Function at 0x1400ee4b0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov r15, r8
mov r14, rdx
mov rsi, qword [r8]
mov rdi, qword [rsi + 8]
cmp byte [rdi + 0x19], 0
jne 0x1400ee531
nop dword [rax]
nop word [rax + rax]
mov r8, qword [rdi + 0x10]
mov rdx, r15
mov rcx, r15
call fcn.1400d1eb0
mov rbx, rdi
mov rdi, qword [rdi]
lea rcx, [rbx + 0x20]
call fcn.1400166f0
mov edx, 0x40
mov rcx, rbx
call fcn.1402ba9fc
cmp byte [rdi + 0x19], 0
je 0x1400ee500
mov qword [rsi + 8], rsi
mov qword [rsi], rsi
mov qword [rsi + 0x10], rsi
xor r12d, r12d
mov qword [r15 + 8], r12
mov rdx, r14
lea rcx, [rbp - 0x70]
call fcn.140031cb0
nop
lea edx, [r12 + 0x5c]
lea rcx, [rbp - 0x70]
call fcn.14009b070
lea edx, [r12 + 0x2a]
lea rcx, [rbp - 0x70]
call fcn.14009b070
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x50]
call fcn.1400c0c30
cmp qword [rax + 0x18], 7
jbe 0x1400ee584
mov rax, qword [rax]
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
lea rcx, [rsp + 0x50]
call fcn.1400166f0
cmp rsi, 0xffffffffffffffff
je 0x1400ee77c
lea r14, [0x14043271c]
movabs r13, 0x3ffffffffffffff
nop dword [rax]
mov ebx, dword [rbp - 0x50]
mov edi, ebx
and edi, 0x10
and ebx, 0x400
lea rdx, [rbp - 0x24]
lea rcx, [rsp + 0x70]
call fcn.140031ed0
nop
lea r8, [rsp + 0x70]
mov r9, qword [rsp + 0x70]
mov r10, qword [rbp - 0x78]
cmp r10, 7
cmova r8, r9
mov r11, qword [rbp - 0x80]
cmp r11, 1
jne 0x1400ee629
mov rdx, r11
lea rax, [0x14041b57c]
mov rcx, rax
sub r8, rax
nop dword [rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x1400ee629
add rcx, 2
sub rdx, 1
jne 0x1400ee610
lea eax, [rdx + 1]
jmp 0x1400ee661
lea r8, [rsp + 0x70]
cmp r10, 7
cmova r8, r9
cmp r11, 2
jne 0x1400ee65e
mov rdx, r11
mov rcx, r14
sub r8, r14
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x1400ee65e
add rcx, 2
sub rdx, 1
jne 0x1400ee645
lea eax, [rdx + 1]
jmp 0x1400ee661
mov eax, r12d
test edi, edi
je 0x1400ee754
test ebx, ebx
jne 0x1400ee754
test eax, eax
jne 0x1400ee754
mov rdi, qword [r15]
mov r9, qword [rdi + 8]
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x28], r12d
mov rbx, rdi
cmp byte [r9 + 0x19], al
jne 0x1400ee6d7
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x20], r9
lea rcx, [r9 + 0x20]
lea rdx, [rsp + 0x70]
call fcn.1400b0fb0
test al, al
jns 0x1400ee6c2
mov dword [rsp + 0x28], r12d
mov r9, qword [r9 + 0x10]
jmp 0x1400ee6d0
mov dword [rsp + 0x28], 1
mov rbx, r9
mov r9, qword [r9]
cmp byte [r9 + 0x19], 0
je 0x1400ee6a0
cmp byte [rbx + 0x19], 0
jne 0x1400ee6ef
lea rdx, [rbx + 0x20]
lea rcx, [rsp + 0x70]
call fcn.1400b0fb0
test al, al
jns 0x1400ee754
cmp qword [r15 + 8], r13
je 0x1400ee7ba
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r12
mov ecx, 0x40
call fcn.1402baa0c
mov rbx, rax
mov qword [rsp + 0x48], rax
lea rcx, [rax + 0x20]
lea rdx, [rsp + 0x70]
call fcn.140031cb0
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov word [rbx + 0x18], 0
mov qword [rsp + 0x48], r12
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.140022b50
nop
lea rcx, [rsp + 0x70]
call fcn.1400166f0
lea rdx, [rbp - 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400ee5c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp qword [r15 + 8], 0
setne bl
lea rcx, [rbp - 0x70]
call fcn.1400166f0
movzx eax, bl
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.1402ba9b0
mov rbx, qword [rsp + 0x350]
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14002bc20
nop
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rsp + 0xa0]
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140031cb0
nop
mov edx, 0x5c
lea rcx, [rsp + 0x20]
call fcn.14009b070
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x1400ee814
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14002be20
mov rax, qword [rdi]
lea r9, [rsp + 0x20]
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call qword [rax + 0xa8]
nop
lea rcx, [rsp + 0x20]
call fcn.1400166f0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402ba9b0
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret