Function at 0x14000c3a6
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x848
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x7b0], xmm6
mov qword [rbp + 0x7a8], 0xfffffffffffffffe
mov qword [rbp + 0x798], r9
mov byte [rbp + 0x7a7], r8b
mov qword [rbp + 0x778], rdx
mov rsi, rcx
mov rax, qword [rcx + 8]
cmp rax, qword [rcx]
jbe 0x14000c401
cmp byte [rax - 1], 0x2f
jne 0x14000c401
dec rax
mov qword [rsi + 8], rax
xorps xmm0, xmm0
movaps xmmword [rbp + 0x700], xmm0
and qword [rbp + 0x710], 0
mov eax, 0x10000
mov qword [rbp + 0x718], rax
mov qword [rbp + 0x720], rax
lea rcx, [rbp + 0x780]
movaps xmmword [rcx], xmm0
and qword [rcx + 0x10], 0
push 0x40
pop rdx
call fcn.14000c97c
movups xmm0, xmmword [rsi]
lea rdx, [rbp + 0x620]
movaps xmmword [rdx], xmm0
lea rcx, [rbp + 0x3d0]
lea r8, [rbp + 0x700]
call fcn.14000ffa4
lea rcx, [rbp + 0x780]
lea rdx, [rbp + 0x3d0]
call fcn.14000c9ae
lea rax, [rbp + 0x1d0]
and qword [rax - 0x18], 0
mov ecx, 0x200
mov qword [rax - 0x10], rcx
mov qword [rax - 8], rax
lea rax, [rbp - 0x48]
and qword [rax - 0x18], 0
mov qword [rax - 0x10], rcx
mov qword [rax - 8], rax
lea r15, [rbp + 0x3fc]
mov al, byte [rbp + 0x7a7]
xor al, 1
mov byte [rbp + 0x7a6], al
lea r14, [rbp + 0x3d0]
xorps xmm6, xmm6
mov rdi, qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rax, qword [rbp + 0x788]
cmp qword [rbp + 0x780], rax
je 0x14000c7e5
movups xmm0, xmmword [rax - 0x10]
add rax, 0xfffffffffffffff0
movaps xmmword [rbp + 0x650], xmm0
mov qword [rbp + 0x788], rax
movaps xmmword [rbp + 0x660], xmm0
lea rbx, [rbp + 0x630]
mov rcx, rbx
lea rdx, [rbp + 0x660]
call fcn.140010f8c
lea rsi, [rbp + 0x6c0]
mov rcx, rsi
mov rdx, rbx
lea r8, str..
call fcn.14000ca1f
cmp qword [rbp + 0x6d8], 8
jb 0x14000c531
mov rsi, qword [rbp + 0x6c0]
mov rcx, rsi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x14000c7c8
movzx ecx, word [rbp + 0x3fc]
movzx eax, word [rbp + 0x3fe]
cmp cx, 0x2e
jne 0x14000c567
test ax, ax
je 0x14000c7af
cmp cx, 0x2e
jne 0x14000c581
cmp ax, 0x2e
jne 0x14000c581
cmp word [rbp + 0x400], 0
je 0x14000c7af
mov rcx, r15
call fcn.1401997f8
lea rcx, [rbp + 0x6e0]
mov rdx, r15
mov r8, rax
lea r9, [rbp - 0x60]
call fcn.14001204b
movups xmm0, xmmword [rbp + 0x6e0]
movaps xmmword [rbp + 0x670], xmm0
mov rax, qword [rbp + 0x778]
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x680], xmm0
lea rcx, [rbp + 0x680]
lea rdx, [rbp + 0x670]
xor r8d, r8d
call fcn.140012a90
mov r12d, eax
or al, byte [rbp + 0x7a7]
cmp al, 1
jne 0x14000c7af
and qword [rbp + 0x1b8], 0
mov ebx, dword [rbp + 0x3d0]
movaps xmm0, xmmword [rbp + 0x650]
movaps xmmword [rbp + 0x690], xmm0
lea rcx, [rbp + 0x1b8]
lea rdx, [rbp + 0x690]
call fcn.140003486
lea rcx, [rbp + 0x1b8]
mov dl, 0x2f
call fcn.1400034d4
movups xmm0, xmmword [rbp + 0x6e0]
movaps xmmword [rbp + 0x6a0], xmm0
lea rcx, [rbp + 0x1b8]
lea rdx, [rbp + 0x6a0]
call fcn.140003486
mov eax, ebx
shr eax, 4
and eax, 1
mov rcx, qword [rbp + 0x1c8]
mov rdx, qword [rbp + 0x1b8]
add rdx, rcx
mov qword [rbp + 0x728], rcx
mov qword [rbp + 0x730], rdx
mov ecx, dword [rbp + 0x3ec]
mov edx, dword [rbp + 0x3f0]
shl rcx, 0x20
or rdx, rcx
mov qword [rbp + 0x738], rdx
lea rcx, [rbp + 0x750]
movups xmmword [rcx], xmm6
mov dword [rbp + 0x760], eax
test byte [rbp + 0x3d0], 2
je 0x14000c6a6
or eax, 4
mov dword [rbp + 0x760], eax
mov rax, qword [rbp + 0x3d4]
mov rcx, qword [rbp + 0x3e4]
mov qword [rbp + 0x740], rcx
mov qword [rbp + 0x748], rax
test r12b, r12b
je 0x14000c733
movups xmm0, xmmword [rbp + 0x728]
movaps xmmword [rbp + 0x6b0], xmm0
lea rcx, [rbp + 0x768]
lea rdx, [rbp + 0x6b0]
mov r8, qword [rbp + 0x840]
call fcn.14000ffa4
movups xmm0, xmmword [rbp + 0x768]
movups xmmword [rbp + 0x728], xmm0
test bl, 0x10
je 0x14000c720
lea rcx, [rbp + 0x1b8]
call fcn.140004562
mov rcx, rax
lea rdx, [rbp + 0x760]
xor r8d, r8d
call fcn.14000c170
mov rcx, qword [rbp + 0x838]
lea rdx, [rbp + 0x728]
call fcn.14000c30e
test bl, 0x10
sete al
or al, byte [rbp + 0x7a6]
jne 0x14000c7af
cmp qword [rbp + 0x798], 0
je 0x14000c763
lea rcx, [rbp + 0x728]
mov rdx, qword [rbp + 0x830]
call qword [rbp + 0x798]
test al, al
je 0x14000c7af
mov rax, qword [rbp + 0x1c8]
mov rcx, qword [rbp + 0x1b8]
add rcx, rax
mov qword [rbp + 0x6f0], rax
mov qword [rbp + 0x6f8], rcx
lea rcx, [rbp + 0x768]
lea rdx, [rbp + 0x6f0]
lea r8, [rbp + 0x700]
call fcn.14000ffa4
lea rcx, [rbp + 0x780]
lea rdx, [rbp + 0x768]
call fcn.14000c9ae
mov rcx, r13
mov rdx, r14
call rdi
test eax, eax
jne 0x14000c54a
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rbp + 0x6c0]
call fcn.140001c0a
lea rcx, [rbp + 0x630]
call fcn.140001c0a
jmp 0x14000c4c0
mov rax, qword [rbp + 0x838]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lea rax, [0x1400111ec]
lea r9, [rbp + 0x3d0]
mov qword [r9], rax
mov r8, rdx
sub r8, rcx
sar r8, 6
call fcn.14000d6ec
lea rcx, [rbp - 0x60]
call fcn.1400115a8
lea rcx, [rbp + 0x1b8]
call fcn.1400115a8
lea rcx, [rbp + 0x780]
call fcn.14000cab4
lea rcx, [rbp + 0x700]
call fcn.14000fe58
movaps xmm6, xmmword [rbp + 0x7b0]
add rsp, 0x848
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret