Function at 0x14003c6c0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x3a0], rbx
mov rax, qword [0x14029fbf8]
xor rax, rsp
mov qword [rbp + 0x250], rax
mov rsi, rdx
mov rbx, rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
lea r8, [0x140249704]
lea rcx, [rsp + 0x28]
call fcn.140032ca0
cmp qword [rax + 0x18], 8
jb 0x14003c72d
mov rax, qword [rax]
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov rdi, rax
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x14003c75a
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.140007b00
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r14w
cmp rdi, 0xffffffffffffffff
jne 0x14003c790
mov rcx, qword [rbp - 0x40]
mov qword [rbx], rcx
mov rcx, qword [rbp - 0x38]
mov qword [rbx + 8], rcx
mov rcx, qword [rbp - 0x30]
mov qword [rbx + 0x10], rcx
jmp 0x14003ca89
movabs r15, 0x7fffffffffffffff
nop word [rax + rax]
lea r8, [0x140243070]
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140032ca0
nop
lea r8, [rbp + 0x2c]
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14003fb40
nop
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x14003c822
inc rax
mov rcx, qword [rsp + 0x48]
cmp rax, r15
ja 0x14003ca09
add rax, rax
cmp rax, 0x1000
jb 0x14003c81d
test cl, 0x1f
jne 0x14003ca03
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14003c9fd
sub rcx, rax
cmp rcx, 8
jb 0x14003c9f7
cmp rcx, 0x27
ja 0x14003c9f1
mov rcx, rax
call fcn.1401998b8
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r14w
test byte [rbp], 0x10
je 0x14003c89b
mov rax, qword [rbp - 0x10]
cmp rax, 8
jb 0x14003c9db
inc rax
mov rcx, qword [rbp - 0x28]
cmp rax, r15
ja 0x14003ca27
add rax, rax
cmp rax, 0x1000
jb 0x14003c9d6
test cl, 0x1f
jne 0x14003ca21
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14003ca1b
sub rcx, rax
cmp rcx, 8
jb 0x14003ca15
cmp rcx, 0x27
ja 0x14003ca0f
jmp 0x14003c9d3
lea rax, [rsp + 0x68]
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r14w
mov r8d, 5
lea rdx, str..json
lea rcx, [rsp + 0x68]
call fcn.140006bd0
nop
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r14w
lea rax, [rbp + 0x2c]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14003c8f0
lea rdx, [rbp + 0x2c]
lea rcx, [rbp - 0x78]
call fcn.140006bd0
nop
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x78]
call fcn.14003cc20
test al, al
jne 0x14003c977
mov rax, qword [rbp - 0x10]
cmp rax, 8
jb 0x14003c9db
inc rax
mov rcx, qword [rbp - 0x28]
cmp rax, r15
ja 0x14003ca45
add rax, rax
cmp rax, 0x1000
jb 0x14003c9d6
test cl, 0x1f
jne 0x14003ca3f
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14003ca39
sub rcx, rax
cmp rcx, 8
jb 0x14003ca33
cmp rcx, 0x27
ja 0x14003ca2d
jmp 0x14003c9d3
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x40]
call fcn.140040080
nop
mov rax, qword [rbp - 0x10]
cmp rax, 8
jb 0x14003c9db
inc rax
mov rcx, qword [rbp - 0x28]
cmp rax, r15
ja 0x14003ca63
add rax, rax
cmp rax, 0x1000
jb 0x14003c9d6
test cl, 0x1f
jne 0x14003ca5d
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14003ca57
sub rcx, rax
cmp rcx, 8
jb 0x14003ca51
cmp rcx, 0x27
ja 0x14003ca4b
mov rcx, rax
call fcn.1401998b8
lea rdx, [rbp]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
je 0x14003ca69
jmp 0x14003c7a0
call fcn.1401a7998
int3
call fcn.1401a7998
int3
call fcn.1401a7998
int3
call fcn.1401a7998
int3
call fcn.1401a7998
nop
call fcn.1401a7998
int3
call fcn.1401a7998
int3
call fcn.1401a7998
int3
call fcn.1401a7998
int3
call fcn.1401a7998
int3
call fcn.1401a7998
int3
call fcn.1401a7998
int3
call fcn.1401a7998
int3
call fcn.1401a7998
int3
call fcn.1401a7998
int3
call fcn.1401a7998
int3
call fcn.1401a7998
int3
call fcn.1401a7998
int3
call fcn.1401a7998
int3
call fcn.1401a7998
int3
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
mov rax, qword [rbp - 0x40]
mov qword [rbx], rax
mov rax, qword [rbp - 0x38]
mov qword [rbx + 8], rax
mov rax, qword [rbp - 0x30]
mov qword [rbx + 0x10], rax
mov rax, rbx
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.140199a10
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x360
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret