Function at 0x1400032a0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
mov rax, qword [0x140020008]
xor rax, rsp
mov qword [rbp + 0x590], rax
xor esi, esi
mov qword [rsp + 0x30], rcx
mov rdi, rcx
mov qword [rsp + 0x60], r9
lea rax, [rbp - 0x10]
mov qword [rsp + 0x58], r8
mov r15, r8
mov qword [rbp - 0x10], rsi
lea ecx, [rsi + 0x30]
mov qword [rbp - 8], rax
call fcn.1400062b0
xorps xmm0, xmm0
mov rbx, rax
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
cmp rax, rdi
je 0x140003364
cmp qword [rdi + 0x18], 8
mov r9, rdi
mov rdx, qword [rdi + 0x10]
jb 0x140003329
mov r9, qword [rdi]
cmp rdx, 7
ja 0x14000335c
cmp qword [rax + 0x18], 8
mov rsi, rbx
jb 0x14000333c
mov rsi, qword [rax]
lea rdi, [rdx + rdx]
mov qword [rax + 0x10], rdx
mov r8, rdi
mov rdx, r9
mov rcx, rsi
call fcn.140008540
xor eax, eax
mov word [rdi + rsi], ax
xor esi, esi
jmp 0x140003364
mov rcx, rbx
call fcn.1400022f0
mov qword [rbx + 0x20], rsi
lea rcx, [rbx + 0x20]
mov rax, qword [rbp - 8]
mov qword [rbx + 0x28], rax
mov rax, qword [rbp - 8]
mov qword [rax], rbx
mov qword [rbp - 8], rcx
nop
mov r14, qword [rbp - 0x10]
test r14, r14
je 0x140003c8f
mov rdx, r14
lea rcx, [rbp + 0x2d0]
call fcn.140003f00
lea rdx, [rbp + 0x2d0]
lea rcx, [rbp - 0x50]
call fcn.140003f00
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.140002460
cmp qword [rbp + 0x2c8], 8
lea rcx, [rbp + 0x2b0]
lea rdx, [rbp + 0x340]
cmovae rcx, qword [rbp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x140003520
mov rcx, qword [r14 + 0x20]
mov rax, qword [r14 + 0x28]
test rcx, rcx
je 0x1400033ff
mov qword [rcx + 0x28], rax
jmp 0x140003403
mov qword [rbp - 8], rax
mov rcx, qword [r14 + 0x28]
mov rax, qword [r14 + 0x20]
mov qword [rcx], rax
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x14000344d
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003448
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003d0d
mov rcx, rdi
call fcn.1400062ec
mov edx, gethostbyname
mov qword [r14 + 0x10], rsi
mov rcx, r14
mov qword [r14 + 0x18], 7
mov word [r14], si
call fcn.1400062ec
mov rdx, qword [rbp + 0x2c8]
cmp rdx, 8
jb 0x1400034b0
mov rcx, qword [rbp + 0x2b0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034ab
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003d0d
call fcn.1400062ec
mov rdx, qword [rbp + 0x2e8]
mov qword [rbp + 0x2c0], rsi
mov qword [rbp + 0x2c8], 7
mov word [rbp + 0x2b0], si
cmp rdx, 8
jb 0x140003380
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000350e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003d0d
call fcn.1400062ec
jmp 0x140003380
mov byte [rsp + 0x20], 0
mov byte [rsp + 0x21], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x22], 0x3c
mov byte [rsp + 0x23], 0x3c
mov byte [rsp + 0x24], 0x3c
movzx eax, byte [rsp + 0x21]
movzx eax, byte [rsp + 0x20]
test al, al
jne 0x1400035a2
mov rdi, rsi
nop word [rax + rax]
movzx ecx, byte [rsp + rdi + 0x21]
mov eax, 0x3c
sub eax, ecx
lea ecx, [rax + rax*2]
mov eax, 0x81020409
shl ecx, 3
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov eax, 0x81020409
add ecx, 0x7f
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rsp + rdi + 0x21], cl
inc rdi
cmp rdi, 4
jb 0x140003550
lea rdx, [rsp + 0x21]
lea rcx, [rbp + 0x36c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140003b68
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x29], reloc.WS2_32.dll_inet_ntoa
mov byte [rsp + 0x2a], 0x53
mov byte [rsp + 0x2b], reloc.WS2_32.dll_inet_ntoa
mov byte [rsp + 0x2c], 0x53
mov byte [rsp + 0x2d], 0x53
mov byte [rsp + 0x2e], 0x53
movzx eax, byte [rsp + 0x29]
movzx eax, byte [rsp + 0x28]
test al, al
jne 0x140003642
mov rdi, rsi
movzx ecx, byte [rsp + rdi + 0x29]
mov eax, 0x53
sub eax, ecx
lea ecx, [rax + rax*4]
mov eax, 0x81020409
shl ecx, 3
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov eax, 0x81020409
add ecx, 0x7f
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rsp + rdi + 0x29], cl
inc rdi
cmp rdi, 6
jb 0x1400035f0
lea rdx, [rsp + 0x29]
lea rcx, [rbp + 0x36c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140003b68
mov eax, dword [rbp + 0x340]
bt eax, 0xa
jb 0x140003b68
test al, 0x10
je 0x140003876
lea rcx, [rbp + 0x36c]
call fcn.140002ba0
test eax, eax
je 0x140003876
lea rdx, [rbp + 0x36c]
lea rcx, [rbp - 0x30]
call fcn.140003dc0
mov r12, qword [rbp + 0x2e8]
mov r15, rax
mov rbx, qword [rbp + 0x2e0]
cmp r12, 8
mov qword [rsp + 0x70], rsi
movabs rax, 0x7ffffffffffffffe
lea rsi, [rbp + 0x2d0]
cmovae rsi, qword [rbp + 0x2d0]
cmp rbx, rax
ja 0x140003d25
cmp rbx, 8
jae 0x1400036f4
movups xmm0, xmmword [rsi]
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], 7
movups xmmword [rsp + 0x68], xmm0
jmp 0x1400037ab
mov rdi, rbx
or rdi, 7
mov qword [rbp + 0x330], rdi
cmp rdi, rax
jbe 0x14000371a
mov rdi, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14000374d
mov eax, 0xa
cmp rdi, rax
mov qword [rbp - 0x58], rax
cmovb rdi, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rdi + 1]
cmp rcx, rax
ja 0x140003d1f
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000377c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003d1f
mov rcx, rax
call fcn.1400062b0
mov rcx, rax
test rax, rax
je 0x140003d19
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000378a
test rcx, rcx
je 0x140003788
call fcn.1400062b0
jmp 0x14000378a
xor eax, eax
lea r8, [rbx*2 + 2]
mov qword [rsp + 0x68], rax
mov rdx, rsi
mov qword [rsp + 0x78], rbx
mov rcx, rax
mov qword [rbp - 0x80], rdi
call fcn.140008540
mov r8, r15
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x310]
call fcn.1400027a0
mov ecx, gethostbyname
call fcn.1400062b0
xorps xmm0, xmm0
lea rdx, [rbp + 0x310]
xor esi, esi
mov rcx, rax
mov rdi, rax
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
call fcn.140003d40
mov qword [rdi + 0x20], rsi
lea rdx, [rdi + 0x20]
mov rcx, qword [rbp - 8]
mov qword [rdi + 0x28], rcx
mov rax, qword [rbp - 8]
mov qword [rax], rdi
mov qword [rbp - 8], rdx
mov rdx, qword [rbp + 0x328]
cmp rdx, 8
jb 0x140003853
mov rcx, qword [rbp + 0x310]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000384e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003d0d
call fcn.1400062ec
mov r15, qword [rsp + 0x58]
mov qword [rbp + 0x320], rsi
mov qword [rbp + 0x328], 7
mov word [rbp + 0x310], si
jmp 0x140003b6f
lea rdx, str..EXTEN
lea rcx, [rbp + 0x36c]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x140003b68
xorps xmm0, xmm0
lea rax, [rbp + 0x36c]
movups xmmword [rsp + 0x38], xmm0
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400038b0
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
ja 0x140003d37
cmp rdi, 8
jae 0x140003902
mov qword [rsp + 0x48], rdi
lea rdx, [rbp + 0x36c]
add rdi, rdi
mov qword [rsp + 0x50], 7
mov r8, rdi
lea rcx, [rsp + 0x38]
call fcn.140008540
mov word [rsp + rdi + 0x38], si
jmp 0x1400039b6
mov rbx, rdi
or rbx, 7
cmp rbx, rax
jbe 0x140003921
mov rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x140003951
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x140003d31
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000397d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003d31
mov rcx, rax
call fcn.1400062b0
test rax, rax
je 0x140003d2b
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000398a
test rcx, rcx
je 0x14000398a
call fcn.1400062b0
mov rsi, rax
mov qword [rsp + 0x48], rdi
lea rdx, [rbp + 0x36c]
add rdi, rdi
mov qword [rsp + 0x38], rsi
mov r8, rdi
mov qword [rsp + 0x50], rbx
mov rcx, rsi
call fcn.140008540
xor eax, eax
mov word [rdi + rsi], ax
xor esi, esi
mov r12, qword [rbp + 0x2e8]
movabs rax, 0x7ffffffffffffffe
mov rbx, qword [rbp + 0x2e0]
cmp r12, 8
mov qword [rbp - 0x70], rsi
lea rsi, [rbp + 0x2d0]
cmovae rsi, qword [rbp + 0x2d0]
cmp rbx, rax
ja 0x140003d37
cmp rbx, 8
jae 0x140003a0c
movups xmm0, xmmword [rsi]
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], 7
movups xmmword [rbp - 0x78], xmm0
jmp 0x140003ab7
mov rdi, rbx
or rdi, 7
cmp rdi, rax
jbe 0x140003a2b
mov rdi, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x140003a5b
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rdi + 1]
cmp rcx, rax
ja 0x140003d31
add rcx, rcx
cmp rcx, 0x1000
jb 0x140003a8a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003d31
mov rcx, rax
call fcn.1400062b0
mov rcx, rax
test rax, rax
je 0x140003d2b
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140003a98
test rcx, rcx
je 0x140003a96
call fcn.1400062b0
jmp 0x140003a98
xor eax, eax
lea r8, [rbx*2 + 2]
mov qword [rbp - 0x78], rax
mov rdx, rsi
mov qword [rbp - 0x68], rbx
mov rcx, rax
mov qword [rbp - 0x60], rdi
call fcn.140008540
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x2f0]
call fcn.1400027a0
mov rdx, qword [rsp + 0x60]
lea rdi, [rbp]
xor eax, eax
mov ecx, 0x2a8
cmp qword [rbp + 0x308], 8
mov r9, r15
rep stosb byte [rdi], al
lea rax, [rbp + 0x2f0]
cmovae rax, qword [rbp + 0x2f0]
lea rcx, [rbp]
mov qword [rbp], rax
call fcn.140001cd0
mov rdx, qword [rbp + 0x308]
cmp rdx, 8
jb 0x140003b4b
mov rcx, qword [rbp + 0x2f0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b46
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003d2b
call fcn.1400062ec
xor esi, esi
mov qword [rbp + 0x308], 7
mov qword [rbp + 0x300], rsi
mov word [rbp + 0x2f0], si
jmp 0x140003b6f
mov r12, qword [rbp + 0x2e8]
lea rdx, [rbp + 0x340]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140003520
mov rcx, qword [r14 + 0x20]
mov rax, qword [r14 + 0x28]
test rcx, rcx
je 0x140003b9a
mov qword [rcx + 0x28], rax
jmp 0x140003b9e
mov qword [rbp - 8], rax
mov rcx, qword [r14 + 0x28]
mov rax, qword [r14 + 0x20]
mov qword [rcx], rax
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x140003be8
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003be3
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003d0d
mov rcx, rdi
call fcn.1400062ec
mov edx, gethostbyname
mov qword [r14 + 0x10], rsi
mov rcx, r14
mov qword [r14 + 0x18], 7
mov word [r14], si
call fcn.1400062ec
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, gethostbyname
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rbp + 0x2c8]
cmp rdx, 8
jb 0x140003c5f
mov rcx, qword [rbp + 0x2b0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c5a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003d0d
call fcn.1400062ec
mov qword [rbp + 0x2c0], rsi
mov qword [rbp + 0x2c8], 7
mov word [rbp + 0x2b0], si
cmp r12, 8
jb 0x140003380
lea rdx, [r12*2 + 2]
jmp 0x1400034e2
mov rdi, qword [rsp + 0x30]
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140003cd4
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003ccf
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003d13
mov rcx, rdi
mov rdi, qword [rsp + 0x30]
call fcn.1400062ec
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
mov rcx, qword [rbp + 0x590]
xor rcx, rsp
call fcn.140006290
mov rbx, qword [rsp + 0x6e8]
add rsp, 0x6a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14000a678
int3
call fcn.14000a678
int3
call fcn.14000a678
int3
call fcn.140002220
int3
call fcn.1400022c0
int3
call fcn.14000a678
int3
call fcn.140002220
int3
call fcn.1400022c0
int3