Function at 0x7fffb6db5c24
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x7fffb6df6798]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor edi, edi
mov qword [rsp + 0x48], rdx
mov r15, r8
mov dword [rsp + 0x50], edi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x58], rdi
xor edx, edx
mov qword [rsp + 0x60], rax
mov r8d, 0x250
lea rcx, [rbp - 0x70]
mov ebx, edi
mov esi, edi
or r13, 0xffffffffffffffff
call sub.msvcrt.dll_memset
mov al, byte [r15 + 8]
mov ecx, 0x101d0
and al, 1
mov qword [rbp - 0x80], rdi
mov byte [rsp + 0x40], al
call qword [sym.imp.msvcrt.dll_malloc]
mov r12, rax
test rax, rax
jne 0x7fffb6db5cc9
mov edx, 0x10303
mov r8d, 0x8007000e
mov cl, 2
call fcn.7fffb6dc60a0
mov edi, 0x8007000e
jmp 0x7fffb6db617e
mov rcx, qword [r15 + 0x10]
lea r9, [rsp + 0x50]
mov r8d, 0x80e8
mov rdx, rax
call fcn.7fffb6db1690
mov edi, eax
test eax, eax
js 0x7fffb6db6126
mov ecx, 0x20
call qword [sym.imp.msvcrt.dll_malloc]
xor r9d, r9d
mov rbx, rax
test rax, rax
jne 0x7fffb6db5d15
mov edx, 0x10303
mov r8d, 0x8007000e
mov cl, 2
call fcn.7fffb6dc60a0
xor r9d, r9d
test rbx, rbx
jne 0x7fffb6db5d24
mov edi, 0x8007000e
jmp 0x7fffb6db6126
mov eax, dword [rsp + 0x50]
mov dword [rbx + 8], eax
mov qword [rbx], r9
mov rax, qword [r15 + 0x10]
mov qword [rbx + 0x10], rax
mov word [rbx + 0x18], r9w
mov rax, qword [rsp + 0x48]
mov al, byte [rax + 0xf8]
test al, al
jne 0x7fffb6db6111
mov eax, dword [rbx + 8]
lea r8, [rbx + 0x18]
mov edx, 0x80e8
mov rcx, r12
mov word [r12 + rax*2], r9w
call fcn.7fffb6db52f4
xor edx, edx
test eax, eax
jne 0x7fffb6db6104
mov r9d, 0x80e8
mov rcx, r12
mov eax, r9d
cmp word [rcx], dx
je 0x7fffb6db5d8c
add rcx, 2
sub rax, 1
jne 0x7fffb6db5d7d
test rax, rax
je 0x7fffb6db60f7
mov rdi, r9
sub rdi, rax
cmp rdi, r9
jae 0x7fffb6db60f7
lea r8, [0x7fffb6ddcfe0]
mov dword [rsp + 0x50], edi
mov rdx, r9
mov rcx, r12
call fcn.7fffb6db52f4
test eax, eax
jne 0x7fffb6db60ea
lea rdx, [rbp - 0x70]
mov rcx, r12
call qword [sym.imp.KernelBase.dll_FindFirstFileW]
mov r13, rax
mov qword [rsp + 0x68], rax
mov eax, edi
xor r9d, r9d
mov qword [rbp - 0x78], rax
mov word [r12 + rax*2], r9w
cmp r13, 0xffffffffffffffff
je 0x7fffb6db5fca
mov rdi, qword [rsp + 0x48]
mov cl, byte [rdi + 0xf8]
test cl, cl
jne 0x7fffb6db60e3
inc qword [r15 + 0x40]
mov rax, qword [r15 + 0x28]
test rax, rax
je 0x7fffb6db5e1a
inc qword [r15 + 0x20]
dec rax
mov qword [r15 + 0x28], rax
mov r8, qword [r15 + 0x28]
mov rcx, rdi
mov rdx, qword [r15 + 0x20]
sub r8, qword [r15 + 0x38]
sub rdx, qword [r15 + 0x30]
call fcn.7fffb6db5240
mov rax, qword [r15 + 0x28]
mov edx, 0x104
mov rcx, qword [r15 + 0x20]
mov qword [r15 + 0x38], rax
mov eax, edx
mov qword [r15 + 0x30], rcx
lea rcx, [rbp - 0x44]
cmp word [rcx], r9w
je 0x7fffb6db5e5d
add rcx, 2
sub rax, 1
jne 0x7fffb6db5e4d
test rax, rax
je 0x7fffb6db60d6
mov rdi, rdx
lea r8, [rbp - 0x44]
sub rdi, rax
mov edx, 0x100
lea rax, [rbp - 0x44]
mov dword [rsp + 0x28], edi
mov r9d, edi
mov qword [rsp + 0x20], rax
mov ecx, 0x800
call qword [sym.imp.KernelBase.dll_LCMapStringW]
test dword [rbp - 0x70], 0x1500
jne 0x7fffb6db5f9d
test byte [rbp - 0x70], 0x10
je 0x7fffb6db600e
xor ecx, ecx
cmp byte [rsp + 0x40], cl
je 0x7fffb6db5f9d
cmp word [rbp - 0x44], 0x2e
jne 0x7fffb6db5ed3
cmp edi, 1
je 0x7fffb6db5f9d
cmp edi, 2
jne 0x7fffb6db5ed3
cmp word [rbp - 0x42], 0x2e
je 0x7fffb6db5f9d
lea r8, [0x7fffb6de1474]
mov edx, 0x104
lea rcx, [rbp - 0x44]
call fcn.7fffb6db52f4
xor edx, edx
test eax, eax
jne 0x7fffb6db5f9d
mov rcx, qword [rbx + 0x10]
lea r13d, [rdi + 1]
mov qword [rsp + 0x70], rdx
mov edi, edx
test rcx, rcx
je 0x7fffb6db5f2b
mov r9d, r13d
lea r8, [rbp - 0x44]
lea rdx, [rsp + 0x70]
call fcn.7fffb6db1758
mov rdi, qword [rsp + 0x70]
test eax, eax
js 0x7fffb6db5f2b
test rdi, rdi
je 0x7fffb6db5f2b
test byte [rdi + 0x2c], 8
jne 0x7fffb6db5f98
lea rcx, [r13*2 + 0x20]
call qword [sym.imp.msvcrt.dll_malloc]
mov rsi, rax
xor eax, eax
test rsi, rsi
jne 0x7fffb6db5f60
mov edx, 0x10303
mov r8d, 0x8007000e
mov cl, 2
call fcn.7fffb6dc60a0
xor eax, eax
test rsi, rsi
je 0x7fffb6db60ca
mov qword [rsi], rax
lea edx, [r13 + 1]
mov eax, dword [rsp + 0x50]
lea rcx, [rsi + 0x18]
lea r8, [rbp - 0x44]
mov dword [rsi + 8], eax
mov qword [rsi + 0x10], rdi
call fcn.7fffb6dafd5c
xor ecx, ecx
test eax, eax
jne 0x7fffb6db60b3
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x60], rsi
mov qword [rax], rsi
mov esi, ecx
mov r13, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x48]
lea rdx, [rbp - 0x70]
mov rcx, r13
call qword [sym.imp.KernelBase.dll_FindNextFileW]
xor r9d, r9d
test eax, eax
jne 0x7fffb6db5df4
mov rcx, r13
call qword [sym.imp.KernelBase.dll_FindClose]
or r13, 0xffffffffffffffff
xor r9d, r9d
mov rdi, qword [rbx]
test rbx, rbx
je 0x7fffb6db5fde
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
xor r9d, r9d
mov rax, qword [rsp + 0x60]
mov rsi, r9
mov qword [rax], rdi
lea rax, [rsp + 0x58]
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x60], rax
test rbx, rbx
jne 0x7fffb6db5d3b
mov edi, r9d
jmp 0x7fffb6db6126
mov rcx, qword [rbx + 0x10]
xor eax, eax
mov qword [rsp + 0x78], rax
test rcx, rcx
je 0x7fffb6db6047
mov r9d, edi
lea r8, [rbp - 0x44]
lea rdx, [rsp + 0x78]
call fcn.7fffb6db1758
test eax, eax
js 0x7fffb6db6047
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x7fffb6db6047
test byte [rax + 0x2c], 8
jne 0x7fffb6db5f9d
mov r9d, edi
lea r8, [rbp - 0x44]
mov rdi, qword [rsp + 0x48]
lea rdx, [rbp - 0x80]
mov rcx, rdi
call fcn.7fffb6db097c
test eax, eax
js 0x7fffb6db5fa2
mov eax, dword [rbp - 0x50]
mov r9, r12
mov ecx, dword [rbp - 0x54]
mov r8d, dword [r15 + 8]
mov rdx, qword [rbp - 0x80]
shl rcx, 0x20
add rcx, rax
mov rax, qword [rbp - 0x5c]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov rcx, rdi
mov dword [rsp + 0x20], 0x80e8
call fcn.7fffb6db4150
mov edi, eax
xor ecx, ecx
mov rax, qword [rbp - 0x78]
mov word [r12 + rax*2], cx
test edi, edi
js 0x7fffb6db6126
jmp 0x7fffb6db5f9d
mov r8d, 0x8000ffff
mov edx, 0x2871f
mov cl, 2
mov edi, r8d
call fcn.7fffb6dc60a0
jmp 0x7fffb6db60cf
mov edi, 0x8007000e
mov r13, qword [rsp + 0x68]
jmp 0x7fffb6db6126
mov r8d, 0x8000ffff
mov edx, 0x2871e
jmp 0x7fffb6db611c
mov edx, 0x28723
jmp 0x7fffb6db6116
mov r8d, 0x8000ffff
mov edx, 0x2871d
jmp 0x7fffb6db611c
mov r8d, 0x8000ffff
mov edx, 0x28720
jmp 0x7fffb6db611c
mov r8d, 0x8000ffff
mov edx, 0x2871c
jmp 0x7fffb6db611c
mov edx, 0x28722
mov r8d, 0x80004004
mov cl, 2
mov edi, r8d
call fcn.7fffb6dc60a0
mov rcx, r12
call qword [sym.imp.msvcrt.dll_free]
xor r15d, r15d
test rsi, rsi
je 0x7fffb6db6148
mov rcx, rsi
jmp 0x7fffb6db6142
mov rcx, rbx
mov rbx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
test rbx, rbx
jne 0x7fffb6db613c
cmp qword [rsp + 0x58], r15
je 0x7fffb6db616f
mov rcx, qword [rsp + 0x58]
mov rbx, rcx
mov rbx, qword [rcx]
mov qword [rsp + 0x58], rbx
call qword [sym.imp.msvcrt.dll_free]
test rbx, rbx
jne 0x7fffb6db6154
cmp r13, 0xffffffffffffffff
je 0x7fffb6db617e
mov rcx, r13
call qword [sym.imp.KernelBase.dll_FindClose]
mov eax, edi
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.7fffb6dcff80
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret