Function at 0x140030b74
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x4a0
mov rax, qword [0x140045008]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rdi, qword [rsp + 0x500]
mov rbx, rdx
xor r12d, r12d
mov r14d, r9d
mov r15, r8
mov rbp, rcx
mov edx, r12d
mov r10d, 0x104
test rbx, rbx
je 0x140030be8
mov eax, r10d
mov rcx, rbx
mov r8d, r12d
cmp word [rcx], r12w
je 0x140030bd6
add rcx, 2
sub rax, 1
jne 0x140030bc6
mov ecx, 0x80070057
test rax, rax
je 0x140030bed
mov rdx, r10
sub rdx, rax
jmp 0x140030bf0
mov ecx, 0x80070057
mov r8d, ecx
lea r9, [rdx + rdx]
test r8d, r8d
jns 0x140030c49
mov r9, r12
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030f0a
test byte [rcx + 0x1c], 1
je 0x140030f0a
cmp byte [rcx + 0x19], 2
jb 0x140030f0a
mov rcx, qword [rcx + 0x10]
mov edx, 0x19
mov dword [rsp + 0x20], r8d
mov r9, rbx
lea r8, [0x14003d4f0]
call fcn.1400042f4
jmp 0x140030f0a
mov rax, r12
test rdi, rdi
je 0x140030c72
mov rdx, r10
mov rax, rdi
mov r8d, r12d
cmp word [rax], r12w
je 0x140030c6a
add rax, 2
sub rdx, 1
jne 0x140030c5a
test rdx, rdx
jne 0x140030c7f
mov rax, r12
mov r8d, ecx
test r8d, r8d
js 0x140030c87
add rax, rax
jmp 0x140030c8a
mov rax, r10
sub rax, rdx
jmp 0x140030c75
mov rax, r12
test r8d, r8d
jns 0x140030ce1
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030f0a
test byte [rcx + 0x1c], 1
je 0x140030f0a
cmp byte [rcx + 0x19], 2
jb 0x140030f0a
mov edx, 0x1a
mov rcx, qword [rcx + 0x10]
mov r9, rdi
mov dword [rsp + 0x28], r8d
lea r8, [0x14003d4f0]
mov qword [rsp + 0x20], rbx
call fcn.1400304cc
jmp 0x140030f0a
add rax, r9
cmp rax, 0x206
jb 0x140030d39
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030f0a
test byte [rcx + 0x1c], 1
je 0x140030f0a
cmp byte [rcx + 0x19], 2
jb 0x140030f0a
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003d4f0]
mov edx, 0x1b
mov qword [rsp + 0x20], rbx
mov r9, rdi
call fcn.140004180
jmp 0x140030f0a
mov r8, rbx
lea rcx, [rsp + 0x280]
mov edx, 0x208
call fcn.140003c48
mov r8d, eax
test eax, eax
jns 0x140030d8a
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030f0a
test byte [rcx + 0x1c], 1
je 0x140030f0a
cmp byte [rcx + 0x19], 2
jb 0x140030f0a
mov edx, 0x1c
jmp 0x140030cbf
mov r8, rdi
lea rcx, [rsp + 0x280]
call fcn.14003161c
mov r8d, eax
test eax, eax
jns 0x140030dd6
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030f0a
test byte [rcx + 0x1c], 1
je 0x140030f0a
cmp byte [rcx + 0x19], 2
jb 0x140030f0a
mov edx, 0x1d
jmp 0x140030cbf
xor edx, edx
mov dword [rsp + 0x30], r12d
mov r8d, 0x24c
lea rcx, [rsp + 0x34]
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x280]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140030e4c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ecx, eax
call fcn.140003e60
mov r8d, eax
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030f0a
test byte [rcx + 0x1c], 1
je 0x140030f0a
cmp byte [rcx + 0x19], 2
jb 0x140030f0a
lea edx, [rsi + 0x1f]
jmp 0x140030cbf
mov edi, 0x102
cmp word [rsp + 0x5c], 0x2e
jne 0x140030e69
movzx eax, word [rsp + 0x5e]
cmp ax, 0x2e
je 0x140030e7c
test ax, ax
je 0x140030e7c
lea r9, [rsp + 0x5c]
mov r8d, r14d
mov rdx, r15
mov rcx, rbx
call fcn.1400305cc
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindNextFileW]
test eax, eax
je 0x140030f01
cmp byte [rbp + 0xa5], r12b
jne 0x140030ec6
cmp byte [rbp + 0xa6], r12b
jne 0x140030ec6
mov rcx, qword [rbp + 0x2e8]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, edi
jne 0x140030ec6
mov rcx, qword [rbp + 0x2e0]
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
cmp eax, edi
je 0x140030e51
mov rcx, qword [0x140045158]
lea rax, [0x140045158]
cmp rcx, rax
je 0x140030f01
test byte [rcx + 0x1c], 1
je 0x140030f01
cmp byte [rcx + 0x19], 5
jb 0x140030f01
mov rcx, qword [rcx + 0x10]
lea r9, [rbp + 0x288]
mov edx, 0xd7
lea r8, [0x14003cbb0]
call fcn.14000a67c
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FindClose]
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.140039130
add rsp, 0x4a0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret