Function at 0x140036530
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x3a0], rbx
mov rax, qword [0x14028cab8]
xor rax, rsp
mov qword [rbp + 0x250], rax
mov rsi, rdx
mov rbx, rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
lea r8, [0x140238ba4]
lea rcx, [rsp + 0x28]
call fcn.14002cd90
cmp qword [rax + 0x18], 8
jb 0x14003659d
mov rax, qword [rax]
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov rdi, rax
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x1400365ca
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.14000c430
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r14w
cmp rdi, 0xffffffffffffffff
jne 0x140036600
mov rcx, qword [rbp - 0x40]
mov qword [rbx], rcx
mov rcx, qword [rbp - 0x38]
mov qword [rbx + 8], rcx
mov rcx, qword [rbp - 0x30]
mov qword [rbx + 0x10], rcx
jmp 0x1400368f9
movabs r15, 0x7fffffffffffffff
nop word [rax + rax]
lea r8, [0x1402319e0]
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.14002cd90
nop
lea r8, [rbp + 0x2c]
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140039b20
nop
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x140036692
inc rax
mov rcx, qword [rsp + 0x48]
cmp rax, r15
ja 0x140036879
add rax, rax
cmp rax, 0x1000
jb 0x14003668d
test cl, 0x1f
jne 0x140036873
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14003686d
sub rcx, rax
cmp rcx, 8
jb 0x140036867
cmp rcx, 0x27
ja 0x140036861
mov rcx, rax
call fcn.140189b04
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r14w
test byte [rbp], 0x10
je 0x14003670b
mov rax, qword [rbp - 0x10]
cmp rax, 8
jb 0x14003684b
inc rax
mov rcx, qword [rbp - 0x28]
cmp rax, r15
ja 0x140036897
add rax, rax
cmp rax, 0x1000
jb 0x140036846
test cl, 0x1f
jne 0x140036891
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14003688b
sub rcx, rax
cmp rcx, 8
jb 0x140036885
cmp rcx, 0x27
ja 0x14003687f
jmp 0x140036843
lea rax, [rsp + 0x68]
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r14w
mov r8d, 5
lea rdx, str..json
lea rcx, [rsp + 0x68]
call fcn.140009360
nop
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r14w
lea rax, [rbp + 0x2c]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140036760
lea rdx, [rbp + 0x2c]
lea rcx, [rbp - 0x78]
call fcn.140009360
nop
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x78]
call fcn.140036aa0
test al, al
jne 0x1400367e7
mov rax, qword [rbp - 0x10]
cmp rax, 8
jb 0x14003684b
inc rax
mov rcx, qword [rbp - 0x28]
cmp rax, r15
ja 0x1400368b5
add rax, rax
cmp rax, 0x1000
jb 0x140036846
test cl, 0x1f
jne 0x1400368af
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400368a9
sub rcx, rax
cmp rcx, 8
jb 0x1400368a3
cmp rcx, 0x27
ja 0x14003689d
jmp 0x140036843
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x40]
call fcn.14003a030
nop
mov rax, qword [rbp - 0x10]
cmp rax, 8
jb 0x14003684b
inc rax
mov rcx, qword [rbp - 0x28]
cmp rax, r15
ja 0x1400368d3
add rax, rax
cmp rax, 0x1000
jb 0x140036846
test cl, 0x1f
jne 0x1400368cd
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400368c7
sub rcx, rax
cmp rcx, 8
jb 0x1400368c1
cmp rcx, 0x27
ja 0x1400368bb
mov rcx, rax
call fcn.140189b04
lea rdx, [rbp]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
je 0x1400368d9
jmp 0x140036610
call fcn.140197bd8
int3
call fcn.140197bd8
int3
call fcn.140197bd8
int3
call fcn.140197bd8
int3
call fcn.140197bd8
nop
call fcn.140197bd8
int3
call fcn.140197bd8
int3
call fcn.140197bd8
int3
call fcn.140197bd8
int3
call fcn.140197bd8
int3
call fcn.140197bd8
int3
call fcn.140197bd8
int3
call fcn.140197bd8
int3
call fcn.140197bd8
int3
call fcn.140197bd8
int3
call fcn.140197bd8
int3
call fcn.140197bd8
int3
call fcn.140197bd8
int3
call fcn.140197bd8
int3
call fcn.140197bd8
int3
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
mov rax, qword [rbp - 0x40]
mov qword [rbx], rax
mov rax, qword [rbp - 0x38]
mov qword [rbx + 8], rax
mov rax, qword [rbp - 0x30]
mov qword [rbx + 0x10], rax
mov rax, rbx
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.140189c60
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x360
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret