Function at 0x14002b3d0
Capabilities:
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x5d8
movdqa xmmword [rsp + 0x5c0], xmm8
movdqa xmmword [rsp + 0x5b0], xmm7
movdqa xmmword [rsp + 0x5a0], xmm6
mov ebp, r9d
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1402f4538]
xor rax, rsp
mov qword [rsp + 0x598], rax
lea rdi, [rsp + 0x498]
mov qword [rsp + 0x480], rdi
mov qword [rsp + 0x488], 0
mov qword [rsp + 0x490], 0x80
mov word [rsp + 0x250], 0x105
mov rax, qword [r8]
mov qword [rsp + 0x230], rax
mov rax, qword [r8 + 8]
mov qword [rsp + 0x238], rax
lea rdx, [rsp + 0x230]
lea r8, [rsp + 0x480]
mov r9d, 0x104
call fcn.140029010
cmp dword [rsi], 0
je 0x14002b4d9
mov rcx, qword [rsp + 0x480]
cmp rcx, rdi
je 0x14002b499
call qword [0x1402f0bf8]
mov rcx, qword [rsp + 0x598]
xor rcx, rsp
call fcn.140241350
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x5a0]
movaps xmm7, xmmword [rsp + 0x5b0]
movaps xmm8, xmmword [rsp + 0x5c0]
add rsp, 0x5d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x488]
test rax, rax
je 0x14002b513
mov rcx, qword [rsp + 0x480]
movzx edx, word [rcx + rax*2 - 2]
add edx, 0xffffffd1
cmp edx, 0x2d
ja 0x14002b723
movabs r8, 0x200000000801
bt r8, rdx
jae 0x14002b723
lea r8, [rax + 1]
cmp r8, qword [rsp + 0x490]
ja 0x14002b761
add rax, rax
add rax, qword [rsp + 0x480]
mov word [rax], 0x2a
mov r8, qword [rsp + 0x488]
lea rax, [r8 + 1]
mov qword [rsp + 0x488], rax
add r8, 2
cmp r8, qword [rsp + 0x490]
ja 0x14002ba20
mov rcx, qword [rsp + 0x480]
mov word [rcx + rax*2], 0
mov rcx, qword [rsp + 0x480]
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x230]
mov edx, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
cmp rax, 0xffffffffffffffff
je 0x14002b63d
mov r15, rax
mov byte [rsp + 0x3f], bpl
mov rbp, rbx
lea r12, [rsp + 0x25c]
mov rcx, r12
call qword [0x1402f0c78]
lea r13, [rsp + 0x230]
mov rdi, qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rbx, qword [0x1402f0c78]
nop word cs:[rax + rax]
movzx ecx, word [rsp + 0x25c]
cmp rax, 1
jne 0x14002b5f4
cmp cx, 0x2e
je 0x14002b60b
cmp rax, 2
jne 0x14002b652
cmp cx, 0x2e
jne 0x14002b652
cmp word [rsp + 0x25e], 0x2e
jne 0x14002b652
mov rcx, r15
mov rdx, r13
call rdi
test eax, eax
je 0x14002b61e
mov rcx, r12
call rbx
jmp 0x14002b5e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
cmp eax, 0x12
jne 0x14002b717
mov rdx, rbp
call fcn.14002bab0
jmp 0x14002ba00
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edx, eax
call fcn.1400715f0
jmp 0x14002b486
lea r13, [rsp + 0x1b0]
mov qword [rsp + 0x198], r13
mov qword [rsp + 0x1a0], 0
mov qword [rsp + 0x1a8], 0x80
mov rcx, r12
call qword [0x1402f0c78]
lea rcx, [rsp + 0x198]
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov edx, 0xfde9
mov r8, r12
mov r9, rax
call fcn.14002ce10
cmp dword [rsi], 0
jne 0x14002b9ed
mov qword [rbp], r15
mov r12, qword [r14]
mov r15, qword [r14 + 8]
lea r14, [rsp + 0x118]
mov qword [rsp + 0x100], r14
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0x80
cmp r15, 0x81
jb 0x14002b784
lea rcx, [rsp + 0x100]
mov r9d, 1
mov rdx, r14
mov r8, r15
call fcn.14001cd30
mov rax, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x108]
jmp 0x14002b78e
mov edx, eax
call fcn.1400715f0
jmp 0x14002ba00
lea r8, [rax + 1]
cmp r8, qword [rsp + 0x490]
ja 0x14002ba43
mov word [rcx + rax*2], 0x5c
mov r8, qword [rsp + 0x488]
lea rax, [r8 + 1]
mov qword [rsp + 0x488], rax
add r8, 2
cmp r8, qword [rsp + 0x490]
jbe 0x14002b525
lea rcx, [rsp + 0x480]
mov r9d, 2
mov rdx, rdi
call fcn.14001cd30
mov rax, qword [rsp + 0x488]
jmp 0x14002b525
xor ecx, ecx
mov rax, r14
test r15, r15
je 0x14002b7a4
add rcx, rax
mov rdx, r12
mov r8, r15
call fcn.140242bf0
mov rcx, qword [rsp + 0x108]
add rcx, r15
mov qword [rsp + 0x108], rcx
mov word [rsp + 0xd8], 0x101
mov word [rsp + 0xb0], 0x101
mov word [rsp + 0x88], 0x101
mov word [rsp + 0x60], 0x105
movups xmm0, xmmword [rsp + 0x198]
movups xmmword [rsp + 0x40], xmm0
lea r15, [rsp + 0xb8]
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x100]
lea r8, [rsp + 0x40]
lea r9, [rsp + 0x68]
xor edx, edx
call fcn.1400247a0
pshufd xmm6, xmmword [rsp + 0x230], 0x50
mov word [rsp + 0xb0], 0x105
movups xmm0, xmmword [rsp + 0x100]
movups xmmword [rsp + 0x90], xmm0
movdqu xmm0, xmmword [rsp + 0x23c]
pshufd xmm7, xmm0, 0xb1
movq xmm8, qword [rsp + 0x24c]
lea rcx, [rsp + 0x90]
mov rdx, r15
call fcn.140020610
movzx eax, byte [rsp + 0x3f]
mov byte [rsp + 0xdc], al
movdqu xmmword [rsp + 0xe0], xmm7
pand xmm6, xmmword [0x140243b90]
pxor xmm0, xmm0
pcmpeqd xmm0, xmm6
movdqa xmm1, xmm0
pandn xmm1, xmmword [0x140243ba0]
pand xmm0, xmmword [0x140243bb0]
por xmm0, xmm1
punpcklqdq xmm8, xmm0
movdqu xmmword [rsp + 0xf0], xmm8
movd dword [rsp + 0xd8], xmm0
lea r12, [rbp + 8]
cmp r12, r15
je 0x14002b938
mov rax, qword [rbp + 0x20]
cmp rax, 0x10
jb 0x14002b8fd
mov rcx, qword [r12]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14002b8f8
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002baa4
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140241098
movups xmm0, xmmword [rsp + 0xb8]
movups xmm1, xmmword [rsp + 0xc8]
movups xmmword [r12 + 0x10], xmm1
movups xmmword [r12], xmm0
mov rax, qword [r15 + 0x40]
mov qword [rbp + 0x48], rax
movdqu xmm0, xmmword [r15 + 0x20]
movdqu xmm1, xmmword [r15 + 0x30]
movdqu xmmword [rbp + 0x38], xmm1
movdqu xmmword [rbp + 0x28], xmm0
jmp 0x14002b99d
mov rax, qword [rsp + 0xd0]
mov rcx, qword [r15 + 0x40]
mov qword [rbp + 0x48], rcx
movdqu xmm0, xmmword [r15 + 0x20]
movdqu xmm1, xmmword [r15 + 0x30]
movdqu xmmword [rbp + 0x38], xmm1
movdqu xmmword [rbp + 0x28], xmm0
cmp rax, 0x10
jb 0x14002b99d
mov rcx, qword [rsp + 0xb8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14002b998
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002baa4
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140241098
mov dword [rsi], 0
mov eax, dword [0x1402f5d00]
mov ecx, dword [0x1402f6910]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002ba6e
lea rax, str._4__
mov qword [rsi + 8], rax
mov rcx, qword [rsp + 0x100]
cmp rcx, r14
je 0x14002b9e6
call qword [0x1402f0bf8]
mov r15, 0xffffffffffffffff
mov rcx, qword [rsp + 0x198]
cmp rcx, r13
je 0x14002ba00
call qword [0x1402f0bf8]
lea rdi, [rsp + 0x498]
cmp r15, 0xffffffffffffffff
je 0x14002b486
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x14002b486
lea rcx, [rsp + 0x480]
mov r9d, 2
mov rdx, rdi
call fcn.14001cd30
mov rax, qword [rsp + 0x488]
jmp 0x14002b55b
lea rcx, [rsp + 0x480]
mov r9d, 2
mov rdx, rdi
call fcn.14001cd30
mov rcx, qword [rsp + 0x480]
mov rax, qword [rsp + 0x488]
jmp 0x14002b735
lea rcx, [0x1402f5d00]
call fcn.14024119c
cmp dword [0x1402f5d00], 0xffffffff
jne 0x14002b9c8
lea rcx, [fcn.1400039b0]
call fcn.140241370
lea rcx, [0x1402f5d00]
call fcn.140241204
jmp 0x14002b9c8
call qword [0x1402f0b58]
int3