Function at 0x140008ad0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x300]
sub rsp, 0x400
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x450], rbx
mov rax, qword [0x1400c0140]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
mov qword [rsp + 0x70], rdx
mov r14, rcx
mov qword [rbp - 0x58], rcx
xor esi, esi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov qword [rbp + 0x18], 7
mov qword [rbp + 0x10], rsi
mov word [rbp], si
mov qword [rbp + 0x90], 7
mov qword [rbp + 0x88], rsi
mov word [rbp + 0x78], si
mov qword [rbp + 0x40], 7
mov qword [rbp + 0x38], rsi
mov word [rbp + 0x28], si
mov qword [rbp - 0x10], 7
mov qword [rbp - 0x18], rsi
mov word [rbp - 0x28], si
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rcx
lea rcx, [rbp + 0x28]
call fcn.1400015e0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp - 0x28]
call fcn.1400015e0
lea r8d, [rsi + 2]
lea rdx, [0x14008f340]
lea rcx, [rbp - 0x28]
call fcn.140015a00
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], rsi
mov word [rbp - 0x50], si
lea r8d, [rsi + 0xa]
lea rdx, str._NLU__
lea rcx, [rbp - 0x50]
call fcn.140001780
nop
lea rcx, [rsp + 0x50]
call fcn.140013ad0
mov r12, qword [rsp + 0x58]
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r12
test r12, r12
je 0x140008c23
mov qword [r12 + 0x18], 7
mov qword [r12 + 0x10], rsi
mov word [r12], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, r12
call fcn.1400015e0
nop
add r12, 0x28
mov qword [rsp + 0x58], r12
cmp qword [rbp - 0x38], 8
jb 0x140008c3c
mov rcx, qword [rbp - 0x50]
call fcn.140063290
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], rsi
mov word [rbp - 0x50], si
mov r8d, 4
lea rdx, [0x14008f360]
lea rcx, [rbp - 0x50]
call fcn.140001780
nop
lea rcx, [rsp + 0x30]
call fcn.140013ad0
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x140008ca4
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov word [rbx], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400015e0
nop
add rbx, 0x28
mov qword [rsp + 0x38], rbx
cmp qword [rbp - 0x38], 8
jb 0x140008cbd
mov rcx, qword [rbp - 0x50]
call fcn.140063290
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], rsi
mov word [rbp - 0x50], si
mov r8d, 4
lea rdx, str._n_
lea rcx, [rbp - 0x50]
call fcn.140001780
nop
lea rax, [rbp - 0x50]
movabs r13, 0x6666666666666667
mov r15, qword [rsp + 0x30]
cmp rax, rbx
jae 0x140008d84
lea rax, [rbp - 0x50]
cmp r15, rax
ja 0x140008d84
lea rcx, [rbp - 0x50]
sub rcx, r15
mov rax, r13
imul rcx
mov rsi, rdx
sar rsi, 4
mov rax, rsi
shr rax, 0x3f
add rsi, rax
mov rdi, qword [rsp + 0x40]
cmp rbx, rdi
jne 0x140008d4a
lea rcx, [rsp + 0x30]
call fcn.140013ad0
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov r15, qword [rsp + 0x30]
lea rax, [rsi + rsi*4]
lea rdx, [r15 + rax*8]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor esi, esi
test rbx, rbx
je 0x140008d82
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov word [rbx], si
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rcx, rbx
call fcn.1400015e0
nop
jmp 0x140008dd9
mov rdi, qword [rsp + 0x40]
cmp rbx, rdi
jne 0x140008da7
lea rcx, [rsp + 0x30]
call fcn.140013ad0
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov r15, qword [rsp + 0x30]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x140008dd9
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov word [rbx], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400015e0
nop
add rbx, 0x28
mov qword [rsp + 0x38], rbx
cmp qword [rbp - 0x38], 8
jb 0x140008df2
mov rcx, qword [rbp - 0x50]
call fcn.140063290
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], rsi
mov word [rbp - 0x50], si
mov r8d, 5
lea rdx, str._n._
lea rcx, [rbp - 0x50]
call fcn.140001780
nop
lea rax, [rbp - 0x50]
cmp rax, rbx
jae 0x140008e9c
lea rax, [rbp - 0x50]
cmp r15, rax
ja 0x140008e9c
lea rcx, [rbp - 0x50]
sub rcx, r15
mov rax, r13
imul rcx
mov rsi, rdx
sar rsi, 4
mov rax, rsi
shr rax, 0x3f
add rsi, rax
cmp rbx, rdi
jne 0x140008e62
lea rcx, [rsp + 0x30]
call fcn.140013ad0
mov rbx, qword [rsp + 0x38]
mov r15, qword [rsp + 0x30]
lea rax, [rsi + rsi*4]
lea rdx, [r15 + rax*8]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor esi, esi
test rbx, rbx
je 0x140008e9a
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov word [rbx], si
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rcx, rbx
call fcn.1400015e0
nop
jmp 0x140008ee7
cmp rbx, rdi
jne 0x140008eb5
lea rcx, [rsp + 0x30]
call fcn.140013ad0
mov rbx, qword [rsp + 0x38]
mov r15, qword [rsp + 0x30]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x140008ee7
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov word [rbx], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400015e0
nop
add rbx, 0x28
mov qword [rsp + 0x38], rbx
cmp qword [rbp - 0x38], 8
jb 0x140008f00
mov rcx, qword [rbp - 0x50]
call fcn.140063290
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
lea rdx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdx, rax
mov qword [rsp + 0x20], rax
mov r13, qword [rsp + 0x50]
nop dword [rax + rax]
cmp rdx, 0xffffffffffffffff
je 0x14000911f
lea rsi, [rbp + 0xcc]
lea rdi, [0x14008f280]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x14000911d
lea rsi, [rbp + 0xcc]
lea rdi, [0x14008f284]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x14000911d
xor esi, esi
movabs rax, 0x6666666666666667
mov edi, esi
test byte [rbp + 0xa0], 0x10
je 0x14000904f
mov rcx, r12
sub rcx, r13
imul rcx
mov r12, rdx
sar r12, 4
mov rax, r12
shr rax, 0x3f
add r12, rax
je 0x14000910c
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
mov rsi, r13
nop dword [rax]
mov qword [rbp - 0x38], 7
xor eax, eax
mov qword [rbp - 0x40], rax
mov word [rbp - 0x50], ax
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp - 0x50]
call fcn.1400015e0
nop
lea r8, [0x14008ef9c]
mov rdx, r14
lea rcx, [rbp + 0x50]
call fcn.140018a10
nop
lea r8, [rbp + 0xcc]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140018c70
nop
lea r8, [rbp]
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.14002bae0
mov r13d, eax
cmp qword [rbp + 0x68], 8
jb 0x140009031
mov rcx, qword [rbp + 0x50]
call fcn.140063290
test r13d, r13d
jne 0x140009144
inc rdi
add rsi, 0x28
cmp rdi, r12
jb 0x140008fc0
jmp 0x140009113
mov rcx, rbx
sub rcx, r15
imul rcx
mov r12, rdx
sar r12, 4
mov rax, r12
shr rax, 0x3f
add r12, rax
je 0x14000910c
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
mov rsi, r15
nop dword [rax + rax]
mov qword [rbp - 0x38], 7
xor eax, eax
mov qword [rbp - 0x40], rax
mov word [rbp - 0x50], ax
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp - 0x50]
call fcn.1400015e0
nop
lea r8, [0x14008ef9c]
mov rdx, r14
lea rcx, [rbp + 0x50]
call fcn.140018a10
nop
lea r8, [rbp + 0xcc]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140018c70
nop
lea r8, [rbp]
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.14002bae0
mov r13d, eax
cmp qword [rbp + 0x68], 8
jb 0x1400090f1
mov rcx, qword [rbp + 0x50]
call fcn.140063290
test r13d, r13d
jne 0x140009272
inc rdi
add rsi, 0x28
cmp rdi, r12
jb 0x140009080
jmp 0x140009113
mov r12, qword [rsp + 0x58]
jmp 0x14000911f
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
xor esi, esi
lea rdx, [rbp + 0xa0]
mov rdi, qword [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14000932c
mov rdx, rdi
jmp 0x140008f30
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdx, r14
mov rcx, qword [rsp + 0x70]
call fcn.1400119e0
nop
cmp qword [rbp - 0x10], 8
jb 0x14000916d
mov rcx, qword [rbp - 0x28]
call fcn.140063290
mov qword [rbp - 0x10], 7
xor r12d, r12d
mov qword [rbp - 0x18], r12
mov word [rbp - 0x28], r12w
cmp qword [rbp + 0x40], 8
jb 0x140009191
mov rcx, qword [rbp + 0x28]
call fcn.140063290
mov qword [rbp + 0x40], 7
mov qword [rbp + 0x38], r12
mov word [rbp + 0x28], r12w
cmp qword [rbp + 0x18], 8
jb 0x1400091b2
mov rcx, qword [rbp]
call fcn.140063290
mov qword [rbp + 0x18], 7
mov qword [rbp + 0x10], r12
mov word [rbp], r12w
test r15, r15
je 0x140009201
mov rdi, r15
cmp r15, rbx
je 0x1400091f8
cmp qword [rdi + 0x18], 8
jb 0x1400091df
mov rcx, qword [rdi]
call fcn.140063290
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r12
mov word [rdi], r12w
add rdi, 0x28
cmp rdi, rbx
jne 0x1400091d0
mov rcx, r15
call fcn.140063290
nop
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x140009249
mov rdi, rbx
mov rsi, qword [rsp + 0x58]
cmp rbx, rsi
je 0x140009240
cmp qword [rdi + 0x18], 8
jb 0x140009227
mov rcx, qword [rdi]
call fcn.140063290
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r12
mov word [rdi], r12w
add rdi, 0x28
cmp rdi, rsi
jne 0x140009218
mov rcx, rbx
call fcn.140063290
nop
cmp qword [r14 + 0x18], 8
jb 0x140009258
mov rcx, qword [r14]
call fcn.140063290
mov qword [r14 + 0x18], 7
mov qword [r14 + 0x10], r12
mov word [r14], r12w
mov eax, 1
jmp 0x140009431
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdx, r14
mov rcx, qword [rsp + 0x70]
call fcn.1400119e0
nop
cmp qword [rbp - 0x10], 8
jb 0x14000929b
mov rcx, qword [rbp - 0x28]
call fcn.140063290
mov qword [rbp - 0x10], 7
xor edi, edi
mov qword [rbp - 0x18], rdi
mov word [rbp - 0x28], di
cmp qword [rbp + 0x40], 8
jb 0x1400092bd
mov rcx, qword [rbp + 0x28]
call fcn.140063290
mov qword [rbp + 0x40], 7
mov qword [rbp + 0x38], rdi
mov word [rbp + 0x28], di
cmp qword [rbp + 0x18], 8
jb 0x1400092dd
mov rcx, qword [rbp]
call fcn.140063290
mov qword [rbp + 0x18], 7
mov qword [rbp + 0x10], rdi
mov word [rbp], di
lea rcx, [rsp + 0x30]
call fcn.140013b90
nop
lea rcx, [rsp + 0x50]
call fcn.140013b90
nop
cmp qword [r14 + 0x18], 8
jb 0x140009312
mov rcx, qword [r14]
call fcn.140063290
mov qword [r14 + 0x18], 7
mov qword [r14 + 0x10], rdi
mov word [r14], di
mov eax, 1
jmp 0x140009431
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
cmp qword [rbp - 0x10], 8
jb 0x140009346
mov rcx, qword [rbp - 0x28]
call fcn.140063290
mov qword [rbp - 0x10], 7
mov qword [rbp - 0x18], rsi
mov word [rbp - 0x28], si
cmp qword [rbp + 0x40], 8
jb 0x140009366
mov rcx, qword [rbp + 0x28]
call fcn.140063290
mov qword [rbp + 0x40], 7
mov qword [rbp + 0x38], rsi
mov word [rbp + 0x28], si
cmp qword [rbp + 0x18], 8
jb 0x140009386
mov rcx, qword [rbp]
call fcn.140063290
mov qword [rbp + 0x18], 7
mov qword [rbp + 0x10], rsi
mov word [rbp], si
test r15, r15
je 0x1400093d3
mov rdi, r15
cmp r15, rbx
je 0x1400093ca
cmp qword [rdi + 0x18], 8
jb 0x1400093b2
mov rcx, qword [rdi]
call fcn.140063290
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rsi
mov word [rdi], si
add rdi, 0x28
cmp rdi, rbx
jne 0x1400093a3
mov rcx, r15
call fcn.140063290
nop
test r13, r13
je 0x140009410
mov rdi, r13
cmp r13, r12
je 0x140009407
cmp qword [rdi + 0x18], 8
jb 0x1400093ef
mov rcx, qword [rdi]
call fcn.140063290
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rsi
mov word [rdi], si
add rdi, 0x28
cmp rdi, r12
jne 0x1400093e0
mov rcx, r13
call fcn.140063290
nop
cmp qword [r14 + 0x18], 8
jb 0x14000941f
mov rcx, qword [r14]
call fcn.140063290
mov qword [r14 + 0x18], 7
mov qword [r14 + 0x10], rsi
mov word [r14], si
xor eax, eax
mov rcx, qword [rbp + 0x2f0]
xor rcx, rsp
call fcn.140063080
mov rbx, qword [rsp + 0x450]
add rsp, 0x400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret