Function at 0x1400014ac
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x78], r8
mov r8, rcx
mov qword [rsp + 0x70], rcx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
xor r9d, r9d
mov r12d, r9d
mov qword [rsp + 0x50], r9
lea rax, str._sharedMicrosoft.WindowsDesktop.App
lea rcx, str._sharedMicrosoft.NETCore.App
cmp byte [rbp + 0x250], r9b
cmovne rcx, rax
add rdx, rdx
sub rdx, rcx
add rdx, r8
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140001521
lea rdx, [rbp - 0x80]
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
or r14, 0xffffffffffffffff
cmp rax, r14
je 0x14000181a
lea edi, [r14 + 9]
lea esi, [rdi - 7]
mov rbx, qword [rsp + 0x48]
xor r13d, r13d
lea rax, [rbp - 0x54]
mov qword [rsp + 0x30], rax
movzx eax, word [rbp - 0x54]
sub ax, 0x31
cmp ax, di
ja 0x1400016b0
mov eax, dword [rbp - 0x80]
test al, 0x10
je 0x1400016b0
mov r8d, 0xa
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x54]
call fcn.14000a9d8
cmp eax, edi
jne 0x1400016b0
mov rcx, qword [rsp + 0x30]
movzx eax, word [rcx]
add rcx, 2
mov qword [rsp + 0x30], rcx
cmp ax, 0x2e
jne 0x1400016b0
cmp word [rcx], 0x30
jb 0x1400016b0
cmp word [rcx], 0x39
ja 0x1400016b0
mov r8d, 0xa
lea rdx, [rsp + 0x30]
call fcn.14000a9d8
mov edi, eax
test eax, eax
js 0x1400016ab
mov r9, qword [rsp + 0x30]
movzx ecx, word [r9]
add r9, 2
mov qword [rsp + 0x30], r9
cmp cx, 0x2e
jne 0x1400016ab
cmp word [r9], 0x30
jb 0x1400016ab
cmp word [r9], 0x39
ja 0x1400016ab
mov r8d, 0xa
lea rdx, [rsp + 0x30]
mov rcx, r9
call fcn.14000a9d8
test eax, eax
js 0x1400016ab
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x5c], eax
mov rcx, qword [rsp + 0x30]
cmp word [rcx], 0x2d
jne 0x140001659
cmp word [rcx + 2], 0x70
jne 0x140001659
mov byte [rsp + 0x60], sil
test edi, edi
jne 0x14000165e
test eax, eax
je 0x1400016ab
jmp 0x14000165e
mov byte [rsp + 0x60], r13b
lea rcx, [rbp - 0x54]
call fcn.14000acd8
mov qword [rsp + 0x68], rax
cmp rbx, r12
je 0x14000168f
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rbx], xmm0
movsd xmm1, qword [rsp + 0x68]
movsd qword [rbx + 0x10], xmm1
add rbx, 0x18
mov qword [rsp + 0x48], rbx
jmp 0x1400016ab
lea r8, [rsp + 0x58]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400034b8
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov edi, 8
lea rdx, [rbp - 0x80]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000155d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdi, qword [rsp + 0x40]
sub rbx, rdi
movabs rax, 0x2aaaaaaaaaaaaaab
imul rbx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
xor r11d, r11d
test edx, edx
mov r13b, byte [rbp + 0x250]
je 0x14000181d
mov r10d, r14d
mov r8d, r14d
mov ebx, r14d
movsxd r15, edx
jle 0x14000177d
mov r9d, r11d
mov rcx, rdi
mov r12, qword [rsp + 0x38]
mov eax, dword [rcx]
test r13b, r13b
je 0x140001729
cmp eax, dword [r12]
je 0x14000173e
cmp eax, r8d
cmovb r8d, eax
add r9, rsi
add rcx, 0x18
cmp r9, r15
jl 0x14000171c
jmp 0x140001741
mov r8d, eax
mov eax, r11d
mov r9, rdi
cmp dword [r9], r8d
jne 0x140001765
mov ecx, dword [r9 + 4]
test r13b, r13b
je 0x14000175c
cmp ecx, dword [r12 + 4]
je 0x140001775
cmp ecx, ebx
jle 0x140001765
mov ebx, ecx
mov r10d, eax
add eax, esi
add r11, rsi
add r9, 0x18
cmp r11, r15
jl 0x140001747
jmp 0x14000177a
mov ebx, ecx
mov r10d, eax
xor r11d, r11d
movsxd rax, r10d
lea rcx, [rax + rax*2]
cmp byte [rdi + rcx*8 + 8], r11b
je 0x1400017bc
mov ecx, r11d
test edx, edx
jle 0x1400017bc
mov rdx, r11
lea rax, [rdi + 8]
cmp dword [rax - 8], r8d
jne 0x1400017a9
cmp dword [rax - 4], ebx
jne 0x1400017a9
cmp byte [rax], r11b
je 0x1400017b9
add ecx, esi
add rdx, rsi
add rax, 0x18
cmp rdx, r15
jl 0x140001799
jmp 0x1400017bc
mov r10d, ecx
movsxd rax, r10d
lea rbx, [rax + rax*2]
mov rdx, qword [rsp + 0x70]
inc r14
cmp word [rdx + r14*2], r11w
jne 0x1400017c8
sub r14, rsi
mov r9, qword [rdi + rbx*8 + 0x10]
mov r8, r14
mov rcx, qword [rsp + 0x78]
call fcn.14000116c
movups xmm0, xmmword [rdi + rbx*8]
mov rax, qword [rsp + 0x38]
movups xmmword [rax], xmm0
movsd xmm1, qword [rdi + rbx*8 + 0x10]
movsd qword [rax + 0x10], xmm1
test r15, r15
jle 0x140001820
lea rbx, [rdi + 0x10]
mov rcx, qword [rbx]
call fcn.14000ad94
lea rbx, [rbx + 0x18]
sub r15, rsi
jne 0x140001807
jmp 0x140001820
xor r11d, r11d
mov sil, r11b
lea rcx, [rsp + 0x40]
call fcn.140002c60
mov al, sil
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1400037f0
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret