Function at 0x140001290
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rbp + 0x210], rax
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], 6
mov qword [rsp + 0x70], 0xf
mov eax, dword [str.._asi_]
mov dword [rsp + 0x58], eax
movzx eax, word [0x140005548]
mov word [rsp + 0x5c], ax
mov byte [rsp + 0x5e], r12b
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], r12b
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp - 0x40]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp - 0x40]
call fcn.140002610
nop
cmp qword [rbp + 0x50], r12
je 0x140001811
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x40]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x40]
call fcn.140003020
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x1400017c2
lea rcx, [rbp - 0x30]
call fcn.140002a40
test rax, rax
jne 0x1400013a7
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x40]
add rcx, rax
xor r8d, r8d
lea edx, [r12 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rsi, qword [rsp + 0x68]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 5
jb 0x140001911
lea r15, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae r15, qword [rsp + 0x58]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea r14, [rsi + 5]
mov ebx, 0xf
lea rdi, [rsp + 0x30]
movabs rax, 0x8000000000000000
lea edx, [rbx + 7]
cmp r14, rbx
jbe 0x140001474
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000143a
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.140003430
test rax, rax
je 0x1400014fa
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000146f
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000145d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000190b
jmp 0x14000141b
test rcx, rcx
je 0x14000146c
call fcn.140003430
mov rdi, rax
jmp 0x14000146f
mov rdi, r12
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [str..asi]
mov dword [rdi + rsi], eax
movzx eax, byte [0x140005594]
mov byte [rdi + rsi + 4], al
mov byte [rdi + r14], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rcx, qword [rsp + 0x30]
lea rdx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r13, rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140001506
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001501
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001501
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003474
movdqa xmm0, xmmword [0x1400056a0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
cmp r13, 0xffffffffffffffff
je 0x14000177c
mov r15, qword [rsp + 0x68]
lea rax, [rbp + 0xfc]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001536
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, rbx
jb 0x140001905
lea r12, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae r12, qword [rsp + 0x58]
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xor eax, eax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
lea r14, [r15 + rbx]
mov edi, 0xf
lea rsi, [rbp - 0x68]
cmp r14, rdi
jbe 0x140001602
mov rdi, r14
or rdi, 0xf
cmp rdi, rcx
jbe 0x1400015ab
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400015d2
cmp rdi, 0x16
mov ecx, 0x16
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1400015f1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001917
mov rcx, rax
call fcn.140003430
test rax, rax
je 0x140001775
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400015fe
test rcx, rcx
je 0x1400015fb
call fcn.140003430
mov rsi, rax
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], rdi
mov r8, r15
mov rdx, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsi + r15]
mov r8, rbx
lea rdx, [rbp + 0xfc]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r14], 0
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x1400016b4
lea rdx, str.ASI
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002b00
mov rcx, rax
lea rdx, [rbp + 0xfc]
call fcn.140002b00
mov rcx, rax
lea rdx, str._Loaded_to
call fcn.140002b00
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
mov rcx, rax
call fcn.1400031c0
lea rdx, [0x140002cd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140001712
lea rdx, str.Error_load
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002b00
mov rcx, rax
lea rdx, [rbp + 0xfc]
call fcn.140002b00
mov rcx, rax
lea rdx, str._to
call fcn.140002b00
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
mov rcx, rax
call fcn.1400031c0
lea rdx, [0x140002cd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140001749
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001744
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001775
call fcn.140003474
lea rdx, [rbp + 0xd0]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140001523
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
xor r12d, r12d
mov ebx, r12d
jmp 0x140001839
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, str.Cant_find_.asi_in_folder
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002b00
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x68]
mov rcx, rax
call fcn.1400031c0
lea rdx, [0x140002cd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ebx, r12d
jmp 0x140001839
lea rdx, str.Cant_read_process.txt.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002b00
lea rdx, [0x140002cd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp - 0x30]
call fcn.140002a40
test rax, rax
jne 0x140001834
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x40]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
jmp 0x140001834
lea rdx, str.Cant_open_process.txt.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002b00
lea rdx, [0x140002cd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ebx, 1
lea rcx, [rbp - 0x40]
call fcn.140001920
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x140001882
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000187d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000187d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003474
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400018d3
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400018ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003474
mov eax, ebx
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140003410
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
int3
call fcn.1400011b0
int3
call fcn.140001110
int3