Function at 0x140004e90
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x2f0], rbx
mov rax, qword [0x14005d3d0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, r8
mov rdi, rdx
mov qword [rsp + 0x20], rdx
mov r13d, 1
mov rcx, qword [rdx]
sub rcx, 0x18
call fcn.140001e50
add rax, 0x18
mov qword [rsp + 0x40], rax
mov r8d, r13d
lea rdx, [0x140050f34]
lea rcx, [rsp + 0x40]
call fcn.1400058d0
mov rdx, qword [rbx]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400058d0
xor ebp, ebp
mov dword [rsp + 0x50], ebp
xor edx, edx
mov r8d, 0x24c
lea rcx, [rsp + 0x54]
call fcn.14000c570
lea rdx, [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x28], rax
or r15, 0xffffffffffffffff
cmp rax, r15
je 0x14000513a
nop
test byte [rsp + 0x50], 0x10
jne 0x1400050c1
mov rbx, qword [rdi]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x140004f81
cmp rax, qword [rbx - 0x18]
jne 0x140004f81
lea rdi, [rbx - 0x18]
lock inc dword [rbx - 8]
jmp 0x140004fbc
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rdi, rax
test rax, rax
je 0x140005124
mov ecx, dword [rbx - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rbx - 0x10]
inc ecx
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.14000c238
lea rax, [rdi + 0x18]
mov qword [rsp + 0x38], rax
mov r8d, r13d
lea rdx, [0x140050f34]
lea rcx, [rsp + 0x38]
call fcn.1400058d0
lea rcx, [rsp + 0x7c]
mov rax, r15
inc rax
cmp word [rcx + rax*2], 0
jne 0x140004fe1
lea r12, [rsp + 0x7c]
lea rsi, [rsp + 0x7c]
mov rbx, qword [rsp + 0x38]
sub rsi, rbx
sar rsi, 1
mov r14d, dword [rbx - 0x10]
mov ecx, ebp
test eax, eax
setns cl
test ecx, ecx
je 0x140005119
movsxd rdx, eax
lea rcx, [rsp + 0x7c]
call fcn.14000d8c0
mov rbp, rax
mov ecx, 0x7fffffff
sub ecx, eax
xor edx, edx
cmp ecx, r14d
setge dl
test edx, edx
je 0x14000510e
lea edi, [r14 + rax]
test edi, edi
js 0x140005103
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140005066
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140002740
mov rbx, qword [rsp + 0x38]
cmp rsi, r14
ja 0x14000506f
lea r12, [rbx + rsi*2]
movsxd rdx, ebp
add rdx, rdx
lea rcx, [rbx + r14*2]
mov r9, rdx
mov r8, r12
call fcn.14000c238
cmp edi, dword [rbx - 0xc]
jg 0x1400050f8
mov dword [rbx - 0x10], edi
movsxd rax, edi
xor ebp, ebp
mov word [rbx + rax*2], bp
lea rcx, [rsp + 0x38]
call fcn.1400045d0
test eax, eax
je 0x1400050da
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400050bc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x20]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14000512a
jmp 0x140004f50
mov r13d, ebp
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000512a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14000512a
mov ecx, 0x80070057
call fcn.140001260
int3
mov ecx, 0x80070057
call fcn.140001260
int3
mov ecx, 0x80070057
call fcn.140001260
int3
mov ecx, 0x80070057
call fcn.140001260
nop
call fcn.140001f60
int3
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbx, qword [rsp + 0x40]
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000514f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, r13d
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14000bb80
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret