Function at 0x140005440
Capabilities:
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x42d8
call fcn.140091330
sub rsp, rax
mov esi, r9d
mov r13, r8
mov r12, rdx
mov r15, rcx
mov rcx, r8
call fcn.140096a30
mov rbp, rax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x24], esi
mov eax, esi
imul rbx, rax, 0x838
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rsi, [0x1400c67c0]
nop word cs:[rax + rax]
mov ecx, dword [rsi + r14*4 + 0x10]
cmp ecx, eax
je 0x1400054e7
mov ecx, dword [rsi + r14*4 + 0x14]
cmp ecx, eax
je 0x1400054d8
mov ecx, dword [rsi + r14*4 + 0x18]
cmp ecx, eax
je 0x1400054dd
mov ecx, dword [rsi + r14*4 + 0x1c]
cmp ecx, eax
je 0x1400054e3
add r14, 4
cmp r14, 0x80
jne 0x1400054a0
mov eax, 0xffffffff
jmp 0x1400054ea
inc r14
jmp 0x1400054e7
add r14, 2
jmp 0x1400054e7
add r14, 3
mov eax, r14d
shl rax, 4
mov rcx, qword [rax + rsi + 0x218]
mov rdx, qword [rax + rsi + 0x210]
add rdx, rcx
add rbx, rcx
mov qword [rax + rsi + 0x218], rbx
mov qword [r15], rdx
mov qword [r15 + 8], 0x838
lea rdx, str._s._s
lea rcx, [rsp + 0x70]
mov r8, r12
mov r9, r13
call fcn.1400028f0
mov rax, qword [rsp + 0x78]
lea rbx, [rax*4 + 2]
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop word cs:[rax + rax]
mov ecx, dword [rsi + r14*4 + 0x10]
cmp ecx, eax
je 0x140005597
mov ecx, dword [rsi + r14*4 + 0x14]
cmp ecx, eax
je 0x140005588
mov ecx, dword [rsi + r14*4 + 0x18]
cmp ecx, eax
je 0x14000558d
mov ecx, dword [rsi + r14*4 + 0x1c]
cmp ecx, eax
je 0x140005593
add r14, 4
cmp r14, 0x80
jne 0x140005550
mov eax, 0xffffffff
jmp 0x14000559a
inc r14
jmp 0x140005597
add r14, 2
jmp 0x140005597
add r14, 3
mov eax, r14d
shl rax, 4
mov rcx, qword [rax + rsi + 0x218]
mov r8, qword [rax + rsi + 0x210]
add r8, rcx
add rbx, rcx
mov qword [rax + rsi + 0x218], rbx
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x70]
call fcn.1400030a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
mov word [rcx + rax], 0
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x140005628
mov r12, rax
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x28], r15
mov esi, dword [r15 + 0xc]
mov r15d, dword [rsp + 0x24]
cmp esi, r15d
jne 0x14000563f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r15, qword [rsp + 0x28]
mov rax, r15
add rsp, 0x42d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rbx, rbp
lea r14, [rsp + 0xac]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
movsxd rax, dword [rax + 8]
mov qword [rsp + 0x38], rax
not rbx
lea r13, [rsp + 0x80]
mov rdi, qword [sym.imp.KERNEL32.dll_FindNextFileW]
lea rbp, [rsp + 0x2d0]
mov qword [rsp + 0x48], rbx
nop
cmp word [rsp + 0xac], 0
je 0x140005790
mov ecx, 1
xor eax, eax
nop word cs:[rax + rax]
mov edx, ecx
inc ecx
add eax, 0xfffffffe
cmp word [rsp + rdx*2 + 0xac], 0
jne 0x1400056a0
test eax, eax
je 0x140005790
neg eax
add rax, r14
mov rcx, r14
xor r15d, r15d
jmp 0x1400056ee
mov byte [rsp + rdx + 0x2d0], r8b
mov r15d, 1
add r15, rdx
add rcx, 2
cmp rcx, rax
jae 0x1400057a0
mov rdx, r15
movzx r8d, word [rcx]
cmp r8w, 0x7f
jbe 0x1400056d0
movzx r9d, r8w
cmp r9d, 0x7ff
ja 0x140005740
mov r9d, r8d
shr r9d, 6
or r9b, 0xc0
mov byte [rsp + rdx + 0x2d0], r9b
and r8b, 0x3f
or r8b, 0x80
mov byte [rsp + rdx + 0x2d1], r8b
mov r15d, 2
jmp 0x1400056de
mov r10d, r9d
shr r10d, 0xc
or r10b, 0xe0
mov byte [rsp + rdx + 0x2d0], r10b
shr r9d, 6
and r9b, 0x3f
or r9b, 0x80
mov byte [rsp + rdx + 0x2d1], r9b
and r8b, 0x3f
or r8b, 0x40
mov byte [rsp + rdx + 0x2d2], r8b
mov r15d, 3
jmp 0x1400056de
mov byte [rsp + 0x2d0], 0
jmp 0x140005805
lea rax, [rsp + r15]
add rax, 0x2d0
mov byte [rsp + r15 + 0x2d0], 0
xor ecx, ecx
nop word cs:[rax + rax]
lea rdx, [rax + rcx]
dec rdx
cmp rdx, rbp
jb 0x140005800
dec rcx
cmp byte [rdx], 0x2e
jne 0x1400057c0
cmp rcx, 0xffffffffffffffff
je 0x140005800
cmp rbx, rcx
jne 0x140005800
add rcx, rax
inc rcx
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
call fcn.140092690
test eax, eax
je 0x140005823
nop dword [rax + rax]
mov r15d, dword [rsp + 0x24]
mov rcx, r12
mov rdx, r13
call rdi
test eax, eax
je 0x140005612
cmp esi, r15d
jne 0x140005680
jmp 0x140005612
movsxd rsi, esi
mov r14, rsi
imul r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
lea rax, [r14 + r13]
mov qword [rsp + 0x30], rax
inc esi
mov rax, qword [rsp + 0x28]
mov dword [rax + 0xc], esi
lea rbx, [r14 + r13]
add rbx, 0x38
mov rcx, rbx
mov rdx, rbp
mov r8, r15
call fcn.140091e40
mov qword [r13 + r14], rbx
mov qword [r13 + r14 + 8], r15
mov rax, qword [rsp + 0x84]
mov qword [r13 + r14 + 0x28], rax
mov rax, qword [rsp + 0x94]
mov qword [r13 + r14 + 0x30], rax
mov eax, dword [rsp + 0x9c]
mov ecx, dword [rsp + 0xa0]
shl rax, 0x20
or rcx, rax
mov qword [r13 + r14 + 0x20], rcx
mov byte [r13 + r14 + 0x10], 0
mov eax, dword [rsp + 0x80]
and eax, 0x10
cmp eax, 1
mov al, 2
sbb al, 0
mov byte [r13 + r14 + 0x10], al
mov ecx, dword [rsp + 0x80]
test cl, 2
jne 0x1400058ca
mov rdx, qword [rsp + 0x30]
jmp 0x1400058db
or al, 4
mov rdx, qword [rsp + 0x30]
mov byte [rdx + 0x10], al
mov ecx, dword [rsp + 0x80]
test cl, 1
mov rbx, qword [rsp + 0x48]
lea r14, [rsp + 0xac]
lea r13, [rsp + 0x80]
mov r15d, dword [rsp + 0x24]
je 0x140005906
or al, 8
mov byte [rdx + 0x10], al
mov ecx, dword [rsp + 0x80]
test cl, 4
je 0x140005805
or al, 0x10
mov byte [rdx + 0x10], al
jmp 0x140005805