Function at 0x140009620
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rax - 0x348]
sub rsp, 0x420
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140023258]
xor rax, rsp
mov qword [rbp + 0x310], rax
mov rsi, rcx
mov qword [rbp - 0x80], rcx
xor edx, edx
mov r8d, 0x140
lea rcx, [rbp + 0xc0]
call fcn.14000eb10
lea r8, str..
mov rdx, rsi
lea rcx, [rbp - 0x50]
call fcn.14000b1e0
nop
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
lea rdx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x1400096e1
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp qword [rbp - 0x38], 8
jb 0x1400096ca
mov rcx, qword [rbp - 0x50]
call fcn.14000b8a0
mov qword [rbp - 0x38], 7
xor ebx, ebx
mov qword [rbp - 0x40], rbx
mov word [rbp - 0x50], bx
jmp 0x140009a0b
lea rdx, [rbp + 0xc0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor ebx, ebx
test eax, eax
je 0x1400099eb
movabs r14, 0xfe624e212ac18000
movabs r13, 0xd6bf94d5e57a42bd
nop
lea rdx, [0x14001de9c]
lea rcx, [rbp + 0xec]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400099d3
lea rdx, [0x14001dea0]
lea rcx, [rbp + 0xec]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400099d3
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], rbx
mov word [rbp - 0x78], bx
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0xec]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0xec]
lea rcx, [rbp - 0x78]
call fcn.140006920
nop
lea r8, [0x14001de88]
mov rdx, rsi
lea rcx, [rbp + 0x98]
call fcn.14000b1e0
nop
lea r8, [rbp - 0x78]
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14000b2c0
mov rdi, rax
lea rax, [rbp - 0x78]
cmp rax, rdi
je 0x140009814
cmp qword [rbp - 0x60], 8
jb 0x1400097c3
mov rcx, qword [rbp - 0x78]
call fcn.14000b8a0
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], rbx
mov word [rbp - 0x78], bx
cmp qword [rdi + 0x18], 8
jae 0x1400097f2
mov r8, qword [rdi + 0x10]
inc r8
add r8, r8
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.14000b8f0
jmp 0x1400097fc
mov rax, qword [rdi]
mov qword [rbp - 0x78], rax
mov qword [rdi], rbx
mov rax, qword [rdi + 0x10]
mov qword [rbp - 0x68], rax
mov rax, qword [rdi + 0x18]
mov qword [rbp - 0x60], rax
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbx
cmp qword [rbp], 8
jb 0x140009824
mov rcx, qword [rbp - 0x18]
call fcn.14000b8a0
mov qword [rbp], 7
mov qword [rbp - 8], rbx
mov word [rbp - 0x18], bx
cmp qword [rbp + 0xb0], 8
jb 0x14000984a
mov rcx, qword [rbp + 0x98]
call fcn.14000b8a0
mov qword [rbp + 0x38], select
mov qword [rbp + 0x30], rbx
mov byte [rbp + 0x20], 0
mov qword [rbp + 0x60], select
mov qword [rbp + 0x58], rbx
mov byte [rbp + 0x48], 0
mov qword [rbp + 0x88], socket
mov qword [rbp + 0x80], rbx
mov byte [rbp + 0x70], 0
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rcx, qword [rbp - 0x78]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rcx, rdi
test eax, eax
jne 0x1400098e3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x1400099c3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], rdx
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov edx, dword [rsp + 0x40]
mov dword [rsp + 0x50], edx
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x54], eax
mov rcx, qword [rsp + 0x50]
add rcx, r14
mov rax, r13
imul rcx
lea r8, [rcx + rdx]
sar r8, 0x17
mov rax, r8
shr rax, 0x3f
add r8, rax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x5c], eax
mov rcx, qword [rsp + 0x58]
add rcx, r14
mov rax, r13
imul rcx
lea rdi, [rcx + rdx]
sar rdi, 0x17
mov rax, rdi
shr rax, 0x3f
add rdi, rax
sub edi, r8d
mov eax, 0xc22e4507
imul edi
add edx, edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 7
jle 0x1400099c3
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rcx, qword [rbp - 0x78]
call fcn.140009460
nop
cmp qword [rbp - 0x60], 8
jb 0x1400099d3
mov rcx, qword [rbp - 0x78]
call fcn.14000b8a0
lea rdx, [rbp + 0xc0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140009710
cmp qword [rbp - 0x38], 8
jb 0x1400099fb
mov rcx, qword [rbp - 0x50]
call fcn.14000b8a0
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], rbx
mov word [rbp - 0x50], bx
cmp qword [rsi + 0x18], 8
jb 0x140009a1a
mov rcx, qword [rsi]
call fcn.14000b8a0
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
mov word [rsi], bx
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.14000b8c0
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret