Function at 0x14007ead0
Capabilities:
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x5d8
movdqa xmmword [rsp + 0x5c0], xmm8
movdqa xmmword [rsp + 0x5b0], xmm7
movdqa xmmword [rsp + 0x5a0], xmm6
mov ebp, r9d
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14027c048]
xor rax, rsp
mov qword [rsp + 0x598], rax
lea rdi, [rsp + 0x498]
mov qword [rsp + 0x480], rdi
mov qword [rsp + 0x488], 0
mov qword [rsp + 0x490], 0x80
mov word [rsp + 0x250], 0x105
mov rax, qword [r8]
mov qword [rsp + 0x230], rax
mov rax, qword [r8 + 8]
mov qword [rsp + 0x238], rax
lea rdx, [rsp + 0x230]
lea r8, [rsp + 0x480]
mov r9d, 0x104
call fcn.14007c550
cmp dword [rsi], 0
je 0x14007ebd9
mov rcx, qword [rsp + 0x480]
cmp rcx, rdi
je 0x14007eb99
call qword [0x140276c98]
mov rcx, qword [rsp + 0x598]
xor rcx, rsp
call fcn.1401a5de0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x5a0]
movaps xmm7, xmmword [rsp + 0x5b0]
movaps xmm8, xmmword [rsp + 0x5c0]
add rsp, 0x5d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x488]
test rax, rax
je 0x14007ec13
mov rcx, qword [rsp + 0x480]
movzx edx, word [rcx + rax*2 - 2]
add edx, 0xffffffd1
cmp edx, 0x2d
ja 0x14007ee23
movabs r8, 0x200000000801
bt r8, rdx
jae 0x14007ee23
lea r8, [rax + 1]
cmp r8, qword [rsp + 0x490]
ja 0x14007ee61
add rax, rax
add rax, qword [rsp + 0x480]
mov word [rax], 0x2a
mov r8, qword [rsp + 0x488]
lea rax, [r8 + 1]
mov qword [rsp + 0x488], rax
add r8, 2
cmp r8, qword [rsp + 0x490]
ja 0x14007f120
mov rcx, qword [rsp + 0x480]
mov word [rcx + rax*2], 0
mov rcx, qword [rsp + 0x480]
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x230]
mov edx, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
cmp rax, 0xffffffffffffffff
je 0x14007ed3d
mov r15, rax
mov byte [rsp + 0x3f], bpl
mov rbp, rbx
lea r12, [rsp + 0x25c]
mov rcx, r12
call qword [0x140276d20]
lea r13, [rsp + 0x230]
mov rdi, qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rbx, qword [0x140276d20]
nop word cs:[rax + rax]
movzx ecx, word [rsp + 0x25c]
cmp rax, 1
jne 0x14007ecf4
cmp cx, 0x2e
je 0x14007ed0b
cmp rax, 2
jne 0x14007ed52
cmp cx, 0x2e
jne 0x14007ed52
cmp word [rsp + 0x25e], 0x2e
jne 0x14007ed52
mov rcx, r15
mov rdx, r13
call rdi
test eax, eax
je 0x14007ed1e
mov rcx, r12
call rbx
jmp 0x14007ece0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
cmp eax, 0x12
jne 0x14007ee17
mov rdx, rbp
call fcn.14007f1b0
jmp 0x14007f100
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edx, eax
call fcn.14008e840
jmp 0x14007eb86
lea r13, [rsp + 0x1b0]
mov qword [rsp + 0x198], r13
mov qword [rsp + 0x1a0], 0
mov qword [rsp + 0x1a8], 0x80
mov rcx, r12
call qword [0x140276d20]
lea rcx, [rsp + 0x198]
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov edx, 0xfde9
mov r8, r12
mov r9, rax
call fcn.140080500
cmp dword [rsi], 0
jne 0x14007f0ed
mov qword [rbp], r15
mov r12, qword [r14]
mov r15, qword [r14 + 8]
lea r14, [rsp + 0x118]
mov qword [rsp + 0x100], r14
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0x80
cmp r15, 0x81
jb 0x14007ee84
lea rcx, [rsp + 0x100]
mov r9d, 1
mov rdx, r14
mov r8, r15
call fcn.1400218c0
mov rax, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x108]
jmp 0x14007ee8e
mov edx, eax
call fcn.14008e840
jmp 0x14007f100
lea r8, [rax + 1]
cmp r8, qword [rsp + 0x490]
ja 0x14007f143
mov word [rcx + rax*2], 0x5c
mov r8, qword [rsp + 0x488]
lea rax, [r8 + 1]
mov qword [rsp + 0x488], rax
add r8, 2
cmp r8, qword [rsp + 0x490]
jbe 0x14007ec25
lea rcx, [rsp + 0x480]
mov r9d, 2
mov rdx, rdi
call fcn.1400218c0
mov rax, qword [rsp + 0x488]
jmp 0x14007ec25
xor ecx, ecx
mov rax, r14
test r15, r15
je 0x14007eea4
add rcx, rax
mov rdx, r12
mov r8, r15
call fcn.1401a77b0
mov rcx, qword [rsp + 0x108]
add rcx, r15
mov qword [rsp + 0x108], rcx
mov word [rsp + 0xd8], 0x101
mov word [rsp + 0xb0], 0x101
mov word [rsp + 0x88], 0x101
mov word [rsp + 0x60], 0x105
movups xmm0, xmmword [rsp + 0x198]
movups xmmword [rsp + 0x40], xmm0
lea r15, [rsp + 0xb8]
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x100]
lea r8, [rsp + 0x40]
lea r9, [rsp + 0x68]
xor edx, edx
call fcn.140077af0
pshufd xmm6, xmmword [rsp + 0x230], 0x50
mov word [rsp + 0xb0], 0x105
movups xmm0, xmmword [rsp + 0x100]
movups xmmword [rsp + 0x90], xmm0
movdqu xmm0, xmmword [rsp + 0x23c]
pshufd xmm7, xmm0, 0xb1
movq xmm8, qword [rsp + 0x24c]
lea rcx, [rsp + 0x90]
mov rdx, r15
call fcn.1400765d0
movzx eax, byte [rsp + 0x3f]
mov byte [rsp + 0xdc], al
movdqu xmmword [rsp + 0xe0], xmm7
pand xmm6, xmmword [0x14023d190]
pxor xmm0, xmm0
pcmpeqd xmm0, xmm6
movdqa xmm1, xmm0
pandn xmm1, xmmword [0x14023d1a0]
pand xmm0, xmmword [0x14023d1b0]
por xmm0, xmm1
punpcklqdq xmm8, xmm0
movdqu xmmword [rsp + 0xf0], xmm8
movd dword [rsp + 0xd8], xmm0
lea r12, [rbp + 8]
cmp r12, r15
je 0x14007f038
mov rax, qword [rbp + 0x20]
cmp rax, 0x10
jb 0x14007effd
mov rcx, qword [r12]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14007eff8
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14007f1a4
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1401a5ac8
movups xmm0, xmmword [rsp + 0xb8]
movups xmm1, xmmword [rsp + 0xc8]
movups xmmword [r12 + 0x10], xmm1
movups xmmword [r12], xmm0
mov rax, qword [r15 + 0x40]
mov qword [rbp + 0x48], rax
movdqu xmm0, xmmword [r15 + 0x20]
movdqu xmm1, xmmword [r15 + 0x30]
movdqu xmmword [rbp + 0x38], xmm1
movdqu xmmword [rbp + 0x28], xmm0
jmp 0x14007f09d
mov rax, qword [rsp + 0xd0]
mov rcx, qword [r15 + 0x40]
mov qword [rbp + 0x48], rcx
movdqu xmm0, xmmword [r15 + 0x20]
movdqu xmm1, xmmword [r15 + 0x30]
movdqu xmmword [rbp + 0x38], xmm1
movdqu xmmword [rbp + 0x28], xmm0
cmp rax, 0x10
jb 0x14007f09d
mov rcx, qword [rsp + 0xb8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14007f098
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14007f1a4
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1401a5ac8
mov dword [rsi], 0
mov eax, dword [0x1402b90c0]
mov ecx, dword [0x1402b92f8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007f16e
lea rax, [0x14027b498]
mov qword [rsi + 8], rax
mov rcx, qword [rsp + 0x100]
cmp rcx, r14
je 0x14007f0e6
call qword [0x140276c98]
mov r15, 0xffffffffffffffff
mov rcx, qword [rsp + 0x198]
cmp rcx, r13
je 0x14007f100
call qword [0x140276c98]
lea rdi, [rsp + 0x498]
cmp r15, 0xffffffffffffffff
je 0x14007eb86
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x14007eb86
lea rcx, [rsp + 0x480]
mov r9d, 2
mov rdx, rdi
call fcn.1400218c0
mov rax, qword [rsp + 0x488]
jmp 0x14007ec5b
lea rcx, [rsp + 0x480]
mov r9d, 2
mov rdx, rdi
call fcn.1400218c0
mov rcx, qword [rsp + 0x480]
mov rax, qword [rsp + 0x488]
jmp 0x14007ee35
lea rcx, [0x1402b90c0]
call fcn.1401a5bcc
cmp dword [0x1402b90c0], 0xffffffff
jne 0x14007f0c8
lea rcx, [fcn.140005fc0]
call fcn.1401a5e00
lea rcx, [0x1402b90c0]
call fcn.1401a5c34
jmp 0x14007f0c8
call qword [0x140276bc8]
int3