Function at 0x140085dc0
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x700
mov rax, qword [0x1401f3df8]
xor rax, rsp
mov qword [rsp + 0x6f0], rax
mov qword [r11 + 8], rbx
lea rcx, [rsp + 0x30]
xor edx, edx
mov qword [r11 + 0x18], rdi
mov r8d, 0x104
call fcn.140099b00
lea rdx, [0x14010e208]
lea rcx, str.HOME_ROOT__nTEMP_TEMP__nDV_DVDIR__nLOG_DATA_log_nBIN_DATA__bin_nLOCK_DATA__nEXE_DRIVER__nDLL_DRIVER__nDLLALT_SYSTEM_IntelDPTF_n_nDPTF_ROOT_ui_nDSP_ROOT_dsp_nCMD_ROOT_cmd_nUI_ROOT_ui_n
call fcn.140085590
mov rdi, rax
test rax, rax
jne 0x140085e28
lea rdx, [0x14010e208]
lea rcx, str.LEGDRIVERDIR_SYSTEM_IntelDPTF_nDATADIR_DRVDATA_IntelDPTF_nLEGDATADIR_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_nSSDVDIR_DATA_dv_nLEGDVDIR_DATA__n
call fcn.140085590
mov rdi, rax
lea rdx, str.LEGDATADIR
lea rcx, str.HOME_ROOT__nTEMP_TEMP__nDV_DVDIR__nLOG_DATA_log_nBIN_DATA__bin_nLOCK_DATA__nEXE_DRIVER__nDLL_DRIVER__nDLLALT_SYSTEM_IntelDPTF_n_nDPTF_ROOT_ui_nDSP_ROOT_dsp_nCMD_ROOT_cmd_nUI_ROOT_ui_n
call fcn.140085590
mov rbx, rax
test rax, rax
jne 0x140085e59
lea rdx, str.LEGDATADIR
lea rcx, str.LEGDRIVERDIR_SYSTEM_IntelDPTF_nDATADIR_DRVDATA_IntelDPTF_nLEGDATADIR_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_nSSDVDIR_DATA_dv_nLEGDVDIR_DATA__n
call fcn.140085590
mov rbx, rax
lea rdx, [0x14010e21c]
lea rcx, str.HOME_ROOT__nTEMP_TEMP__nDV_DVDIR__nLOG_DATA_log_nBIN_DATA__bin_nLOCK_DATA__nEXE_DRIVER__nDLL_DRIVER__nDLLALT_SYSTEM_IntelDPTF_n_nDPTF_ROOT_ui_nDSP_ROOT_dsp_nCMD_ROOT_cmd_nUI_ROOT_ui_n
call fcn.140085590
mov rsi, rax
test rax, rax
jne 0x140085e8a
lea rdx, [0x14010e21c]
lea rcx, str.LEGDRIVERDIR_SYSTEM_IntelDPTF_nDATADIR_DRVDATA_IntelDPTF_nLEGDATADIR_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_nSSDVDIR_DATA_dv_nLEGDVDIR_DATA__n
call fcn.140085590
mov rsi, rax
test rdi, rdi
je 0x140086029
test rbx, rbx
je 0x140086021
test rsi, rsi
je 0x140086021
mov rcx, rdi
call fcn.140085140
test eax, eax
jne 0x140086021
mov qword [rsp + 0x718], rbp
lea r8, str._s_s
lea rbp, str.dsp.dv
mov r9, rsi
lea rdx, [rsp + 0x4d0]
mov qword [rsp + 0x20], rbp
mov ecx, 0x104
call fcn.1400852c0
mov r9, rdi
mov qword [rsp + 0x20], rbp
lea r8, str._s_s
mov ecx, 0x104
lea rdx, [rsp + 0x3c0]
call fcn.1400852c0
mov r8b, 1
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0x4d0]
call fcn.1400847a0
lea rax, str..dv
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x14010d32c]
lea rax, [0x14010d328]
mov ecx, 0x104
lea rdx, [rsp + 0x5e0]
mov qword [rsp + 0x20], rax
call fcn.1400852c0
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140086019
lea r8, [rsp + 0x16c]
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.1400a6c98
lea rax, [rsp + 0x30]
mov r9, rbx
lea r8, str._s_s
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x4d0]
mov ecx, 0x104
call fcn.1400852c0
lea rax, [rsp + 0x30]
mov r9, rdi
lea r8, str._s_s
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x3c0]
mov ecx, 0x104
call fcn.1400852c0
xor r8d, r8d
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0x4d0]
call fcn.1400847a0
lea rdx, [rsp + 0x280]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140086019
lea r8, [rsp + 0x2ac]
jmp 0x140085f7d
mov rbp, qword [rsp + 0x718]
mov rcx, rdi
call fcn.1400a6bb4
mov rdi, qword [rsp + 0x720]
test rbx, rbx
je 0x14008603e
mov rcx, rbx
call fcn.1400a6bb4
mov rbx, qword [rsp + 0x710]
test rsi, rsi
je 0x140086053
mov rcx, rsi
call fcn.1400a6bb4
mov rcx, qword [rsp + 0x6f0]
xor rcx, rsp
call fcn.140097fb0
add rsp, 0x700
pop rsi
ret