Function at 0x140012e40
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8e0]
sub rsp, 0x9e0
mov rax, qword [0x14009c020]
xor rax, rsp
mov qword [rbp + 0x8d0], rax
movzx edi, r9b
mov r13d, r8d
mov r14, rdx
mov r15, rcx
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp + 0x680]
call fcn.14004b2f0
nop
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], rax
lea rax, [0x14009cc90]
mov qword [rsp + 0x78], rax
mov word [rbp - 0x68], 0
mov dword [rbp - 0x60], 0xabcd
mov dword [rbp - 0x54], 0xabcd
lea rax, [rsp + 0x78]
mov qword [rbp - 0x5c], rax
mov dword [rbp + 0x1ba], 0xabcd
lea rax, [rbp - 0x50]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x78], 0x104
mov qword [rbp - 0x70], 0x104
xor esi, esi
mov qword [rbp - 0x80], rsi
mov word [rbp - 0x50], si
lea rax, [rbp - 0x50]
mov qword [rsp + 0x68], rax
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140007410
nop
mov r12d, esi
lea rcx, [rsp + 0x60]
call fcn.140006480
mov rbx, r14
test r14, r14
je 0x140012fa3
cmp word [r14], si
je 0x140012fa3
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140012f81
mov rdx, qword [rcx - 0xc]
test rdx, rdx
je 0x140012f81
mov r8, qword [rdx + 8]
test r8, r8
je 0x140012f81
movsxd rax, r8d
dec rax
cmp rax, qword [rdx + 0x10]
ja 0x140013520
cmp word [rcx + rax*2], 0x5c
je 0x140012f81
movsxd rax, r8d
dec rax
cmp rax, qword [rdx + 0x10]
ja 0x140013520
cmp word [rcx + rax*2], 0x2f
je 0x140012f81
lea edx, [rsi + 0x5c]
lea rcx, [rsp + 0x60]
call fcn.140006fb0
movzx eax, word [rbx]
cmp ax, 0x5c
je 0x140012f90
cmp ax, 0x2f
jne 0x140012f96
add rbx, 2
jmp 0x140012f81
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140007130
lea rbx, str..bde
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140013003
mov r8, qword [rcx - 0xc]
test r8, r8
je 0x140013003
mov r9, qword [r8 + 8]
test r9, r9
je 0x140013003
movsxd rax, r9d
dec rax
cmp rax, qword [r8 + 0x10]
ja 0x140013520
cmp word [rcx + rax*2], 0x5c
je 0x140013003
movsxd rax, r9d
dec rax
cmp rax, qword [r8 + 0x10]
ja 0x140013520
cmp word [rcx + rax*2], 0x2f
je 0x140013003
mov edx, 0x5c
lea rcx, [rsp + 0x60]
call fcn.140006fb0
movzx eax, word [rbx]
cmp ax, 0x5c
je 0x140013012
cmp ax, 0x2f
jne 0x140013018
add rbx, 2
jmp 0x140013003
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140007130
lea rcx, [0x14008d480]
mov rax, qword [rsp + 0x60]
test rax, rax
cmovne rcx, rax
lea rdx, [rbp + 0x680]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x140013064
lea edx, [rcx + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140007630
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov rax, rsi
mov rcx, qword [rsp + 0x60]
cmp word [rcx], si
je 0x140013080
inc rax
cmp word [rcx + rax*2], si
jne 0x140013077
test rcx, rcx
je 0x140013094
mov rdx, qword [rcx - 0xc]
test rdx, rdx
je 0x140013094
mov r8, qword [rdx + 0x10]
jmp 0x140013097
mov r8, rsi
cmp rax, r8
ja 0x140013520
test rcx, rcx
je 0x1400130ab
mov rdx, qword [rcx - 0xc]
jmp 0x1400130ae
mov rdx, rsi
mov qword [rdx + 8], rax
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400130f1
mov rax, qword [rcx - 0xc]
test rax, rax
je 0x1400130f1
cmp dword [rcx - 0x10], 0xabcd
jne 0x140013520
cmp dword [rcx - 4], 0xabcd
jne 0x140013520
mov rax, qword [rax + 0x10]
cmp dword [rcx + rax*2 + 2], 0xabcd
jne 0x140013520
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov ecx, 0x280
call fcn.140048438
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x38], rax
cmp rbx, 0xffffffffffffffff
je 0x14001331b
nop dword [rax]
nop dword [rax + rax]
test byte [rbp + 0x680], 0x10
jne 0x1400132f5
mov byte [rsp + 0x30], 0
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x6ac]
mov rdx, r14
mov rcx, r15
call fcn.14000ef70
test al, al
jne 0x1400132f5
test dil, dil
je 0x140013170
cmp byte [rsp + 0x30], al
je 0x1400132f5
lea rax, [rbp + 0x1e0]
mov qword [rbp + 0x1d0], rax
lea rax, [0x14009cc90]
mov qword [rbp + 0x1d8], rax
mov word [rbp + 0x1f8], 0
mov dword [rbp + 0x200], 0xabcd
mov dword [rbp + 0x20c], 0xabcd
lea rax, [rbp + 0x1d8]
mov qword [rbp + 0x204], rax
mov dword [rbp + 0x41a], 0xabcd
lea rax, [rbp + 0x210]
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x1e8], 0x104
mov qword [rbp + 0x1f0], 0x104
mov qword [rbp + 0x1e0], rsi
mov word [rbp + 0x210], si
lea rax, [rbp + 0x210]
mov qword [rbp + 0x1c8], rax
mov r8, 0xffffffffffffffff
lea rdx, [rbp + 0x6ac]
lea rcx, [rbp + 0x1c0]
call fcn.140007510
test al, al
je 0x14001350c
mov rcx, qword [rbp + 0x1c0]
test rcx, rcx
je 0x140013264
mov rax, qword [rcx - 0xc]
test rax, rax
je 0x140013264
cmp dword [rcx - 0x10], 0xabcd
jne 0x14001350c
cmp dword [rcx - 4], 0xabcd
jne 0x14001350c
mov rax, qword [rax + 0x10]
cmp dword [rcx + rax*2 + 2], 0xabcd
jne 0x14001350c
test rcx, rcx
je 0x1400132b1
call fcn.140056b9c
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x1400132b1
mov rax, qword [rdx - 0xc]
test rax, rax
je 0x1400132b8
cmp dword [rdx - 0x10], 0xabcd
jne 0x140013516
cmp dword [rdx - 4], 0xabcd
jne 0x140013516
mov rax, qword [rax + 0x10]
cmp dword [rdx + rax*2 + 2], 0xabcd
jne 0x140013516
jmp 0x1400132b8
lea rdx, [0x14008d480]
lea rcx, [rbp + 0x420]
call fcn.140006700
nop
lea r8, [rbp + 0x420]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.140015bf0
nop
lea rcx, [rbp + 0x420]
call fcn.140006d00
nop
lea rcx, [rbp + 0x1c0]
call fcn.140006d00
lea rdx, [rbp + 0x680]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140013130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400134ca
nop word [rax + rax]
mov rax, qword [rbx + 0x20]
lea rdi, [0x14008d480]
mov r8, rdi
test rax, rax
cmovne r8, rax
mov rdx, rdi
mov rax, qword [rsp + 0x60]
test rax, rax
cmovne rdx, rax
lea rcx, [rbp + 0x420]
call fcn.140006590
nop
mov rcx, qword [rax]
mov rdx, rdi
test rcx, rcx
cmovne rdx, rcx
lea rcx, str.run_script__s
call fcn.14000b8f0
nop
lea rcx, [rbp + 0x420]
call fcn.140006d00
mov rax, qword [rbx + 0x20]
mov r8, rdi
test rax, rax
cmovne r8, rax
mov rdx, rdi
mov rax, qword [rsp + 0x60]
test rax, rax
cmovne rdx, rax
lea rcx, [rbp + 0x420]
call fcn.140006590
nop
mov rcx, qword [rax]
mov rdx, rdi
test rcx, rcx
cmovne rdx, rcx
mov r8d, r13d
call fcn.14000f8e0
mov esi, eax
lea rcx, [rbp + 0x420]
call fcn.140006d00
mov rax, qword [rbx + 0x20]
mov r8, rdi
test rax, rax
cmovne r8, rax
mov rdx, rdi
mov rax, qword [rsp + 0x60]
test rax, rax
cmovne rdx, rax
lea rcx, [rbp + 0x420]
call fcn.140006590
nop
mov rcx, qword [rax]
mov rdx, rdi
test rcx, rcx
cmovne rdx, rcx
mov r8d, esi
lea rcx, str.run_script__s____0x_x
call fcn.14000b8f0
nop
lea rcx, [rbp + 0x420]
call fcn.140006d00
xor edi, edi
test esi, esi
sete dil
add r12d, edi
mov rax, qword [rbx + 0x20]
lea r8, [0x14008d480]
test rax, rax
cmovne r8, rax
mov byte [rsp + 0x20], 0
mov r9d, esi
mov rdx, r14
mov rcx, r15
call fcn.14000f210
inc dword [r15 + 0x4bc]
add dword [r15 + 0x4c0], edi
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140013498
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140013493
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x140013493
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140013480
mov rbx, rax
jmp 0x1400134bf
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x1400134bf
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x1400134b0
cmp rbx, qword [rsp + 0x38]
jne 0x140013330
lea rcx, [rsp + 0x38]
call fcn.140014c00
nop
lea rcx, [rsp + 0x60]
call fcn.140006d00
mov eax, r12d
mov rcx, qword [rbp + 0x8d0]
xor rcx, rsp
call fcn.140048410
mov rbx, qword [rsp + 0xa38]
add rsp, 0x9e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
int3