
movabs r13, 0xfffffffffffffff
mov rax, r13
sub rax, rdx
cmp rax, 1
jb 0x7ff7c15b3a2c
inc rdx
sub r9, rcx
sar r9, 4
mov rax, r9
shr rax, 1
mov rcx, r13
sub rcx, rax
add rax, r9
xor r8d, r8d
cmp rcx, r9
cmovae r8, rax
cmp r8, rdx
cmovae rdx, r8
mov rcx, rsi
call fcn.7ff7c15b4294
mov rcx, qword [rsi]
mov r14, qword [rsi + 8]
and rbx, 0xfffffffffffffff0
add rbx, rcx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
mov rcx, qword [rbx]
sub rcx, 0x18
call fcn.7ff7c15a4d20
add rax, 0x18
mov qword [r14], rax
mov al, byte [rbx + 8]
mov byte [r14 + 8], al
mov eax, dword [rbx + 0xc]
mov dword [r14 + 0xc], eax
mov r15, qword [rsp + 0x20]
jmp 0x7ff7c15b3957
mov rbx, rdx
cmp rdx, r9
jne 0x7ff7c15b3930
mov rax, r9
sub rax, rdx
sar rax, 4
cmp rax, 1
jae 0x7ff7c15b3930
sub rdx, qword [rsi]
sar rdx, 4
movabs rcx, 0xfffffffffffffff
mov rax, rcx
sub rax, rdx
cmp rax, 1
jb 0x7ff7c15b3a32
inc rdx
sub r9, qword [rsi]
sar r9, 4
mov rax, r9
shr rax, 1
sub rcx, rax
add rax, r9
xor r8d, r8d
cmp rcx, r9
cmovae r8, rax
cmp r8, rdx
cmovae rdx, r8
mov rcx, rsi
call fcn.7ff7c15b4294
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov r15, qword [rsp + 0x20]
lea rcx, [r15 - 0x18]
call fcn.7ff7c15a4d20
add rax, 0x18
mov qword [rbx], rax
mov byte [rbx + 8], r14b
mov dword [rbx + 0xc], r13d
add qword [rsi + 8], 0x10
xor r14d, r14d
mov ebx, r14d
call fcn.7ff7c15abfac
lea rdx, [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x7ff7c15b3757
call fcn.7ff7c15abfac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x12
je 0x7ff7c15b39aa
test edi, edi
js 0x7ff7c15b3757
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x7ff7c15b3757
lea rdx, [r15 - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x7ff7c15b39cb
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x7ff7c15f6588]
cmp r12, 0xffffffffffffffff
je 0x7ff7c15b3a00
call fcn.7ff7c15abfac
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
jne 0x7ff7c15b3a00
test edi, edi
js 0x7ff7c15b3a00
call fcn.7ff7c15abfac
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, edi
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.7ff7c15e78d0
mov rbx, qword [rsp + 0x300]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.7ff7c15a4918
nop
call fcn.7ff7c15a4918
int3