Function at 0x14001efd0
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1a8
mov qword [rsp + 0x38], rdx
mov rdi, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
lea rcx, [rsp + 0x68]
xor edx, edx
call fcn.140026380
lea rbx, [rdi + 4]
lea rax, [rdi + 0x2b0]
mov qword [rsp + 0x48], rax
lea r15, [rdi + 0x2b8]
lea rax, [rdi + 0x260]
mov qword [rsp + 0x40], rax
lea r14, [rdi + 0x288]
lea rbp, [rdi + 0x30]
lea rsi, [rsp + 0x90]
lea r13, [rsp + 0x58]
mov r12, qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov qword [rsp + 0x50], rbp
jmp 0x14001f068
mov rcx, rsi
call fcn.140013ea0
cmp byte [rdi], 0
je 0x14001f0a0
mov rcx, qword [rdi + 0x258]
mov rdx, rbx
call r12
test eax, eax
je 0x14001f170
cmp qword [rdi + 0x258], 0xffffffffffffffff
jne 0x14001f21b
jmp 0x14001f240
mov rax, qword [rdi + 0x2c8]
cmp qword [rdi + 0x2c0], rax
je 0x14001f38c
test rax, rax
mov rcx, qword [r15]
cmove rax, rcx
add rax, 0xffffffffffffffff
mov qword [rsp + 0x80], rax
cmp rcx, rax
jae 0x14001f10b
lea rcx, [rsp + 0x80]
mov rdx, r15
lea r8, str.i___capacity_
call fcn.14000dc60
test rax, rax
je 0x14001f10b
mov rcx, rsi
lea rdx, str..._.._base_containers_vector_buffer.h
mov r8d, 0x55
mov r9, rax
call fcn.1400196d0
mov rcx, rsi
call fcn.1400186e0
mov rdx, qword [rsp + 0x80]
shl rdx, 5
add rdx, qword [rdi + 0x2b0]
mov rcx, qword [rsp + 0x40]
call fcn.140013f10
mov rcx, qword [rsp + 0x48]
call fcn.14001fdb0
mov eax, dword [rdi + 0x2a8]
cmp eax, 1
je 0x14001f18d
test eax, eax
jne 0x14001f1bf
cmp qword [rdi + 0x2a0], 7
mov rax, r14
jbe 0x14001f155
mov rax, qword [rdi + 0x288]
mov qword [rsp + 0x80], rax
mov rax, qword [rdi + 0x298]
mov qword [rsp + 0x88], rax
jmp 0x14001f1a8
mov rcx, qword [rdi + 0x258]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rdi + 0x258], 0xffffffffffffffff
jmp 0x14001f240
lea rax, [0x1400f5b68]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
lea r8, [rsp + 0x80]
call fcn.1400154f0
jmp 0x14001f1c7
mov rcx, rsi
call fcn.140013cc0
cmp qword [rsp + 0xa8], 7
mov rcx, rsi
jbe 0x14001f1dd
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], 0
mov edx, 1
mov r8, rbx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov qword [rdi + 0x258], rax
mov byte [rdi], 1
mov rcx, rsi
call fcn.140013ea0
cmp qword [rdi + 0x258], 0xffffffffffffffff
je 0x14001f240
mov qword [rsp + 0x58], rbp
cmp word [rbp], 0
je 0x14001f282
xor eax, eax
nop dword [rax]
cmp word [rdi + rax*2 + 0x32], 0
lea rax, [rax + 1]
jne 0x14001f230
jmp 0x14001f284
mov byte [rdi], 0
cmp dword [rdi + 0x2a8], 0
jne 0x14001f068
mov rcx, qword [rdi + 0x2a0]
test rcx, rcx
je 0x14001f333
mov rax, r14
cmp rcx, 8
jb 0x14001f26c
mov rax, qword [r14]
mov qword [rdi + 0x298], 1
mov dword [rax], 0x2a
jmp 0x14001f068
xor eax, eax
mov qword [rsp + 0x60], rax
mov rcx, rsi
mov rdx, r13
call fcn.140013df0
mov rcx, rdi
mov rdx, rsi
call fcn.1400281f0
test al, al
jne 0x14001f060
mov r8, rsi
mov rbp, rbx
mov rbx, r14
mov r14d, dword [rdi + 4]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
call fcn.140015b00
test r14b, 0x10
je 0x14001f300
cmp byte [rdi + 0x280], 0
je 0x14001f300
mov rax, qword [rsp + 0x38]
cmp qword [rax + 0x18], 7
mov rcx, rax
jbe 0x14001f2e4
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, 0x400
jne 0x14001f300
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
call fcn.14001f720
and r14d, 0x10
shr r14d, 4
mov rcx, rdi
mov edx, r14d
call fcn.1400283a0
test al, al
mov r14, rbx
mov rbx, rbp
mov rbp, qword [rsp + 0x50]
je 0x14001f37d
mov eax, dword [rdi + 0x2a8]
cmp eax, 1
je 0x14001f34c
test eax, eax
jne 0x14001f37d
jmp 0x14001f39b
mov edx, 1
mov rcx, r14
lea r9, [0x1400f5b68]
call fcn.140003250
jmp 0x14001f068
cmp qword [rdi + 0x2a0], 8
mov rdx, r14
jb 0x14001f35c
mov rdx, qword [r14]
cmp qword [rsp + 0xa8], 7
mov rcx, rsi
jbe 0x14001f372
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
cmp eax, 1
je 0x14001f39b
mov rcx, qword [rsp + 0x38]
call fcn.140013ea0
jmp 0x14001f060
mov rsi, qword [rsp + 0x38]
mov rcx, rsi
call fcn.140013cc0
jmp 0x14001f3ad
lea rcx, [rsp + 0x90]
call fcn.140013ea0
mov rsi, qword [rsp + 0x38]
lea rcx, [rsp + 0x68]
call fcn.140026480
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400a8dd0
mov rax, rsi
add rsp, 0x1a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret