Function at 0x1400621e0
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
mov r11, rsp
push rbp
push rbx
push r12
push r13
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0xf0
mov rax, qword [0x14045d5f0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov qword [r11 + 0x18], rsi
lea r13, [0x1403b26dc]
mov qword [r11 - 0x30], rdi
mov r15, rdx
mov qword [r11 - 0x38], r14
mov rbx, rcx
xor r12d, r12d
movzx eax, byte [rbx]
test al, al
jne 0x1400623a1
cmp qword [rbx + 0x2d0], r12
je 0x14006259d
test al, al
jne 0x1400623a1
mov rcx, qword [rbx + 0x2d0]
mov rax, r12
add rcx, qword [rbx + 0x2c8]
mov rdx, qword [rbx + 0x2b0]
test rdx, rdx
je 0x140062268
mov rdx, qword [rdx]
test rdx, rdx
je 0x140062268
mov rax, qword [rdx]
lea r8, [rcx - 1]
test rax, rax
je 0x140062286
mov rcx, qword [rax]
test rcx, rcx
je 0x140062286
mov rax, qword [rcx]
test rax, rax
je 0x140062286
mov rdx, qword [rax]
jmp 0x140062289
mov rdx, r12
mov rax, qword [rdx + 0x10]
lea rcx, [rbx + 0x260]
mov rdx, qword [rdx + 8]
dec rax
and rax, r8
mov rdx, qword [rdx + rax*8]
call fcn.1400264a0
mov rax, qword [rbx + 0x2d0]
mov rcx, qword [rbx + 0x2c8]
dec rax
add rcx, rax
mov rax, qword [rbx + 0x2c0]
dec rax
and rcx, rax
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rax + rcx*8]
call fcn.140026350
sub qword [rbx + 0x2d0], 1
jne 0x1400622e9
mov qword [rbx + 0x2c8], r12
mov edx, dword [rbx + 0x2a8]
test edx, edx
je 0x140062315
cmp edx, 1
je 0x140062303
lea rcx, [rbp - 9]
call fcn.140026330
jmp 0x14006235d
mov qword [rbp - 0x79], r13
mov qword [rbp - 0x71], 1
movaps xmm0, xmmword [rbp - 0x79]
jmp 0x140062342
cmp qword [rbx + 0x2a0], 8
jb 0x140062328
mov rax, qword [rbx + 0x288]
jmp 0x14006232f
lea rax, [rbx + 0x288]
mov qword [rbp - 0x69], rax
mov rax, qword [rbx + 0x298]
mov qword [rbp - 0x61], rax
movaps xmm0, xmmword [rbp - 0x69]
lea r8, [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rbp - 9]
lea rcx, [rbx + 0x260]
call fcn.140026750
cmp qword [rbp + 0xf], 8
lea rcx, [rbp - 9]
lea rdi, [rbx + 4]
mov dword [rsp + 0x28], 2
cmovae rcx, qword [rbp - 9]
mov r8, rdi
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
lea rcx, [rbp - 9]
mov byte [rbx], 1
mov qword [rbx + 0x258], rax
call fcn.140026350
jmp 0x1400623d1
mov rcx, qword [rbx + 0x258]
lea rdi, [rbx + 4]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400623d1
mov rcx, qword [rbx + 0x258]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rbx + 0x258], 0xffffffffffffffff
cmp qword [rbx + 0x258], 0xffffffffffffffff
jne 0x140062405
mov byte [rbx], r12b
cmp dword [rbx + 0x2a8], r12d
jne 0x140062220
lea rcx, [rbx + 0x288]
mov r8d, 1
mov rdx, r13
call fcn.14000ef50
jmp 0x140062220
lea rcx, [rbx + 0x30]
mov qword [rbp - 0x59], rcx
test rcx, rcx
jne 0x140062417
mov rax, r12
jmp 0x140062430
cmp word [rcx], r12w
jne 0x140062422
mov rax, r12
jmp 0x140062430
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140062426
mov qword [rbp - 0x51], rax
lea rdx, [rsp + 0x30]
movaps xmm0, xmmword [rbp - 0x59]
lea rcx, [rbp - 0x49]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.1400262d0
lea rdx, [rbp - 0x49]
mov rcx, rbx
call fcn.140061c30
test al, al
je 0x14006246a
lea rcx, [rbp - 0x49]
call fcn.140026350
jmp 0x140062220
mov esi, dword [rdi]
lea rcx, [rbx + 0x260]
lea r8, [rbp - 0x49]
shr esi, 4
lea rdx, [rbp - 0x29]
call fcn.140026700
and sil, 1
je 0x14006253d
cmp byte [rbx + 0x280], r12b
je 0x14006253d
cmp qword [rbp - 0x11], 8
lea rcx, [rbp - 0x29]
cmovae rcx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xa
jb 0x14006253d
lea rdi, [rbx + 0x2b0]
mov rax, qword [rdi + 0x20]
inc rax
cmp qword [rdi + 0x10], rax
ja 0x1400624d9
mov edx, 1
mov rcx, rdi
call fcn.140062610
mov rax, qword [rdi + 0x10]
dec rax
and qword [rdi + 0x18], rax
mov rcx, qword [rdi + 0x20]
add rcx, qword [rdi + 0x18]
mov rax, qword [rdi + 0x10]
dec rax
and rcx, rax
mov rax, qword [rdi + 8]
lea r14, [rcx*8]
cmp qword [r14 + rax], r12
jne 0x140062523
mov ecx, 0x20
call fcn.1402dfa60
test rax, rax
je 0x1400625fc
mov rcx, qword [rdi + 8]
mov qword [r14 + rcx], rax
mov rax, qword [rdi + 8]
mov rcx, qword [r14 + rax]
test rcx, rcx
je 0x140062539
lea rdx, [rbp - 0x29]
call fcn.1400262a0
inc qword [rdi + 0x20]
movzx edx, sil
mov rcx, rbx
call fcn.140061c10
test al, al
je 0x140062586
mov ecx, dword [rbx + 0x2a8]
test ecx, ecx
je 0x1400625a7
cmp ecx, 1
jne 0x140062586
lea rdx, [rbx + 0x288]
cmp qword [rdx + 0x18], 8
jb 0x14006256d
mov rdx, qword [rdx]
cmp qword [rbp - 0x31], 8
lea rcx, [rbp - 0x49]
cmovae rcx, qword [rbp - 0x49]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
cmp eax, 1
je 0x1400625a7
lea rcx, [rbp - 0x29]
call fcn.140026350
lea rcx, [rbp - 0x49]
call fcn.140026350
jmp 0x140062220
mov rcx, r15
call fcn.140026330
jmp 0x1400625c5
lea rdx, [rbp - 0x29]
mov rcx, r15
call fcn.1400262a0
lea rcx, [rbp - 0x29]
call fcn.140026350
lea rcx, [rbp - 0x49]
call fcn.140026350
mov r14, qword [rsp + 0xe0]
mov rax, r15
mov rdi, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0x130]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1402e0100
add rsp, 0xf0
pop r15
pop r13
pop r12
pop rbx
pop rbp
ret
call fcn.1402e5d40
int3