Function at 0x140002d90
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rdi
push r13
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140027008]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, rcx
mov edx, 1
mov ecx, 0xa00000
call fcn.140009d98
mov qword [rsp + 0x68], rax
mov r13, rax
test rax, rax
je 0x14000334c
mov edx, dword [rdi]
mov dword [rax], edx
mov ecx, dword [rdi + 4]
mov qword [rsp + 0x2e8], rbx
mov qword [rsp + 0x2f0], rsi
call qword [sym.imp.WS2_32.dll_ntohl]
movsxd rsi, eax
mov edx, 1
lea ecx, [rsi + 1]
movsxd rcx, ecx
call fcn.140009d98
mov rbx, rax
test rax, rax
jne 0x140002e1d
mov rcx, r13
call fcn.14000a2c4
jmp 0x14000333c
mov r8, rsi
lea rdx, [rdi + 8]
mov rcx, rbx
call fcn.1400098c0
mov edx, 1
mov ecx, 0x5000
call fcn.140009d98
mov qword [rbp - 0x80], rax
mov rsi, rax
test rax, rax
jne 0x140002e5c
mov rcx, r13
call fcn.14000a2c4
mov rcx, rbx
call fcn.14000a2c4
jmp 0x14000333c
xor r9d, r9d
mov r8, rsi
mov edx, 0x5000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x140002e91
mov rcx, r13
call fcn.14000a2c4
mov rcx, rbx
call fcn.14000a2c4
mov rcx, rsi
call fcn.14000a2c4
jmp 0x14000333c
mov rcx, rbx
call fcn.14000a2c4
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140002ea0
lea rcx, [r13 + 4]
mov r8d, edi
mov rdx, rsi
mov ebx, edi
call fcn.1400098c0
xor edx, edx
mov byte [rbx + r13 + 4], 0xa
mov r8d, 0x140
lea rcx, [rbp - 0x50]
call fcn.140009150
lea rdx, [rbp - 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x78], rax
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140002f18
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r9d, r9d
lea ecx, [rbx + 0x35]
mov r8d, eax
mov rdx, rsi
call fcn.140005a90
mov rcx, r13
call fcn.14000a2c4
mov rcx, rsi
call fcn.14000a2c4
jmp 0x14000333c
mov edx, 1
mov qword [rsp + 0x2b8], r14
mov ecx, 0x1400
call fcn.140009d98
mov r14, rax
test rax, rax
jne 0x140002f55
mov rcx, r13
call fcn.14000a2c4
mov rcx, rsi
call fcn.14000a2c4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x140003334
movzx eax, word [0x140022218]
add edi, 5
movaps xmm0, xmmword [str.44093009253032642f253032642f2530326420253032643a253032643a253032640925730a]
movaps xmm1, xmmword [0x1400221e0]
movaps xmmword [rbp + 0xf0], xmm0
movaps xmm0, xmmword [0x1400221f0]
movaps xmmword [rbp + 0x110], xmm0
movsd xmm0, qword [0x140022210]
movsd qword [rbp + 0x130], xmm0
movaps xmm0, xmmword [str.4609254936346409253032642f253032642f2530326420253032643a253032643a253032640925730a]
movaps xmmword [rbp + 0x100], xmm1
movaps xmm1, xmmword [0x140022200]
mov word [rbp + 0x138], ax
movzx eax, byte [0x14002221a]
movaps xmmword [rbp + 0x140], xmm0
movaps xmm0, xmmword [0x140022240]
movaps xmmword [rbp + 0x120], xmm1
movaps xmm1, xmmword [0x140022230]
mov byte [rbp + 0x13a], al
movzx eax, word [0x140022270]
movaps xmmword [rbp + 0x160], xmm0
movaps xmm0, xmmword [0x140022260]
movaps xmmword [rbp + 0x150], xmm1
movaps xmm1, xmmword [0x140022250]
mov word [rbp + 0x190], ax
movzx eax, byte [0x140022272]
mov qword [rsp + 0x2f8], r12
movaps xmmword [rbp + 0x180], xmm0
mov dword [rsp + 0x60], edi
movaps xmmword [rbp + 0x170], xmm1
mov byte [rbp + 0x192], al
mov qword [rsp + 0x2b0], r15
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x3c]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea r8, [rbp - 0x78]
xor ecx, ecx
lea rdx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
test byte [rbp - 0x50], 0x10
je 0x140003172
lea rax, [rbp + 0xf0]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x140003066
lea ecx, [rsi + 2]
mov edx, 1
call fcn.140009d98
mov r15, rax
test rax, rax
je 0x140003324
shr esi, 1
mov r12d, 0
je 0x140003106
mov r13, rax
nop word [rax + rax]
lea ebx, [r12 + r12]
movsx ecx, byte [rbp + rbx + 0xf0]
call fcn.14000a1c0
sub al, 0x30
movzx edi, al
lea eax, [rbx + 1]
movsx ecx, byte [rbp + rax + 0xf0]
call fcn.14000a1c0
sub al, 0x30
lea r13, [r13 + 1]
movzx r8d, al
cmp dil, 9
lea eax, [rdi - 7]
movzx edx, al
cmovle edx, edi
shl dl, 4
lea eax, [r8 - 7]
cmp r8b, 9
movzx ecx, al
cmovle ecx, r8d
inc r12d
add dl, cl
mov byte [r13 - 1], dl
cmp r12d, esi
jb 0x1400030a0
mov r13, qword [rsp + 0x68]
mov edi, dword [rsp + 0x60]
movzx ecx, word [rbp - 0x6e]
lea r11, [rbp - 0x24]
movzx edx, word [rbp - 0x70]
movzx r8d, word [rbp - 0x78]
movzx r9d, word [rbp - 0x72]
movzx eax, word [rbp - 0x6c]
movzx r10d, word [rbp - 0x76]
mov qword [rsp + 0x50], r11
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ecx
mov rcx, r14
mov dword [rsp + 0x38], edx
mov edx, 0x1400
mov dword [rsp + 0x30], r8d
mov r8, 0xffffffffffffffff
mov dword [rsp + 0x28], r9d
mov r9, r15
mov dword [rsp + 0x20], r10d
call fcn.1400020d0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [r14 + r8], 0
jne 0x140003163
jmp 0x14000329a
lea rax, [rbp + 0x140]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140003180
lea ecx, [rbx + 2]
mov edx, 1
call fcn.140009d98
mov r15, rax
test rax, rax
je 0x140003324
shr ebx, 1
mov r12d, 0
je 0x140003216
mov r13, rax
nop
lea edi, [r12 + r12]
movsx ecx, byte [rbp + rdi + 0x140]
call fcn.14000a1c0
sub al, 0x30
movzx esi, al
lea eax, [rdi + 1]
movsx ecx, byte [rbp + rax + 0x140]
call fcn.14000a1c0
sub al, 0x30
lea r13, [r13 + 1]
movzx r8d, al
cmp sil, 9
lea eax, [rsi - 7]
movzx edx, al
cmovle edx, esi
shl dl, 4
lea eax, [r8 - 7]
cmp r8b, 9
movzx ecx, al
cmovle ecx, r8d
inc r12d
add dl, cl
mov byte [r13 - 1], dl
cmp r12d, ebx
jb 0x1400031b0
mov r13, qword [rsp + 0x68]
mov edi, dword [rsp + 0x60]
mov eax, dword [rbp - 0x30]
lea r11, [rbp - 0x24]
movzx ecx, word [rbp - 0x6e]
movzx edx, word [rbp - 0x70]
movzx r8d, word [rbp - 0x78]
movzx r9d, word [rbp - 0x72]
movzx r10d, word [rbp - 0x76]
mov qword [rsp + 0x58], r11
mov dword [rsp + 0x70], eax
mov eax, dword [rbp - 0x34]
mov dword [rsp + 0x74], eax
movzx eax, word [rbp - 0x6c]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x70]
mov dword [rsp + 0x48], ecx
mov rcx, r14
mov dword [rsp + 0x40], edx
mov edx, 0x1400
mov dword [rsp + 0x38], r8d
mov r8, 0xffffffffffffffff
mov dword [rsp + 0x30], r9d
mov r9, r15
mov dword [rsp + 0x28], r10d
mov qword [rsp + 0x20], rax
call fcn.1400020d0
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [r14 + r8], 0
jne 0x140003290
mov ecx, edi
mov rdx, r14
add rcx, r13
call fcn.1400098c0
mov rcx, r14
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400032b1
add edi, eax
mov rcx, r15
mov dword [rsp + 0x60], edi
call fcn.14000a2c4
xor edx, edx
mov r8d, 0x1400
mov rcx, r14
call fcn.140009150
mov rbx, qword [rsp + 0x78]
lea rdx, [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140003030
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, r14
call fcn.14000a2c4
mov rcx, qword [rbp - 0x80]
call fcn.14000a2c4
mov r8d, 0x16
mov edx, edi
mov rcx, r13
call fcn.140004970
mov rcx, r13
call fcn.14000a2c4
mov r15, qword [rsp + 0x2b0]
mov r12, qword [rsp + 0x2f8]
mov r14, qword [rsp + 0x2b8]
mov rbx, qword [rsp + 0x2e8]
mov rsi, qword [rsp + 0x2f0]
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140008040
add rsp, 0x2c0
pop r13
pop rdi
pop rbp
ret