Function at 0x1400efc30
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push r12
push r13
push r14
push r15
mov eax, 0x50
call fcn.1402563a0
sub rsp, rax
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x1403bb2d8]
xor rax, rbp
mov qword [rbp], rax
mov rdi, rdx
mov rsi, rcx
test rcx, rcx
je 0x1400efe62
test rdx, rdx
je 0x1400efe62
call fcn.140256224
xor ebx, ebx
mov dword [rax], ebx
mov rcx, qword [rsi]
test rcx, rcx
jne 0x1400efef9
mov eax, ebx
mov rcx, rdi
cmp byte [rdi], al
je 0x1400efcb0
nop dword [rax]
cmp eax, 0x80000000
jae 0x1400efcb0
inc rcx
inc eax
cmp byte [rcx], bl
jne 0x1400efca0
mov r13d, eax
and r13d, 0x7fffffff
je 0x1400efee9
cmp r13, 0x7ffffffc
ja 0x1400efee9
mov ecx, 0x358
call fcn.140253f20
mov qword [rsi], rax
test rax, rax
jne 0x1400efcef
call fcn.140256224
mov dword [rax], reloc.WS2_32.dll_inet_ntoa
jmp 0x1400efe6d
xor edx, edx
mov r8d, 0x358
mov rcx, rax
call fcn.1402547c0
inc r13
mov r15d, 0xfde9
mov r8, rdi
xor edx, edx
mov r9d, r13d
mov ecx, r15d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r14d, eax
test eax, eax
jg 0x1400efe06
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
jne 0x1400efd59
mov r9d, r13d
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov r15d, ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r14d, eax
test r14d, r14d
jg 0x1400efe06
lea eax, [r13 + 2]
mov r14d, r13d
movsxd rcx, eax
add rcx, rcx
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x1400efd82
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1402563a0
sub rsp, rax
mov rcx, rbx
lea r12, [rsp + 0x40]
test r13, r13
je 0x1400efdb2
nop dword [rax + rax]
movsx eax, byte [rcx + rdi]
inc rcx
mov word [r12 + rcx*2 - 2], ax
cmp rcx, r13
jb 0x1400efda0
lea eax, [r14 - 1]
cdqe
add rax, rax
movzx ecx, word [rax + r12 - 2]
cmp cx, 0x2a
je 0x1400efec1
cmp cx, 0x2f
je 0x1400efe95
cmp cx, 0x5c
je 0x1400efe95
lea rcx, [0x14030cb80]
sub rax, rcx
lea rdx, [rax + r12]
nop dword [rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x1400efdf0
jmp 0x1400efec1
lea eax, [r14 + 2]
movsxd rcx, eax
add rcx, rcx
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x1400efe23
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1402563a0
sub rsp, rax
mov r9d, r13d
lea r12, [rsp + 0x40]
mov r8, rdi
xor edx, edx
mov ecx, r15d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1400efdb2
mov rcx, qword [rsi]
call fcn.1402540ac
mov qword [rsi], rbx
call fcn.140256224
mov dword [rax], reloc.WS2_32.dll_shutdown
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.140254f60
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, [0x14030cb7c]
sub rax, rdx
lea rcx, [rax + r12]
nop word [rax + rax]
movzx eax, word [rdx]
add rdx, 2
mov word [rcx + rdx - 2], ax
test ax, ax
jne 0x1400efeb0
mov rdx, qword [rsi]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, qword [rsi]
mov qword [rcx + 0x250], rax
mov rcx, qword [rsi]
cmp qword [rcx + 0x250], 0xffffffffffffffff
jne 0x1400eff11
jmp 0x1400efe5a
call fcn.140256224
mov dword [rax], 2
jmp 0x1400efe6d
mov rdx, rcx
mov rcx, qword [rcx + 0x250]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1400efe6d
mov rax, qword [rsi]
mov rdi, rbx
cmp word [rax + 0x2c], bx
lea r12, [rax + 0x2c]
je 0x1400eff34
cmp rdi, 0xff
jae 0x1400eff34
inc rdi
cmp word [r12 + rdi*2], bx
jne 0x1400eff21
mov qword [rsp + 0x38], rbx
add rax, 0x258
mov qword [rsp + 0x30], rbx
inc rdi
mov r8, r12
xor edx, edx
mov ecx, 0xfde9
mov r9d, edi
mov dword [rsp + 0x28], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1400eff87
test rdi, rdi
je 0x1400eff87
movzx eax, byte [r12 + rbx*2]
mov rcx, qword [rsi]
inc rbx
mov byte [rcx + rbx + 0x257], al
cmp rbx, rdi
jb 0x1400eff70
mov rax, qword [rsi]
mov byte [rax + 0x357], 0
mov rax, qword [rsi]
add rax, 0x258
jmp 0x1400efe6f