Function at 0x140001220
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1e8]
sub rsp, 0x2b0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x1400530c0]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov r12, rdx
mov r14, rcx
mov qword [rbp - 0x10], rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbx
mov r15d, reloc.WS2_32.dll_ntohs
mov qword [rcx + 0x18], r15
mov byte [rcx], bl
mov edi, 1
mov dword [rsp + 0x20], edi
lea rcx, [rbp - 0x30]
call fcn.140003b00
nop
lea r8d, [rbx + 4]
lea rdx, str..
mov rcx, rax
call fcn.140003c20
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x28], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r15
mov byte [rax], bl
or edi, 2
mov dword [rsp + 0x24], edi
mov dword [rsp + 0x20], edi
mov rdx, qword [rbp - 0x18]
cmp rdx, r15
jbe 0x140001315
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001310
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001310
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003ede4
movdqa xmm0, xmmword [0x14004caa0]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova rcx, qword [rbp + 0x18]
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x68], rax
cmp rax, 0xffffffffffffffff
je 0x1400019eb
movabs rsi, 0x7fffffffffffffff
mov r13, 0xffffffffffffffff
mov r8d, reloc.WLDAP32.dll_Ordinal_22
movabs rdx, 0x8000000000000000
test byte [rbp + 0x40], 0x10
jne 0x1400013e2
lea rdx, str.browser.exe
lea rcx, [rbp + 0x6c]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14000172d
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
mov rbx, r13
inc rbx
cmp byte [r12 + rbx], 0
jne 0x1400013a1
cmp rbx, rsi
ja 0x140001a6c
mov qword [rsp + 0x60], r15
cmp rbx, 0xf
ja 0x140001749
mov qword [rsp + 0x58], rbx
mov r8, rbx
mov rdx, r12
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x48], 0
jmp 0x1400017e4
movzx ecx, byte [rbp + 0x6c]
movzx eax, byte [rbp + 0x6d]
cmp cl, 0x2e
jne 0x140001409
test al, al
je 0x14000172d
cmp cl, cl
jne 0x140001409
cmp al, cl
jne 0x140001409
cmp byte [rbp + 0x6e], 0
je 0x14000172d
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov rbx, r13
nop
inc rbx
cmp byte [r12 + rbx], 0
jne 0x140001420
cmp rbx, rsi
ja 0x140001a60
mov qword [rsp + 0x40], r15
cmp rbx, 0xf
ja 0x14000145d
mov qword [rsp + 0x38], rbx
mov r8, rbx
mov rdx, r12
lea rcx, [rsp + 0x28]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x28], 0
jmp 0x1400014f3
mov rdi, rbx
or rdi, 0xf
cmp rdi, rsi
jbe 0x140001472
mov rdi, rsi
lea rax, [rdx + 0x27]
jmp 0x140001494
cmp rdi, 0x16
cmovb rdi, r8
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1400014b3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001a72
mov rcx, rax
call fcn.14003eda0
test rax, rax
je 0x140001989
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400014c4
test rcx, rcx
je 0x1400014c2
call fcn.14003eda0
mov rsi, rax
jmp 0x1400014c4
xor esi, esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rdi
mov r8, rbx
mov rdx, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
movabs rsi, 0x7fffffffffffffff
mov edi, dword [rsp + 0x24]
mov r8d, 1
lea rdx, [0x14004c6e8]
lea rcx, [rsp + 0x28]
call fcn.140003c20
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xor ebx, ebx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r15
mov byte [rax], bl
or edi, 4
mov dword [rsp + 0x20], edi
lea rax, [rbp + 0x6c]
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x140001542
lea rdx, [rbp + 0x6c]
lea rcx, [rbp - 0x70]
call fcn.140003c20
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 8], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r15
mov byte [rax], 0
or edi, 8
mov dword [rsp + 0x24], edi
mov dword [rsp + 0x20], edi
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400015c8
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400015c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001990
call fcn.14003ede4
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], r15
mov byte [rbp - 0x70], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140001611
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000160c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001997
call fcn.14003ede4
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r15
mov byte [rsp + 0x28], 0
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova rdx, qword [rbp - 8]
lea r8, str.browser.exe
lea rcx, [rsp + 0x70]
call fcn.140001220
mov rbx, rax
cmp r14, rax
je 0x1400016a8
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x140001681
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x14000167c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000199e
mov rcx, r8
call fcn.14003ede4
xor eax, eax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], r15
mov byte [r14], al
movups xmm0, xmmword [rbx]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [r14 + 0x10], xmm1
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], r15
mov byte [rbx], al
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1400016e5
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000199e
call fcn.14003ede4
nop
mov rdx, qword [rbp + 0x10]
cmp qword [r14 + 0x10], 0
jne 0x1400019a5
cmp rdx, 0xf
jbe 0x14000172b
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001726
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400019d3
call fcn.14003ede4
xor ebx, ebx
lea rdx, [rbp + 0x40]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1400019df
jmp 0x14000135e
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x140001782
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14003eda0
test rax, rax
je 0x140001982
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400017bf
mov rsi, rax
cmp rax, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1400017ae
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001a66
jmp 0x140001763
test rcx, rcx
je 0x1400017bd
call fcn.14003eda0
mov rdi, rax
jmp 0x1400017bf
xor edi, edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov r8, rbx
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
mov edi, dword [rsp + 0x24]
mov r8d, 1
lea rdx, [0x14004c6e8]
lea rcx, [rsp + 0x48]
call fcn.140003c20
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r15
mov byte [rax], bl
or edi, 0x10
mov dword [rsp + 0x20], edi
lea rax, [rbp + 0x6c]
inc r13
cmp byte [rax + r13], 0
jne 0x140001832
mov r8, r13
lea rdx, [rbp + 0x6c]
lea rcx, [rsp + 0x70]
call fcn.140003c20
movups xmm6, xmmword [rax]
movups xmmword [rbp - 0x50], xmm6
movups xmm7, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm7
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r15
mov byte [rax], 0
lea rax, [rbp - 0x50]
cmp r14, rax
je 0x1400018b9
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x1400018a6
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x1400018a1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400018ec
mov rcx, r8
call fcn.14003ede4
mov byte [r14], 0
movups xmmword [r14], xmm6
movups xmmword [r14 + 0x10], xmm7
mov byte [rbp - 0x50], 0
jmp 0x1400018bd
mov r15, qword [rbp - 0x38]
cmp r15, 0xf
jbe 0x1400018f9
lea rdx, [r15 + 1]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400018f3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003ede4
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140001938
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001933
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001933
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003ede4
movdqa xmm0, xmmword [0x14004caa0]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x1400019df
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
cmp rdx, 0xf
jbe 0x1400019df
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003ede4
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x140001a29
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a24
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003ede4
mov rax, r14
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14003ed80
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140001200
int3
call fcn.140001160
int3
call fcn.140001200
int3
call fcn.140001160
int3