Function at 0x140038320
Capabilities:
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x588
movaps xmmword [rsp + 0x570], xmm6
mov ebx, r9d
mov r13, r8
mov r12, rdx
mov rsi, rcx
mov rax, qword [0x14019ac40]
xor rax, rsp
mov qword [rsp + 0x568], rax
lea rdi, [rsp + 0x468]
mov qword [rsp + 0x450], rdi
movdqa xmm6, xmmword [0x14016ddb0]
movdqu xmmword [rsp + 0x458], xmm6
mov word [rsp + 0x210], 0x105
mov qword [rsp + 0x200], r8
lea rdx, [rsp + 0x200]
lea r8, [rsp + 0x450]
mov r9d, 0x104
call fcn.140035ea0
cmp dword [rsi], 0
je 0x1400383ee
mov rcx, qword [rsp + 0x450]
cmp rcx, rdi
je 0x1400383bf
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x568]
xor rcx, rsp
call fcn.14016a260
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x570]
add rsp, 0x588
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x458]
test rax, rax
je 0x14003842c
mov rcx, qword [rsp + 0x450]
movzx edx, word [rcx + rax*2 - 2]
add edx, 0xffffffd1
cmp dx, 0x2d
ja 0x1400385d8
movzx edx, dx
movabs rbp, 0x200000000801
bt rbp, rdx
jae 0x1400385d8
lea r8, [rax + 1]
cmp r8, qword [rsp + 0x460]
ja 0x140038616
add rax, rax
add rax, qword [rsp + 0x450]
mov word [rax], 0x2a
mov r8, qword [rsp + 0x458]
lea rax, [r8 + 1]
mov qword [rsp + 0x458], rax
add r8, 2
cmp r8, qword [rsp + 0x460]
ja 0x140038929
mov rcx, qword [rsp + 0x450]
mov word [rcx + rax*2], 0
mov rcx, qword [rsp + 0x450]
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x200]
mov edx, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
cmp rax, 0xffffffffffffffff
je 0x140038557
mov rbp, rax
mov byte [rsp + 0x3f], bl
lea rbx, [rsp + 0x22c]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
lea rdi, [rsp + 0x200]
mov r14, qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
nop dword [rax]
movzx ecx, word [rsp + 0x22c]
cmp rax, 1
jne 0x140038504
cmp cx, 0x2e
je 0x14003851b
cmp rax, 2
jne 0x14003856c
cmp cx, 0x2e
jne 0x14003856c
cmp word [rsp + 0x22e], 0x2e
jne 0x14003856c
mov rcx, rbp
mov rdx, rdi
call r14
test eax, eax
je 0x140038530
mov rcx, rbx
call r15
jmp 0x1400384f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
cmp eax, 0x12
jne 0x1400385c4
mov rdx, r12
call fcn.1400389c0
lea rdi, [rsp + 0x468]
jmp 0x140038911
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edx, eax
call fcn.14002e8d0
jmp 0x1400383ac
lea r14, [rsp + 0x180]
mov qword [rsp + 0x168], r14
movdqu xmmword [rsp + 0x170], xmm6
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
lea rdi, [rsp + 0x168]
mov qword [rsp + 0x20], rdi
mov rcx, rsi
mov edx, 0xfde9
mov r8, rbx
mov r9, rax
call fcn.140039f50
cmp dword [rsi], 0
je 0x140038639
lea rdi, [rsp + 0x468]
jmp 0x1400388fe
mov edx, eax
call fcn.14002e8d0
lea rdi, [rsp + 0x468]
jmp 0x140038911
lea r8, [rax + 1]
cmp r8, qword [rsp + 0x460]
ja 0x14003894c
mov word [rcx + rax*2], 0x5c
mov r8, qword [rsp + 0x458]
lea rax, [r8 + 1]
mov qword [rsp + 0x458], rax
add r8, 2
cmp r8, qword [rsp + 0x460]
jbe 0x14003843e
lea rcx, [rsp + 0x450]
mov r9d, 2
mov rdx, rdi
call fcn.1400291c0
mov rax, qword [rsp + 0x458]
jmp 0x14003843e
mov qword [r12], rbp
mov rbp, qword [r13]
mov rbx, qword [r13 + 8]
lea rax, [rsp + 0xe8]
mov qword [rsp + 0xd0], rax
movdqu xmmword [rsp + 0xd8], xmm6
mov r13, r14
cmp rbx, 0x81
jb 0x140038695
lea rcx, [rsp + 0xd0]
mov r9d, 1
mov rdx, rax
mov r8, rbx
call fcn.1400291c0
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xd8]
jmp 0x14003869c
xor ecx, ecx
test rbx, rbx
je 0x1400386b2
add rcx, rax
mov rdx, rbp
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsp + 0xd8]
add rcx, rbx
mov qword [rsp + 0xd8], rcx
mov word [rsp + 0x98], 0x101
mov word [rsp + 0x80], 0x101
mov word [rsp + 0x68], 0x101
mov word [rsp + 0x50], 0x106
mov qword [rsp + 0x40], rdi
lea r14, [rsp + 0x88]
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r15, [rsp + 0xd0]
lea r8, [rsp + 0x40]
lea r9, [rsp + 0x58]
mov rcx, r15
mov edx, 2
call fcn.1400317a0
mov rdi, qword [rsp + 0x21c]
movdqu xmm0, xmmword [rsp + 0x20c]
mov eax, dword [rsp + 0x200]
test al, 1
mov ecx, 0x1ff
mov ebp, 0x16d
cmove ebp, ecx
pshufd xmm6, xmm0, 0xb1
and eax, 0x10
cmp eax, 1
mov ebx, 3
sbb ebx, 0
mov word [rsp + 0x80], 0x106
mov qword [rsp + 0x70], r15
lea rcx, [rsp + 0x70]
mov rdx, r14
call fcn.1400400d0
mov dword [rsp + 0xa8], ebx
mov al, byte [rsp + 0x3f]
mov byte [rsp + 0xac], al
movdqu xmmword [rsp + 0xb0], xmm6
mov qword [rsp + 0xc0], rdi
mov dword [rsp + 0xc8], ebx
mov dword [rsp + 0xcc], ebp
lea rdi, [r12 + 8]
cmp r14, rdi
je 0x140038833
mov rax, qword [r12 + 0x20]
cmp rax, 0x10
jb 0x1400387ee
mov rcx, qword [rdi]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400387e9
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x1400389ad
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.14016a23c
movups xmm0, xmmword [rsp + 0x88]
movups xmm1, xmmword [rsp + 0x98]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov rax, qword [r14 + 0x40]
mov qword [r12 + 0x48], rax
movdqu xmm0, xmmword [r14 + 0x20]
movups xmm1, xmmword [r14 + 0x30]
movups xmmword [r12 + 0x38], xmm1
movdqu xmmword [r12 + 0x28], xmm0
lea rdi, [rsp + 0x468]
mov r14, r13
jmp 0x1400388a6
mov rax, qword [rsp + 0xa0]
mov rcx, qword [r14 + 0x40]
mov qword [r12 + 0x48], rcx
movdqu xmm0, xmmword [r14 + 0x20]
movups xmm1, xmmword [r14 + 0x30]
movups xmmword [r12 + 0x38], xmm1
movdqu xmmword [r12 + 0x28], xmm0
cmp rax, 0x10
lea rdi, [rsp + 0x468]
mov r14, r13
jb 0x1400388a6
mov rcx, qword [rsp + 0x88]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400388a1
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x1400389ad
add rax, 0x28
mov rdx, rax
mov rcx, rbp
call fcn.14016a23c
mov dword [rsi], 0
mov eax, dword [0x14019c710]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
jg 0x140038977
lea rax, [0x14019a518]
mov qword [rsi + 8], rax
mov rcx, qword [rsp + 0xd0]
lea rax, [rsp + 0xe8]
cmp rcx, rax
je 0x1400388f7
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbp, 0xffffffffffffffff
mov rcx, qword [rsp + 0x168]
cmp rcx, r14
je 0x140038911
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp rbp, 0xffffffffffffffff
je 0x1400383ac
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1400383ac
lea rcx, [rsp + 0x450]
mov r9d, 2
mov rdx, rdi
call fcn.1400291c0
mov rax, qword [rsp + 0x458]
jmp 0x140038474
lea rcx, [rsp + 0x450]
mov r9d, 2
mov rdx, rdi
call fcn.1400291c0
mov rcx, qword [rsp + 0x450]
mov rax, qword [rsp + 0x458]
jmp 0x1400385ea
lea rcx, [0x14019c710]
call fcn.14016a3dc
cmp dword [0x14019c710], 0xffffffff
jne 0x1400388d1
lea rcx, [0x14003a600]
call fcn.14016a724
lea rcx, [0x14019c710]
call fcn.14016a37c
jmp 0x1400388d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3