Function at 0x140093050
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x730
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x720], rax
mov qword [rsp + 0x58], r9
mov dword [rsp + 0x4c], r8d
mov esi, edx
xor r12d, r12d
mov r15d, r12d
mov dword [rsp + 0x34], r12d
lea rcx, [r11 - 0x6c8]
call fcn.14010312c
nop
call fcn.140102a14
mov rcx, rax
mov eax, r12d
test rcx, rcx
setne al
test eax, eax
jne 0x1400930cd
mov ecx, 0x80004005
call fcn.140005210
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
call fcn.140102a14
mov rcx, rax
mov eax, r12d
test rcx, rcx
setne al
test eax, eax
jne 0x1400930fc
mov ecx, 0x80004005
call fcn.140005210
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
call fcn.140102a14
mov rcx, rax
mov eax, r12d
test rcx, rcx
setne al
test eax, eax
jne 0x14009312b
mov ecx, 0x80004005
call fcn.140005210
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x28], rdi
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, rax
mov rax, qword [rax]
mov r8d, 0x104
lea rdx, [rsp + 0x510]
call qword [rax + 0xe8]
lea rcx, [rsp + 0x510]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rdx, str.InsDrv.ini
lea rcx, [rsp + 0x510]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, 3
je 0x1400931a9
cmp esi, 5
jne 0x1400931c7
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
mov rax, qword [rax]
call qword [rax + VarBstrFromDisp]
mov r13, rax
jmp 0x1400931c2
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x60]
mov r13, rax
test r13, r13
jne 0x140093235
lea rdx, [rdi - 0x18]
or r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400931e7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140093208
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
dec r14d
test r14d, r14d
jg 0x140093229
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
call fcn.140103194
xor eax, eax
jmp 0x140093b8f
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
lea rdi, [rsp + 0x510]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x1400932b5
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14009333e
cmp dword [rdx + 0x10], eax
jge 0x140093287
cmp dword [rbx - 0xc], eax
jge 0x14009327a
mov ecx, 0x80070057
call fcn.140005210
mov dword [rbx - 0x10], r12d
mov word [rbx], r12w
jmp 0x14009333e
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14009329e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
jmp 0x14009333e
mov r12d, dword [rbx - 0x10]
lea rsi, [rsp + 0x510]
sub rsi, rbx
sar rsi, 1
test ecx, ecx
jns 0x1400932d5
mov ecx, 0x80070057
call fcn.140005210
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400932f7
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.140005e40
mov rbx, qword [rsp + 0x20]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp rsi, r12
lea r12, [rax + rax]
mov r9, r12
ja 0x14009331b
lea r8, [rbx + rsi*2]
call fcn.1402457b4
jmp 0x140093328
lea r8, [rsp + 0x510]
call fcn.1402471ac
cmp edi, dword [rbx - 0xc]
jg 0x140093b77
mov dword [rbx - 0x10], edi
xor eax, eax
mov word [r12 + rbx], ax
xor r12d, r12d
xor eax, eax
mov rcx, r14
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, r13
lea rcx, [rsp + 0x28]
call fcn.140005d50
mov edx, 0x5c
mov rcx, rbx
call fcn.140249468
test rax, rax
jne 0x140093374
mov eax, r14d
jmp 0x14009337a
sub rax, rbx
sar rax, 1
mov r8d, eax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.14000d770
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400933ea
cmp dword [rbx + 0x10], 0
jl 0x1400933db
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400933db
call fcn.140006190
mov rdi, rax
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
dec eax
test eax, eax
jg 0x1400933d0
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x20], rax
jmp 0x1400933ea
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.140005d50
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140093410
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop dword [rax]
mov rbx, qword [rsp + 0x28]
cmp dword [rbx - 0x10], 0
jl 0x140093571
lea rdx, [0x1402f5b20]
mov rcx, rbx
call fcn.140245e24
test rax, rax
je 0x140093571
sub rax, rbx
sar rax, 1
test eax, eax
jne 0x140093571
lea edx, [rax + 0x5c]
mov rdi, qword [rsp + 0x20]
mov rcx, rdi
call fcn.140249468
test rax, rax
jne 0x14009345f
mov eax, r14d
jmp 0x140093465
sub rax, rdi
sar rax, 1
mov r8d, eax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x20]
call fcn.14000d770
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x1400934d2
cmp dword [rdi + 0x10], 0
jl 0x1400934c3
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400934c3
call fcn.140006190
mov rbx, rax
mov eax, r14d
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x1400934b8
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x20], rax
jmp 0x1400934d2
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.140005d50
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400934f2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 3
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.1400475a0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x28]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140093567
cmp dword [rdi + 0x10], 0
jl 0x140093558
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140093558
call fcn.140006190
mov rbx, rax
mov eax, r14d
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x14009354d
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x28], rax
jmp 0x140093567
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.140005d50
nop
mov rdx, qword [rsp + 0x68]
jmp 0x1400933f2
mov r9, rbx
mov rsi, qword [rsp + 0x20]
mov r8, rsi
lea rdx, [0x1402dd6b0]
lea rcx, [rsp + 0x300]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x300]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
xor eax, eax
mov rcx, r14
lea rdi, [rsp + 0x300]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x140093620
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x1400936a8
cmp dword [rdx + 0x10], eax
jge 0x1400935ed
cmp dword [rsi - 0xc], eax
jge 0x1400935e0
mov ecx, 0x80070057
call fcn.140005210
mov dword [rsi - 0x10], r12d
mov word [rsi], r12w
jmp 0x1400936a8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140093604
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x20], rsi
mov rbx, qword [rsp + 0x28]
jmp 0x1400936a8
mov r13d, dword [rsi - 0x10]
lea r12, [rsp + 0x300]
sub r12, rsi
sar r12, 1
test ecx, ecx
jns 0x140093640
mov ecx, 0x80070057
call fcn.140005210
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x140093662
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.140005e40
mov rsi, qword [rsp + 0x20]
movsxd rax, edi
movsxd rdx, dword [rsi - 0xc]
mov rcx, rsi
add rdx, rdx
cmp r12, r13
lea r13, [rax + rax]
mov r9, r13
ja 0x140093686
lea r8, [rsi + r12*2]
call fcn.1402457b4
jmp 0x140093693
lea r8, [rsp + 0x300]
call fcn.1402471ac
cmp edi, dword [rsi - 0xc]
jg 0x140093b6d
mov dword [rsi - 0x10], edi
xor r12d, r12d
mov word [r13 + rsi], r12w
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0xf0]
mov edx, eax
mov dword [rsp + 0x38], eax
mov eax, r12d
mov ecx, r12d
mov dword [rsp + 0x30], ecx
mov r13d, 1
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x3c], eax
cmp r13d, 8
ja 0x140093ad0
test edx, r13d
je 0x140093ac6
mov r15d, r12d
mov dword [rsp + 0x34], r12d
mov rcx, qword [rsi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rsi - 8], 0
jl 0x140093728
cmp rax, qword [rsi - 0x18]
jne 0x140093728
lea r12, [rsi - 0x18]
lock inc dword [rsi - 8]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
jmp 0x140093767
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rsi - 0x10]
call qword [rax]
mov r12, rax
test rax, rax
jne 0x140093743
call fcn.140020970
mov eax, dword [rsi - 0x10]
mov dword [r12 + 8], eax
mov eax, dword [rsi - 0x10]
inc eax
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rsi
add rdx, rdx
lea rcx, [r12 + 0x18]
call fcn.1402471ac
lea rax, [r12 + 0x18]
mov qword [rsp + 0x40], rax
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
mov rax, qword [rax]
mov edx, dword [rsp + 0x3c]
call qword [rax + pe_nt_image_headers64]
mov r12, rax
test rax, rax
jne 0x14009379a
mov ecx, eax
jmp 0x1400937ab
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.140005f90
mov eax, dword [rsp + 0x4c]
mov rdi, qword [rsp + 0x40]
test eax, eax
jle 0x14009381c
cmp dword [rdi - 0x10], eax
jl 0x140093808
mov rax, qword [rsp + 0x58]
mov dword [rax], 1
lea rdx, [rdi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400937f3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x30]
mov edx, dword [rsp + 0x38]
xor r12d, r12d
jmp 0x140093ad0
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx]
cmp eax, 1
mov edx, 0
cmovne eax, edx
mov dword [rcx], eax
mov rdx, rsi
lea rcx, [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, r12
lea rcx, [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x300]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rdx, [0x1402f35b0]
lea rcx, [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
je 0x140093a8e
mov eax, 1
xor ecx, ecx
mov r13d, ecx
test r15d, r15d
jne 0x140093a69
test eax, eax
je 0x140093a69
lea rdx, [0x1402e3994]
lea rcx, [rsp + 0xdc]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140093a53
lea rdx, [0x1402e3998]
lea rcx, [rsp + 0xdc]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140093a53
test byte [rsp + 0xb0], 0x10
je 0x14009398f
lea r8, [rsp + 0xdc]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.14003ffa0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14009395e
cmp dword [rbx + 0x10], r15d
jl 0x14009394f
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14009394f
call fcn.140006190
mov rdi, rax
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
dec eax
test eax, eax
jg 0x140093944
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x28], rax
jmp 0x14009395e
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.140005d50
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14009397e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x40]
jmp 0x140093a05
lea rcx, [rdi - 0x18]
lea r12, [rbx - 0x18]
cmp rcx, r12
je 0x1400939fd
cmp dword [r12 + 0x10], 0
jl 0x1400939e7
mov rax, qword [r12]
cmp qword [rcx], rax
jne 0x1400939e7
call fcn.140006190
mov rbx, rax
mov eax, r14d
lock xadd dword [r12 + 0x10], eax
dec eax
test eax, eax
jg 0x1400939d2
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rsp + 0x28], rbx
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x40]
jmp 0x1400939fd
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.140005d50
mov rbx, qword [rsp + 0x28]
inc r13d
mov r12, qword [rsp + 0x60]
cmp r13d, 2
jl 0x140093a30
xor eax, eax
test rbx, rbx
setne al
test eax, eax
jne 0x140093a21
mov ecx, 0x80004005
call fcn.140005210
mov rdx, rbx
mov rcx, rsi
call fcn.140247088
test eax, eax
je 0x140093a53
mov rcx, qword [0x1403b9758]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
mov rax, qword [rax]
mov rdx, rbx
call qword [rax + 0x3f8]
mov r15d, eax
mov dword [rsp + 0x34], eax
lea rdx, [rsp + 0xb0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x140093893
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
test r15d, r15d
jne 0x140093a7c
jmp 0x1400937d8
mov r13d, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x30]
or ecx, r13d
mov dword [rsp + 0x30], ecx
jmp 0x140093a92
mov ecx, dword [rsp + 0x30]
lea rdx, [rdi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140093ab1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ecx, dword [rsp + 0x30]
xor r12d, r12d
mov edx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x3c]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
add r13d, r13d
inc eax
jmp 0x1400936d7
test edx, edx
je 0x140093b0d
mov eax, dword [rsp + 0x780]
cmp ecx, edx
jne 0x140093af0
test eax, eax
je 0x140093af0
mov r15d, 1
mov dword [rsp + 0x34], r15d
jmp 0x140093b0d
test edx, ecx
je 0x140093b05
test eax, eax
jne 0x140093b05
mov r15d, 1
mov dword [rsp + 0x34], r15d
jmp 0x140093b0d
mov r15d, r12d
mov dword [rsp + 0x34], r12d
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140093b29
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140093b4a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
dec r14d
test r14d, r14d
jg 0x140093b6b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x140093b87
mov ecx, 0x80070057
call fcn.140005210
mov ecx, 0x80070057
call fcn.140005210
nop
mov r15d, dword [rsp + 0x34]
call fcn.140103194
mov eax, r15d
mov rcx, qword [rsp + 0x720]
xor rcx, rsp
call fcn.140245660
lea r11, [rsp + 0x730]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret