Function at 0x14024f4e0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x14031fcd0]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov r14, r8
mov r15, rdx
mov rsi, rcx
xor r12d, r12d
mov rcx, rdx
call fcn.140250ab0
mov qword [rbp + 0x20], r12
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], rax
movdqu xmmword [rsp + 0x40], xmm0
mov rdx, qword [rsi + 0x10]
test rdx, rdx
je 0x14024fe4b
mov eax, dword [rdx + 8]
jmp 0x14024f564
lea ecx, [rax + 1]
lock cmpxchg dword [rdx + 8], ecx
je 0x14024f56e
test eax, eax
je 0x14024fe4b
jmp 0x14024f55a
mov rax, qword [rsi + 8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x40]
lea rdx, str.Windows.Management.Deployment.PackageManager
lea rcx, [rbp + 0xd0]
call fcn.14024ec84
nop
or r13, 0xffffffffffffffff
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14024f5e7
mov eax, r13d
lock xadd dword [rcx + 8], eax
add eax, r13d
jne 0x14024f5e7
mov rbx, qword [rsp + 0x48]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [str.PS_]
mov eax, r13d
lock xadd dword [rbx + 0xc], eax
add eax, r13d
jne 0x14024f5e7
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [str.PS_]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x48]
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x14024f609
mov qword [rbp + 0x20], r12
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [str.PS_]
nop
lea r8, [rbp + 0x20]
mov rdx, qword [rbp + 0xe0]
mov rcx, rsi
mov rax, rbx
call qword [str.PS_]
mov edi, eax
mov qword [rbp + 0x50], r12
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
mov r8d, 0x2f
lea rdx, str.RoActivateInstance_for_IPackageManager_returned
lea rcx, [rbp + 0x50]
call fcn.14000b760
nop
mov dword [rbp - 0x20], edi
mov rcx, qword [r14 + 0x38]
test rcx, rcx
je 0x14024fe51
mov rax, qword [rcx]
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x50]
mov rax, qword [rax + 0x10]
call qword [str.PS_]
nop
lea rcx, [rbp + 0x50]
call fcn.14000a0c8
mov qword [rbp + 0x48], r12
test edi, edi
js 0x14024f6a7
mov rbx, qword [rbp + 0x20]
mov rax, qword [rbx]
mov rdi, qword [rax]
lea rcx, [rbp + 0x48]
call fcn.14024e43c
mov r8, rax
lea rdx, [0x1402c3258]
mov rcx, rbx
mov rax, rdi
call qword [str.PS_]
mov edi, eax
mov qword [rbp + 0x40], r12
test edi, edi
js 0x14024f6cc
mov rcx, qword [rbp + 0x48]
mov rax, qword [rcx]
lea r9, [rbp + 0x40]
xor edx, edx
lea r8d, [rdx + 1]
mov rax, qword [rax + 0x50]
call qword [str.PS_]
mov edi, eax
mov rcx, r12
mov qword [rbp + 8], rcx
test edi, edi
js 0x14024f6f2
mov rcx, qword [rbp + 0x40]
mov rax, qword [rcx]
lea rdx, [rbp + 8]
mov rax, qword [rax + 0x30]
call qword [str.PS_]
mov edi, eax
mov rcx, qword [rbp + 8]
mov byte [rbp - 0x28], r12b
test edi, edi
js 0x14024fda4
mov rax, qword [rcx]
lea rdx, [rbp - 0x28]
mov rax, qword [rax + 0x38]
call qword [str.PS_]
mov edi, eax
cmp byte [rbp - 0x28], r12b
je 0x14024fda0
mov qword [rbp], r12
test edi, edi
js 0x14024f73a
mov rcx, qword [rbp + 8]
mov rax, qword [rcx]
lea rdx, [rbp]
mov rax, qword [rax + 0x30]
call qword [str.PS_]
mov edi, eax
mov rcx, r12
mov qword [rbp + 0x18], rcx
test edi, edi
js 0x14024f774
mov rbx, qword [rbp]
mov rax, qword [rbx]
mov rdi, qword [rax]
lea rcx, [rbp + 0x18]
call fcn.14024e43c
mov r8, rax
lea rdx, [0x14029f390]
mov rcx, rbx
mov rax, rdi
call qword [str.PS_]
mov edi, eax
mov rcx, qword [rbp + 0x18]
mov rax, r12
mov qword [rbp + 0x10], rax
test edi, edi
js 0x14024f796
mov rax, qword [rcx]
lea rdx, [rbp + 0x10]
mov rax, qword [rax + 0x40]
call qword [str.PS_]
mov edi, eax
mov rax, qword [rbp + 0x10]
mov rcx, r12
mov qword [rbp - 8], rcx
test edi, edi
js 0x14024f7ba
xor r9d, r9d
lea r8d, [r9 + 8]
lea rdx, [rbp - 8]
mov rcx, rax
call fcn.14024e3ac
mov edi, eax
mov rcx, qword [rbp - 8]
mov edx, r12d
mov dword [rbp + 0x28], edx
test edi, edi
js 0x14024f7de
mov rax, qword [rcx]
lea rdx, [rbp + 0x28]
mov rax, qword [rax + 0x38]
call qword [str.PS_]
mov edi, eax
mov rcx, qword [rbp - 8]
mov edx, dword [rbp + 0x28]
mov qword [rbp + 0xb0], r12
mov rax, r12
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], 7
mov word [rbp + 0xb0], r12w
test edx, edx
je 0x14024f8f2
mov qword [rbp - 0x10], rax
test edi, edi
js 0x14024f82b
mov rax, qword [rcx]
lea r8, [rbp - 0x10]
xor edx, edx
mov rax, qword [rax + 0x30]
call qword [str.PS_]
mov edi, eax
mov rax, qword [rbp - 0x10]
mov rcx, r12
mov qword [rbp + 0x30], rcx
test edi, edi
js 0x14024f853
mov rcx, qword [rax]
mov r8, qword [rcx + 0x30]
lea rdx, [rbp + 0x30]
mov rcx, rax
mov rax, r8
call qword [str.PS_]
mov edi, eax
mov rcx, qword [rbp + 0x30]
mov qword [rbp - 0x38], r12
test edi, edi
js 0x14024f89d
mov rax, qword [rcx]
lea rdx, [rbp - 0x38]
mov rax, qword [rax + 0x30]
call qword [str.PS_]
mov edi, eax
test eax, eax
js 0x14024f89d
mov dword [rbp - 0x20], r12d
mov rax, qword [rsi]
lea r8, [rbp - 0x20]
mov rdx, qword [rbp - 0x38]
mov rcx, rsi
mov rax, qword [rax + 0x40]
call qword [str.PS_]
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.140017810
mov rax, qword [rsi]
mov rdx, qword [rbp - 0x38]
mov rcx, rsi
mov rax, qword [rax + 0x38]
call qword [str.PS_]
mov qword [rbp - 0x38], r12
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14024f8d0
mov qword [rbp + 0x30], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PS_]
nop
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14024f8eb
mov qword [rbp - 0x10], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PS_]
nop
mov rax, qword [rbp + 0xc0]
test rax, rax
je 0x14024fc33
mov rbx, r12
mov qword [rbp - 0x10], rbx
test edi, edi
js 0x14024f924
mov rbx, qword [rbp]
mov rax, qword [rbx]
lea rdx, [rbp - 0x10]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [str.PS_]
mov edi, eax
mov rbx, qword [rbp - 0x10]
mov rcx, r12
mov qword [rbp + 0x38], rcx
test edi, edi
js 0x14024f95a
mov rax, qword [rbx]
mov rdi, qword [rax]
lea rcx, [rbp + 0x38]
call fcn.14024e43c
mov r8, rax
lea rdx, [0x14029f418]
mov rcx, rbx
mov rax, rdi
call qword [str.PS_]
mov edi, eax
mov rcx, qword [rbp + 0x38]
mov rdx, r12
mov qword [rbp - 0x30], rdx
test edi, edi
js 0x14024f97c
mov rax, qword [rcx]
lea rdx, [rbp - 0x30]
mov rax, qword [rax + 0x60]
call qword [str.PS_]
mov edi, eax
mov rdx, qword [rbp - 0x30]
mov dword [rbp - 0x18], r12d
mov rax, qword [rsi]
lea r8, [rbp - 0x18]
mov rcx, rsi
mov rax, qword [rax + 0x40]
call qword [str.PS_]
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], r12
mov r8, r13
inc r8
cmp word [rax + r8*2], r12w
jne 0x14024f9a3
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.14000b760
nop
mov rax, qword [rsi]
mov rdx, qword [rbp - 0x30]
mov rcx, rsi
mov rax, qword [rax + 0x38]
call qword [str.PS_]
mov qword [rbp - 0x30], r12
cmp qword [rbp + 0x60], r12
je 0x14024fbf3
mov r8d, 6
lea rdx, str..exe
lea rcx, [rbp + 0x50]
call fcn.14000a12c
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp + 0x100]
call fcn.1400b4a50
lea rcx, [rbp + 0x50]
cmp qword [rbp + 0x68], 8
cmovae rcx, qword [rbp + 0x50]
lea rdx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, r13
je 0x14024fbf3
mov qword [rbp + 0x90], r12
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], r12
lea rax, [rbp + 0x12c]
mov r8, r13
inc r8
cmp word [rax + r8*2], r12w
jne 0x14024fa4c
lea rdx, [rbp + 0x12c]
lea rcx, [rbp + 0x90]
call fcn.14000b760
nop
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], r12w
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
setae r9b
cmovae rcx, qword [rbp + 0x90]
mov rax, qword [rbp + 0xa0]
lea r8, [rcx + rax*2]
lea rdx, [rbp + 0x90]
test r9b, r9b
cmovne rdx, qword [rbp + 0x90]
lea rax, [fcn.1400dac10]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14024e9f0
lea r9, [rbp + 0xb0]
lea r8, [rbp + 0x70]
lea rdx, [rsp + 0x78]
mov rcx, r15
call fcn.14024e840
movabs rax, 0x7ffffffffffffffe
mov rcx, qword [rbp + 0x80]
sub rax, rcx
cmp rax, 0x2a
jb 0x14024fe5d
lea rax, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rax, qword [rbp + 0x70]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x2a
lea r9, str.Adding_entry_to_exe_to_friendly_name_map:
lea r8, [rbp + 0x70]
mov dl, byte [rbp - 0x28]
lea rcx, [rsp + 0x58]
call fcn.14000d85c
nop
lea r8, [0x1402c3630]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x58]
call fcn.14000d7f0
nop
lea r8, [rbp + 0xb0]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140017d64
mov r9, rax
mov dword [rbp - 0x20], r12d
mov rcx, qword [r14 + 0x38]
test rcx, rcx
je 0x14024fe57
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
lea r8, [rbp - 0x20]
mov rdx, r9
call qword [str.PS_]
nop
lea rcx, [rbp - 0x78]
call fcn.14000a0c8
nop
lea rcx, [rbp - 0x58]
call fcn.14000a0c8
nop
lea rcx, [rsp + 0x58]
call fcn.14000a0c8
nop
lea rcx, [rbp + 0x70]
call fcn.14000a0c8
nop
lea rcx, [rbp + 0x90]
call fcn.14000a0c8
lea rdx, [rbp + 0x100]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14024fa2d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rbp + 0x50]
call fcn.14000a0c8
nop
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x14024fc18
mov qword [rbp + 0x38], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PS_]
nop
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14024fc33
mov qword [rbp - 0x10], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PS_]
nop
test edi, edi
js 0x14024fcd4
mov rcx, qword [rbp + 8]
mov rax, qword [rcx]
lea rdx, [rbp - 0x28]
mov rax, qword [rax + 0x40]
call qword [str.PS_]
mov edi, eax
test eax, eax
js 0x14024fcd4
lea rcx, [rbp + 0xb0]
call fcn.14000a0c8
nop
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14024fc7e
mov qword [rbp - 8], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PS_]
nop
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x14024fc99
mov qword [rbp + 0x10], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PS_]
nop
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x14024fcb4
mov qword [rbp + 0x18], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PS_]
nop
mov rcx, qword [rbp]
test rcx, rcx
je 0x14024fccf
mov qword [rbp], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PS_]
nop
jmp 0x14024f711
mov qword [rbp + 0x50], r12
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
mov r8d, 0x25
lea rdx, str.Exe_to_friendly_name_iteration_failed
lea rcx, [rbp + 0x50]
call fcn.14000b760
nop
mov dword [rbp - 0x18], edi
mov rcx, qword [r14 + 0x38]
test rcx, rcx
je 0x14024fe45
mov rax, qword [rcx]
lea r8, [rbp - 0x18]
lea rdx, [rbp + 0x50]
mov rax, qword [rax + 0x10]
call qword [str.PS_]
nop
lea rcx, [rbp + 0x50]
call fcn.14000a0c8
nop
lea rcx, [rbp + 0xb0]
call fcn.14000a0c8
nop
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14024fd4f
mov qword [rbp - 8], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PS_]
nop
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x14024fd6a
mov qword [rbp + 0x10], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PS_]
nop
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x14024fd85
mov qword [rbp + 0x18], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PS_]
nop
mov rcx, qword [rbp]
test rcx, rcx
je 0x14024fda0
mov qword [rbp], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PS_]
nop
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x14024fdbb
mov qword [rbp + 8], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PS_]
nop
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14024fdd6
mov qword [rbp + 0x40], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PS_]
nop
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14024fdf1
mov qword [rbp + 0x48], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PS_]
nop
lea rcx, [rbp + 0xd0]
call fcn.14024ede4
nop
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x14024fe19
mov qword [rbp + 0x20], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.PS_]
nop
mov eax, edi
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.1400b1670
mov rbx, qword [rsp + 0x4b8]
add rsp, 0x460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14008cf40
nop
call fcn.1402508f0
nop
call fcn.14008cf40
nop
call fcn.14008cf40
nop
call fcn.140006ad8
int3