Function at 0x1400019e0
Capabilities:
Enumerate files on windows

Disassembly:
push r13
push r15
sub rsp, 0x4f8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
xor edx, edx
mov dword [rsp + 0x20], 4
mov r13, rcx
mov r9d, 0x3000
lea rcx, [rdx - 1]
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
je 0x140001d90
mov qword [rsp + 0x4f0], rdi
xorps xmm0, xmm0
mov qword [rsp + 0x4e8], r12
mov r12, 0xffffffffffffffff
movups xmmword [rax], xmm0
nop word [rax + rax]
inc r12
cmp word [r13 + r12*2], 0
jne 0x140001a50
movzx edi, word [r13 + r12*2 - 2]
lea rcx, [rsp + 0x2c0]
xor edx, edx
mov word [rsp + 0x30], di
mov r8d, 0x104
call fcn.140018830
lea rdx, [rsp + 0x2c0]
mov rcx, r13
sub rdx, r13
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140001a90
lea rcx, [rsp + 0x2c0]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140001ab0
mov eax, dword [0x1400228c8]
lea rdx, [rsp + 0x70]
mov dword [rcx], eax
movzx eax, word [0x1400228cc]
mov word [rcx + 4], ax
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x140001d7d
mov qword [rsp + 0x518], rbx
lea r8, str..jar
mov qword [rsp + 0x520], rbp
mov qword [rsp + 0x528], rsi
mov qword [rsp + 0x4e0], r14
nop word [rax + rax]
lea rax, [rsp + 0x9c]
mov rcx, 0xffffffffffffffff
nop
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x140001b30
lea rdx, [rsp + 0x9c]
lea rdx, [rdx + rcx*2]
lea rcx, [rsp + 0x9c]
lea rax, [0x1400228e0]
cmp rdx, rcx
je 0x140001d33
cmp rax, r8
je 0x140001b8c
movzx ecx, word [rax - 2]
sub rax, 2
sub rdx, 2
cmp word [rdx], cx
jne 0x140001b83
lea rcx, [rsp + 0x9c]
cmp rdx, rcx
jne 0x140001b60
cmp rax, r8
jne 0x140001d33
movzx ecx, word [rax]
cmp word [rdx], cx
jne 0x140001d33
lea rcx, [rsp + 0x9c]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140001bb0
add rax, r12
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
lea rbx, [rax*2 + 4]
mov r8, rbx
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
je 0x140001d52
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.140018830
mov rdx, r14
mov rcx, r13
sub rdx, r13
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140001c10
cmp di, 0x5c
je 0x140001c43
lea rcx, [r14 - 2]
nop word [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140001c30
mov eax, dword [0x1400228d0]
mov dword [rcx], eax
lea rcx, [r14 - 2]
nop word [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140001c50
lea r8, [rsp + 0x9c]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140001c70
mov rax, qword [r15 + 8]
xor ebp, ebp
mov rdi, qword [r15]
lea rsi, [rax*8 + 8]
test rdi, rdi
je 0x140001cb2
lea r9d, [rbp + 0x30]
xor edx, edx
lea r8, [rsp + 0x40]
lea rcx, [rbp - 1]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov rbp, qword [rsp + 0x58]
test rsi, rsi
je 0x140001cfd
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, rsi
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rdi, rdi
je 0x140001d1a
test rax, rax
je 0x140001d04
test rbp, rbp
je 0x140001d04
cmp rsi, rbp
mov rdx, rdi
mov rcx, rax
cmovae rsi, rbp
mov r8, rsi
call fcn.140018bf0
jmp 0x140001d04
xor ebx, ebx
test rdi, rdi
je 0x140001d52
xor r8d, r8d
mov r9d, 0x8000
mov rdx, rdi
lea rcx, [r8 - 1]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test rbx, rbx
je 0x140001d52
mov rcx, qword [r15 + 8]
movzx edi, word [rsp + 0x30]
mov qword [r15], rbx
mov qword [rbx + rcx*8], r14
inc qword [r15 + 8]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
lea r8, str..jar
test eax, eax
jne 0x140001b20
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r14, qword [rsp + 0x4e0]
mov rsi, qword [rsp + 0x528]
mov rbp, qword [rsp + 0x520]
mov rbx, qword [rsp + 0x518]
mov rdi, qword [rsp + 0x4f0]
mov rax, r15
mov r12, qword [rsp + 0x4e8]
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.140002450
add rsp, 0x4f8
pop r15
pop r13
ret