Function at 0x140026488
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x310
mov qword [r11 - 0x2a0], 0xfffffffffffffffe
mov rax, qword [0x14004a300]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov rbx, r9
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x70], rdx
mov r13, rcx
mov rdi, qword [rsp + 0x378]
mov qword [rsp + 0x58], rdi
mov rsi, qword [rsp + 0x380]
mov qword [rsp + 0x80], rsi
mov rax, qword [r11 + 0x28]
xor r14d, r14d
test eax, eax
jne 0x1400264fd
shr rax, 0x20
test eax, eax
mov r12b, r14b
je 0x140026500
mov r12b, 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x40], rax
or rdx, 0xffffffffffffffff
mov rcx, rdx
inc rcx
cmp word [rax + rcx*2], r14w
jne 0x140026512
lea r15, [0x14003f0d0]
cmp word [rax + rcx*2 - 2], 0x5c
je 0x14002654c
mov rax, rdx
inc rax
cmp word [r15 + rax*2], r14w
jne 0x14002652e
mov r8d, eax
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.14000a054
or rdx, 0xffffffffffffffff
test rbx, rbx
jne 0x140026556
mov eax, r14d
jmp 0x140026563
mov rax, rdx
inc rax
cmp word [rbx + rax*2], r14w
jne 0x140026559
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.14000a054
mov rbx, qword [rsp + 0x40]
cmp byte [0x14004b35e], r14b
je 0x140026590
mov rdx, rbx
lea rcx, str.saving_files_matching_filespec__s_n
call sub.msvcrt.dll_wprintf
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
mov qword [rsp + 0x88], rax
cmp rax, 0xffffffffffffffff
jne 0x1400265cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.FindFirstFile_failed_with_GetLastError_d_n
call sub.msvcrt.dll_wprintf
jmp 0x1400268da
xor eax, eax
cmp byte [0x14004b35e], al
je 0x1400265ec
mov r8, r13
lea rdx, [rsp + 0xdc]
lea rcx, str.saving_file__s_from_path__s_n
call sub.msvcrt.dll_wprintf
test byte [rsp + 0xb0], 0x10
jne 0x1400268a8
test rsi, rsi
je 0x14002662d
xor r9d, r9d
lea r8, [rsp + 0xdc]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.140020488
mov rdx, rax
mov rcx, rsi
call fcn.140022408
xor esi, esi
test al, al
jne 0x14002665e
test rdi, rdi
je 0x140026677
xor r9d, r9d
lea r8, [rsp + 0xdc]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.140020488
mov rdx, rax
mov rcx, rdi
call fcn.140022408
test al, al
je 0x140026677
lea rdx, [rsp + 0xdc]
lea rcx, str.excluding_file__s_n
call sub.msvcrt.dll_wprintf
jmp 0x1400268a8
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rsp + 0x48], rax
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x40], rax
or rbx, 0xffffffffffffffff
mov rcx, rbx
inc rcx
cmp word [rax + rcx*2], si
jne 0x1400266a8
cmp word [rax + rcx*2 - 2], 0x5c
je 0x1400266cc
mov r8d, 1
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.14000a054
lea rcx, [rsp + 0xdc]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], si
jne 0x1400266d7
mov r8d, eax
lea rdx, [rsp + 0xdc]
lea rcx, [rsp + 0x40]
call fcn.14000a054
mov rax, rbx
inc rax
cmp word [rdi + rax*2], si
jne 0x1400266f8
cmp word [rdi + rax*2 - 2], 0x5c
je 0x14002671c
mov r8d, 1
mov rdx, r15
lea rcx, [rsp + 0x48]
call fcn.14000a054
lea rcx, [rsp + 0xdc]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], si
jne 0x140026727
mov r8d, eax
lea rdx, [rsp + 0xdc]
lea rcx, [rsp + 0x48]
call fcn.14000a054
mov rbx, qword [rsp + 0x40]
test r12b, r12b
je 0x140026853
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
lea rax, [0x14003f0a8]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdi
mov rsi, rdi
cmp rdi, 0xffffffffffffffff
jne 0x1400267b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea rdx, str.CreateFile_failed_while_checking_file_time
call fcn.14001aa8c
or rsi, rdi
lea r9, [rsp + 0x78]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x1400267f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea rdx, str.CreateFile_failed_while_checking_file_time
call fcn.14001aa8c
lea rdx, [rsp + 0x370]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
nop
test eax, eax
jns 0x140026830
cmp rsi, 0xffffffffffffffff
je 0x140026817
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rsp + 0x68], 0xffffffffffffffff
lea rax, [0x14003efd0]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x48]
jmp 0x14002689d
cmp rsi, 0xffffffffffffffff
je 0x14002683f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rsp + 0x68], 0xffffffffffffffff
lea rax, [0x14003efd0]
mov qword [rsp + 0x60], rax
xor esi, esi
mov rdi, qword [rsp + 0x48]
cmp byte [0x14004b35e], sil
je 0x140026873
mov r8, rdi
mov rdx, rbx
lea rcx, str.copying_file__s_to__s_n
call sub.msvcrt.dll_wprintf
mov rdx, rdi
mov rcx, rbx
call fcn.140021b30
cmp byte [0x14004b35e], sil
je 0x14002689a
mov r8, rdi
mov rdx, rbx
lea rcx, str.copied_file__s_to__s_n
call sub.msvcrt.dll_wprintf
nop
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rdi, qword [rsp + 0x58]
lea rdx, [rsp + 0xb0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov rsi, qword [rsp + 0x80]
jne 0x1400265cb
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
jmp 0x1400268da
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.14002c700
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret