Function at 0x14003d5f8
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x518]
sub rsp, 0x5e0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x1402142b0]
xor rax, rsp
mov qword [rbp + 0x4b0], rax
lea rax, [rbp + 0x268]
mov qword [rbp + 0x260], 0x80
mov qword [rbp + 0x250], rax
mov r13b, r9b
mov rax, qword [r8]
mov r15, r8
mov qword [rsp + 0x30], rax
mov r12, rdx
mov rax, qword [r8 + 8]
lea rdx, [rsp + 0x30]
mov rdi, rcx
mov qword [rsp + 0x38], rax
xor ebx, ebx
mov word [rsp + 0x50], 0x105
lea r8, [rbp + 0x250]
mov qword [rbp + 0x258], rbx
mov r9d, 0x104
lea rcx, [rsp + 0x58]
call fcn.14004260c
cmp dword [rsp + 0x58], ebx
je 0x14003d6a7
movups xmm0, xmmword [rsp + 0x58]
movdqu xmmword [rdi], xmm0
jmp 0x14003daca
mov rdx, qword [rbp + 0x258]
mov r9, qword [rbp + 0x250]
test rdx, rdx
je 0x14003d76b
movzx ecx, word [r9 + rdx*2 - 2]
call fcn.14003f3cc
test al, al
jne 0x14003d76b
cmp cx, 0x3a
je 0x14003d76b
lea r8, [rdx + 1]
mov r14d, 2
cmp r8, qword [rbp + 0x260]
jbe 0x14003d712
mov r9d, r14d
lea rdx, [rbp + 0x268]
lea rcx, [rbp + 0x250]
call fcn.14001e624
mov rdx, qword [rbp + 0x258]
mov r9, qword [rbp + 0x250]
mov eax, 0x5c
mov word [r9 + rdx*2], ax
mov rcx, qword [rbp + 0x258]
inc rcx
mov qword [rbp + 0x258], rcx
lea r8, [rcx + 1]
cmp r8, qword [rbp + 0x260]
jbe 0x14003d757
mov r9, r14
lea rdx, [rbp + 0x268]
lea rcx, [rbp + 0x250]
call fcn.14001e624
mov rcx, qword [rbp + 0x258]
mov rax, qword [rbp + 0x250]
mov r8d, 0x2a
mov word [rax + rcx*2], r8w
jmp 0x14003d7ad
lea r8, [rdx + 1]
mov r14d, 2
cmp r8, qword [rbp + 0x260]
jbe 0x14003d7a2
mov r9d, r14d
lea rdx, [rbp + 0x268]
lea rcx, [rbp + 0x250]
call fcn.14001e624
mov rdx, qword [rbp + 0x258]
mov r9, qword [rbp + 0x250]
mov r8d, 0x2a
mov word [r9 + rdx*2], r8w
inc qword [rbp + 0x258]
lea rcx, [rbp + 0x250]
call fcn.14003bb28
xor r9d, r9d
mov dword [rsp + 0x28], r14d
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea r8, [rbp - 0x50]
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
or rsi, 0xffffffffffffffff
mov rbx, rax
cmp rax, rsi
jne 0x14003d7ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
call fcn.14002c20c
jmp 0x14003daca
lea rdx, [rbp - 0x24]
mov rax, rsi
xor ecx, ecx
inc rax
cmp word [rdx + rax*2], cx
jne 0x14003d808
cmp rax, 1
jne 0x14003d81e
cmp word [rbp - 0x24], 0x2e
je 0x14003d831
cmp rax, r14
jne 0x14003d883
cmp word [rbp - 0x24], 0x2e
jne 0x14003d883
cmp word [rbp - 0x22], 0x2e
jne 0x14003d883
lea rdx, [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor ecx, ecx
test eax, eax
je 0x14003d856
lea rdx, [rbp - 0x24]
mov rax, rsi
inc rax
cmp word [rdx + rax*2], cx
jne 0x14003d84b
jmp 0x14003d811
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
cmp eax, 0x12
jne 0x14003d87a
mov rdx, r12
call fcn.14003db20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x14003daca
mov edx, eax
call fcn.14002c20c
jmp 0x14003d86c
lea rax, [rbp + 0x388]
mov qword [rbp + 0x380], 0x80
xor r14d, r14d
mov qword [rbp + 0x370], rax
lea rax, [rbp - 0x24]
mov qword [rbp + 0x378], r14
inc rsi
cmp word [rax + rsi*2], r14w
jne 0x14003d8aa
mov r8, rsi
lea r9, [rbp + 0x370]
lea rdx, [rbp - 0x24]
lea rcx, [rsp + 0x58]
call fcn.14003c424
cmp dword [rsp + 0x58], r14d
je 0x14003d8fd
movups xmm0, xmmword [rsp + 0x58]
mov rcx, qword [rbp + 0x370]
lea rax, [rbp + 0x388]
movdqu xmmword [rdi], xmm0
cmp rcx, rax
je 0x14003d86c
call fcn.14011c590
jmp 0x14003d86c
movups xmm1, xmmword [r15]
lea rax, [rbp + 0x428]
mov qword [r12], rbx
lea rcx, [rbp + 0x410]
mov qword [rbp + 0x410], rax
movdqa xmm0, xmm1
mov qword [rbp + 0x418], r14
psrldq xmm0, 8
movq rdx, xmm1
movq r8, xmm0
mov qword [rbp + 0x420], 0x80
add r8, rdx
call fcn.1400107ec
mov rax, qword [rbp + 0x370]
lea r9, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x200]
mov rax, qword [rbp + 0x378]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rcx, [rbp + 0x410]
lea rax, [rsp + 0x58]
mov word [rsp + 0x78], 0x101
mov qword [rsp + 0x20], rax
mov word [rbp - 0x60], 0x101
mov word [rbp + 0x220], 0x101
mov word [rsp + 0x50], 0x105
call fcn.14003c5a8
mov rax, qword [rbp + 0x410]
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x58]
mov rax, qword [rbp + 0x418]
mov qword [rsp + 0x38], rax
mov word [rsp + 0x50], 0x105
call fcn.140042300
mov ecx, dword [rbp - 0x50]
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
call fcn.14003dfa4
lea rcx, [rsp + 0x30]
mov ebx, eax
lea rdx, [rbp + 0x200]
call fcn.14002cd90
lea rdx, [rbp + 0x200]
mov dword [rbp + 0x220], ebx
lea rcx, [r12 + 8]
mov byte [rbp + 0x224], r13b
movups xmmword [rbp + 0x228], xmm6
movups xmmword [rbp + 0x238], xmm7
call fcn.14000875c
mov eax, dword [rbp + 0x220]
movups xmm0, xmmword [rbp + 0x228]
mov rdx, qword [rbp + 0x218]
mov dword [r12 + 0x28], eax
mov al, byte [rbp + 0x224]
mov byte [r12 + 0x2c], al
movups xmm1, xmmword [rbp + 0x238]
movups xmmword [r12 + 0x30], xmm0
movups xmmword [r12 + 0x40], xmm1
cmp rdx, 0x10
jb 0x14003da8e
mov rcx, qword [rbp + 0x200]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003da89
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003db19
call fcn.1400690f4
mov dword [rdi], r14d
call fcn.140004f44
mov rcx, qword [rbp + 0x410]
mov qword [rdi + 8], rax
lea rax, [rbp + 0x428]
cmp rcx, rax
je 0x14003dab2
call fcn.14011c590
mov rcx, qword [rbp + 0x370]
lea rax, [rbp + 0x388]
cmp rcx, rax
je 0x14003daca
call fcn.14011c590
mov rcx, qword [rbp + 0x250]
lea rax, [rbp + 0x268]
cmp rcx, rax
je 0x14003dae2
call fcn.14011c590
mov rax, rdi
mov rcx, qword [rbp + 0x4b0]
xor rcx, rsp
call fcn.140115e10
lea r11, [rsp + 0x5e0]
mov rbx, qword [r11 + 0x58]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14011c518
int3