Function at 0x140019830
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
push rbp
push rsi
push r13
push r14
sub rsp, 0x60
xor r13d, r13d
mov rbp, r9
mov rsi, r8
mov r14, rcx
test r9, r9
je 0x140019884
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140019854
lfence
mov r8, r14
mov rdx, rbp
mov rcx, rsi
cmp rax, rbp
jae 0x140019876
call fcn.140055a48
jmp 0x140019884
dec r9
call fcn.1400580e8
mov word [rsi + rbp*2 - 2], r13w
lea rbx, str.em000_64
mov rdx, rbp
mov r8, rbx
mov rcx, rsi
call fcn.140045c80
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rsi + rcx*2], r13w
jne 0x1400198a0
lea rax, [rcx + 1]
cmp rax, rbp
jae 0x1400198e9
lea rax, [rcx + 5]
lfence
lea r8, str..dll
mov rdx, rbp
cmp rax, rbp
ja 0x1400198d3
mov rcx, rsi
call fcn.14005ec5c
jmp 0x1400198e9
sub rdx, rcx
lea rcx, [rsi + rcx*2]
lea r9, [rdx - 1]
call fcn.1400580e8
mov word [rsi + rbp*2 - 2], r13w
mov rcx, rsi
call fcn.140019710
test al, al
je 0x140019903
mov al, 1
add rsp, 0x60
pop r14
pop r13
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x98], rdi
lea r8, [0x140085c88]
mov qword [rsp + 0x58], r12
mov r9, r14
mov rdx, rbp
mov qword [rsp + 0x50], r15
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call fcn.140045e00
mov r15d, r13d
test rsi, rsi
je 0x1400199af
mov ecx, 0x468
call fcn.14004e0e4
mov rdi, rax
test rax, rax
je 0x1400199af
xor edx, edx
mov r8d, 0x468
mov rcx, rax
call fcn.140049dd0
mov eax, dword [0x14009714c]
cmp eax, 0xffffffff
jne 0x14001997b
xor r8d, r8d
lea edx, [rax + 2]
lea ecx, [rax + 7]
call fcn.140044a00
movzx eax, al
mov dword [0x14009714c], eax
cmp eax, 1
mov dword [rsp + 0x28], r13d
mov edx, r13d
mov qword [rsp + 0x20], r13
sete dl
lea r8, [rdi + 8]
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov qword [rdi], rax
cmp rax, 0xffffffffffffffff
jne 0x1400199d0
mov rcx, rdi
call fcn.14004e0d0
xor al, al
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x98]
mov r15, qword [rsp + 0x50]
add rsp, 0x60
pop r14
pop r13
pop rsi
pop rbp
pop rbx
ret
cmp dword [rdi + 0x460], r13d
jne 0x140019ad3
lea r8, [rdi + 0x34]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [r8 + rax*2], r13w
jne 0x1400199f0
lfence
mov edx, 0x104
lea rcx, [rdi + 0x258]
cmp rax, rdx
jae 0x140019a15
call fcn.140055a48
jmp 0x140019a28
mov r9d, 0x103
call fcn.1400580e8
mov word [rdi + 0x45e], r13w
mov rcx, qword [rdi]
lea rdx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140019a43
mov dword [rdi + 0x460], 1
mov r8d, 0xa
mov qword [rsp + 0x40], r13
lea rdx, [rsp + 0x40]
lea rcx, [rdi + 0x258]
call fcn.14004f8ac
mov ebx, eax
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x1400199d0
cmp word [rax], r13w
jne 0x1400199d0
lea ecx, [rbx - 1]
cmp ecx, 0xfffffffd
ja 0x1400199d0
cmp r15d, ebx
jae 0x1400199d0
lfence
lea rax, str.em000_64
mov r9, r14
mov qword [rsp + 0x30], rax
lea r8, str._s_s_u_s.dll
mov dword [rsp + 0x28], ebx
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140045e00
mov rcx, rsi
call fcn.140019710
test al, al
je 0x1400199d0
mov r15d, ebx
jmp 0x1400199d0
mov rcx, qword [rdi]
cmp rcx, 0xffffffffffffffff
je 0x140019aee
call qword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
je 0x140019aee
mov rcx, rdi
call fcn.14004e0d0
test r15d, r15d
je 0x1400199af
lea rax, str.em000_64
mov r9, r14
mov qword [rsp + 0x30], rax
lea r8, str._s_s_u_s.dll
mov dword [rsp + 0x28], r15d
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140045e00
mov al, 1
jmp 0x1400199b1