Function at 0x1401c4410
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x9b8
mov rax, qword [0x1402b4198]
xor rax, rsp
mov qword [rsp + 0x9a0], rax
xor edi, edi
mov qword [rsp + 0x58], 0
xor ebp, ebp
mov r13, r9
cmp byte [0x1402b6294], dil
mov r12, r8
mov r14d, edx
mov rsi, rcx
jne 0x1401c4462
cmp byte [0x1402b4b71], dil
jne 0x1401c4787
mov r8, rsi
mov qword [rsp + 0x9b0], r15
lea rdx, str._s.dll
lea rcx, [rsp + 0x1a0]
call fcn.14001c830
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x1401c44f0
lea rax, str.cant_open_directory
mov r9d, 0x2c8
mov qword [rsp + 0x38], rax
lea r8, str.H5PL__path_table_iterate_process_path
mov rax, qword [0x1402b1808]
lea rdx, str.C:_b_abs_e4nt8ttmb0croothdf5_1686163951797work_srcH5PLpath.c
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov rax, qword [0x1402b1558]
mov qword [rsp + 0x28], rax
mov rax, qword [0x1402b1528]
mov qword [rsp + 0x20], rax
call fcn.1400c3a10
mov ebp, r15d
jmp 0x1401c4777
mov qword [rsp + 0x9f8], rbx
nop dword [rax + rax]
movzx ecx, byte [rsp + 0x8c]
cmp cl, byte [0x140228a08]
movzx eax, byte [rsp + 0x8d]
jne 0x1401c4524
cmp al, byte [0x140228a09]
je 0x1401c4656
cmp cl, byte [0x14027b428]
jne 0x1401c4548
cmp al, byte [0x14027b429]
jne 0x1401c4548
movzx eax, byte [rsp + 0x8e]
cmp al, byte [0x14027b42a]
je 0x1401c4656
mov rax, 0xffffffffffffffff
nop
cmp byte [rsi + rax + 1], 0
lea rax, [rax + 1]
jne 0x1401c4550
lea rdx, [rsp + 0x8c]
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
cmp byte [rdx + rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1401c4570
lea rbx, [rax + rcx]
lea rcx, [rbx + 2]
call fcn.1400c2b00
mov rdi, rax
test rax, rax
je 0x1401c4716
lea rax, [rsp + 0x8c]
mov r9, rsi
lea r8, str._s_s
mov qword [rsp + 0x20], rax
lea rdx, [rbx + 2]
mov rcx, rdi
call fcn.140007560
test byte [rsp + 0x60], 0x10
jne 0x1401c4656
xor r8d, r8d
mov dword [rsp + 0x54], 0xffffffff
lea rax, [rsp + 0x58]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x54]
mov byte [rsp + 0x50], 0
lea edx, [r8 + 2]
mov qword [rsp + 0x20], rax
mov rcx, rdi
call fcn.1400ba7b0
test eax, eax
js 0x1401c46c4
mov ecx, dword [rsp + 0x54]
cmp r14d, 2
je 0x1401c462a
test r14d, r14d
jne 0x1401c461b
test ecx, ecx
jmp 0x1401c4624
cmp r14d, 1
jne 0x1401c4626
cmp ecx, r14d
je 0x1401c462a
xor eax, eax
jmp 0x1401c462f
mov eax, 1
cmp byte [rsp + 0x50], 0
je 0x1401c464b
test eax, eax
je 0x1401c464b
mov rdx, qword [rsp + 0x58]
mov r8, r13
call r12
mov ebp, eax
test eax, eax
jne 0x1401c466c
mov rcx, rdi
call fcn.1400c2c20
mov rdi, rax
lea rdx, [rsp + 0x60]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1401c4500
test ebp, ebp
jns 0x1401c4766
lea rax, str.callback_operator_function_returned_failure
mov r9d, 0x2f2
mov qword [rsp + 0x38], rax
lea r8, str.H5PL__path_table_iterate_process_path
mov rax, qword [0x1402b17b8]
lea rdx, str.C:_b_abs_e4nt8ttmb0croothdf5_1686163951797work_srcH5PLpath.c
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov rax, qword [0x1402b1558]
mov qword [rsp + 0x28], rax
mov rax, qword [0x1402b1528]
mov qword [rsp + 0x20], rax
call fcn.1400c3a10
jmp 0x1401c4766
mov qword [rsp + 0x40], rdi
lea rax, str.failed_to_open_plugin__s
mov qword [rsp + 0x38], rax
lea r8, str.H5PL__path_table_iterate_process_path
mov rax, qword [0x1402b1728]
lea rdx, str.C:_b_abs_e4nt8ttmb0croothdf5_1686163951797work_srcH5PLpath.c
mov qword [rsp + 0x30], rax
mov r9d, 0x2e2
mov rax, qword [0x1402b1558]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov rax, qword [0x1402b1528]
mov qword [rsp + 0x20], rax
call fcn.1400c3a10
jmp 0x1401c4761
lea rax, str.cant_allocate_memory_for_path
mov r9d, 0x2d5
mov qword [rsp + 0x38], rax
lea r8, str.H5PL__path_table_iterate_process_path
mov rax, qword [0x1402b1698]
lea rdx, str.C:_b_abs_e4nt8ttmb0croothdf5_1686163951797work_srcH5PLpath.c
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov rax, qword [0x1402b1558]
mov qword [rsp + 0x28], rax
mov rax, qword [0x1402b1528]
mov qword [rsp + 0x20], rax
call fcn.1400c3a10
mov ebp, 0xffffffff
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbx, qword [rsp + 0x9f8]
mov rcx, rdi
call fcn.1400c2c20
mov r15, qword [rsp + 0x9b0]
mov eax, ebp
mov rcx, qword [rsp + 0x9a0]
xor rcx, rsp
call fcn.1402226d0
add rsp, 0x9b8
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret