Function at 0x140001470
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x1f8]
sub rsp, 0x2f0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14001d008]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov qword [rsp + 0x60], 7
xor edi, edi
mov qword [rsp + 0x58], rdi
mov word [rsp + 0x48], di
lea r8d, [rdi + 0x1a]
lea rdx, str.C:WindowsWebWallpaper
lea rcx, [rsp + 0x48]
call fcn.140001db0
nop
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
lea rdx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
movabs rsi, 0x7fffffffffffffff
cmp rax, 0xffffffffffffffff
jne 0x140001520
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Failed_to_find_the_first_file_in_the_directory
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140001698
test byte [rbp - 0x70], 0x10
jne 0x14000163c
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], rdi
mov word [rsp + 0x20], di
cmp word [rbp - 0x44], 0
jne 0x140001549
mov r8, rdi
jmp 0x14000155c
lea rax, [rbp - 0x44]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140001551
lea rdx, [rbp - 0x44]
lea rcx, [rsp + 0x20]
call fcn.140001db0
nop
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x68]
call fcn.140002490
nop
mov rax, qword [rsp + 0x38]
cmp rax, 8
jb 0x1400015d7
inc rax
mov rcx, qword [rsp + 0x20]
cmp rax, rsi
ja 0x14000166a
add rax, rax
cmp rax, 0x1000
jb 0x1400015d2
test cl, 0x1f
jne 0x140001664
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000165e
sub rcx, rax
cmp rcx, 8
jb 0x140001658
cmp rcx, 0x27
ja 0x140001652
mov rcx, rax
call fcn.140002f18
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], rdi
mov word [rsp + 0x20], di
lea rdx, [rsp + 0x68]
call fcn.140001a50
nop
mov rax, qword [rbp - 0x80]
cmp rax, 8
jb 0x14000163c
inc rax
mov rcx, qword [rsp + 0x68]
cmp rax, rsi
ja 0x140001688
add rax, rax
cmp rax, 0x1000
jb 0x140001637
test cl, 0x1f
jne 0x140001682
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000167c
sub rcx, rax
cmp rcx, 8
jb 0x140001676
cmp rcx, 0x27
ja 0x140001670
mov rcx, rax
call fcn.140002f18
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14000168e
jmp 0x140001520
call fcn.14000793c
int3
call fcn.14000793c
int3
call fcn.14000793c
int3
call fcn.14000793c
int3
call fcn.14000793c
nop
call fcn.14000793c
int3
call fcn.14000793c
int3
call fcn.14000793c
int3
call fcn.14000793c
int3
call fcn.14000793c
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x140001700
inc rax
mov rcx, qword [rsp + 0x48]
cmp rax, rsi
jbe 0x1400016b6
call fcn.14000793c
int3
add rax, rax
cmp rax, 0x1000
jb 0x1400016fb
test byte [rsp + 0x48], 0x1f
je 0x1400016ce
call fcn.14000793c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400016dd
call fcn.14000793c
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400016ec
call fcn.14000793c
int3
cmp rcx, 0x27
jbe 0x1400016f8
call fcn.14000793c
int3
mov rcx, rax
call fcn.140002f18
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.140002c10
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret