Function at 0x14005b900
Capabilities:
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x5d8
movdqa xmmword [rsp + 0x5c0], xmm8
movdqa xmmword [rsp + 0x5b0], xmm7
movdqa xmmword [rsp + 0x5a0], xmm6
mov ebp, r9d
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140180518]
xor rax, rsp
mov qword [rsp + 0x598], rax
lea rdi, [rsp + 0x498]
mov qword [rsp + 0x480], rdi
mov qword [rsp + 0x488], 0
mov qword [rsp + 0x490], 0x80
mov word [rsp + 0x250], 0x105
mov rax, qword [r8]
mov qword [rsp + 0x230], rax
mov rax, qword [r8 + 8]
mov qword [rsp + 0x238], rax
lea rdx, [rsp + 0x230]
lea r8, [rsp + 0x480]
mov r9d, 0x104
call fcn.14005a040
cmp dword [rsi], 0
je 0x14005ba09
mov rcx, qword [rsp + 0x480]
cmp rcx, rdi
je 0x14005b9c9
call qword [0x14017cb20]
mov rcx, qword [rsp + 0x598]
xor rcx, rsp
call fcn.1401213e0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x5a0]
movaps xmm7, xmmword [rsp + 0x5b0]
movaps xmm8, xmmword [rsp + 0x5c0]
add rsp, 0x5d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x488]
test rax, rax
je 0x14005ba43
mov rcx, qword [rsp + 0x480]
movzx edx, word [rcx + rax*2 - 2]
add edx, 0xffffffd1
cmp edx, 0x2d
ja 0x14005bc53
movabs r8, 0x200000000801
bt r8, rdx
jae 0x14005bc53
lea r8, [rax + 1]
cmp r8, qword [rsp + 0x490]
ja 0x14005bc91
add rax, rax
add rax, qword [rsp + 0x480]
mov word [rax], 0x2a
mov r8, qword [rsp + 0x488]
lea rax, [r8 + 1]
mov qword [rsp + 0x488], rax
add r8, 2
cmp r8, qword [rsp + 0x490]
ja 0x14005bf50
mov rcx, qword [rsp + 0x480]
mov word [rcx + rax*2], 0
mov rcx, qword [rsp + 0x480]
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x230]
mov edx, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
cmp rax, 0xffffffffffffffff
je 0x14005bb6d
mov r15, rax
mov byte [rsp + 0x3f], bpl
mov rbp, rbx
lea r12, [rsp + 0x25c]
mov rcx, r12
call qword [0x14017cb78]
lea r13, [rsp + 0x230]
mov rdi, qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rbx, qword [0x14017cb78]
nop word cs:[rax + rax]
movzx ecx, word [rsp + 0x25c]
cmp rax, 1
jne 0x14005bb24
cmp cx, 0x2e
je 0x14005bb3b
cmp rax, 2
jne 0x14005bb82
cmp cx, 0x2e
jne 0x14005bb82
cmp word [rsp + 0x25e], 0x2e
jne 0x14005bb82
mov rcx, r15
mov rdx, r13
call rdi
test eax, eax
je 0x14005bb4e
mov rcx, r12
call rbx
jmp 0x14005bb10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
cmp eax, 0x12
jne 0x14005bc47
mov rdx, rbp
call fcn.14005bfe0
jmp 0x14005bf30
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edx, eax
call fcn.1400660f0
jmp 0x14005b9b6
lea r13, [rsp + 0x1b0]
mov qword [rsp + 0x198], r13
mov qword [rsp + 0x1a0], 0
mov qword [rsp + 0x1a8], 0x80
mov rcx, r12
call qword [0x14017cb78]
lea rcx, [rsp + 0x198]
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov edx, 0xfde9
mov r8, r12
mov r9, rax
call fcn.14005d320
cmp dword [rsi], 0
jne 0x14005bf1d
mov qword [rbp], r15
mov r12, qword [r14]
mov r15, qword [r14 + 8]
lea r14, [rsp + 0x118]
mov qword [rsp + 0x100], r14
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0x80
cmp r15, 0x81
jb 0x14005bcb4
lea rcx, [rsp + 0x100]
mov r9d, 1
mov rdx, r14
mov r8, r15
call fcn.14001dc70
mov rax, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x108]
jmp 0x14005bcbe
mov edx, eax
call fcn.1400660f0
jmp 0x14005bf30
lea r8, [rax + 1]
cmp r8, qword [rsp + 0x490]
ja 0x14005bf73
mov word [rcx + rax*2], 0x5c
mov r8, qword [rsp + 0x488]
lea rax, [r8 + 1]
mov qword [rsp + 0x488], rax
add r8, 2
cmp r8, qword [rsp + 0x490]
jbe 0x14005ba55
lea rcx, [rsp + 0x480]
mov r9d, 2
mov rdx, rdi
call fcn.14001dc70
mov rax, qword [rsp + 0x488]
jmp 0x14005ba55
xor ecx, ecx
mov rax, r14
test r15, r15
je 0x14005bcd4
add rcx, rax
mov rdx, r12
mov r8, r15
call fcn.140122c80
mov rcx, qword [rsp + 0x108]
add rcx, r15
mov qword [rsp + 0x108], rcx
mov word [rsp + 0xd8], 0x101
mov word [rsp + 0xb0], 0x101
mov word [rsp + 0x88], 0x101
mov word [rsp + 0x60], 0x105
movups xmm0, xmmword [rsp + 0x198]
movups xmmword [rsp + 0x40], xmm0
lea r15, [rsp + 0xb8]
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x100]
lea r8, [rsp + 0x40]
lea r9, [rsp + 0x68]
xor edx, edx
call fcn.1400556e0
pshufd xmm6, xmmword [rsp + 0x230], 0x50
mov word [rsp + 0xb0], 0x105
movups xmm0, xmmword [rsp + 0x100]
movups xmmword [rsp + 0x90], xmm0
movdqu xmm0, xmmword [rsp + 0x23c]
pshufd xmm7, xmm0, 0xb1
movq xmm8, qword [rsp + 0x24c]
lea rcx, [rsp + 0x90]
mov rdx, r15
call fcn.140020750
movzx eax, byte [rsp + 0x3f]
mov byte [rsp + 0xdc], al
movdqu xmmword [rsp + 0xe0], xmm7
pand xmm6, xmmword [0x140127100]
pxor xmm0, xmm0
pcmpeqd xmm0, xmm6
movdqa xmm1, xmm0
pandn xmm1, xmmword [0x140127110]
pand xmm0, xmmword [0x140127120]
por xmm0, xmm1
punpcklqdq xmm8, xmm0
movdqu xmmword [rsp + 0xf0], xmm8
movd dword [rsp + 0xd8], xmm0
lea r12, [rbp + 8]
cmp r12, r15
je 0x14005be68
mov rax, qword [rbp + 0x20]
cmp rax, 0x10
jb 0x14005be2d
mov rcx, qword [r12]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14005be28
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14005bfd4
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14012112c
movups xmm0, xmmword [rsp + 0xb8]
movups xmm1, xmmword [rsp + 0xc8]
movups xmmword [r12 + 0x10], xmm1
movups xmmword [r12], xmm0
mov rax, qword [r15 + 0x40]
mov qword [rbp + 0x48], rax
movdqu xmm0, xmmword [r15 + 0x20]
movdqu xmm1, xmmword [r15 + 0x30]
movdqu xmmword [rbp + 0x38], xmm1
movdqu xmmword [rbp + 0x28], xmm0
jmp 0x14005becd
mov rax, qword [rsp + 0xd0]
mov rcx, qword [r15 + 0x40]
mov qword [rbp + 0x48], rcx
movdqu xmm0, xmmword [r15 + 0x20]
movdqu xmm1, xmmword [r15 + 0x30]
movdqu xmmword [rbp + 0x38], xmm1
movdqu xmmword [rbp + 0x28], xmm0
cmp rax, 0x10
jb 0x14005becd
mov rcx, qword [rsp + 0xb8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14005bec8
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14005bfd4
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14012112c
mov dword [rsi], 0
mov eax, dword [0x1401bc758]
mov ecx, dword [0x1401bd448]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005bf9e
lea rax, section..data
mov qword [rsi + 8], rax
mov rcx, qword [rsp + 0x100]
cmp rcx, r14
je 0x14005bf16
call qword [0x14017cb20]
mov r15, 0xffffffffffffffff
mov rcx, qword [rsp + 0x198]
cmp rcx, r13
je 0x14005bf30
call qword [0x14017cb20]
lea rdi, [rsp + 0x498]
cmp r15, 0xffffffffffffffff
je 0x14005b9b6
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x14005b9b6
lea rcx, [rsp + 0x480]
mov r9d, 2
mov rdx, rdi
call fcn.14001dc70
mov rax, qword [rsp + 0x488]
jmp 0x14005ba8b
lea rcx, [rsp + 0x480]
mov r9d, 2
mov rdx, rdi
call fcn.14001dc70
mov rcx, qword [rsp + 0x480]
mov rax, qword [rsp + 0x488]
jmp 0x14005bc65
lea rcx, [0x1401bc758]
call fcn.140121230
cmp dword [0x1401bc758], 0xffffffff
jne 0x14005bef8
lea rcx, [fcn.1400055a0]
call fcn.140121400
lea rcx, [0x1401bc758]
call fcn.140121298
jmp 0x14005bef8
call qword [0x14017ca68]
int3