Function at 0x14003c6b0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x3a0], rbx
mov rax, qword [0x140299ac8]
xor rax, rsp
mov qword [rbp + 0x250], rax
mov rsi, rdx
mov rbx, rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
lea r8, [0x140243164]
lea rcx, [rsp + 0x28]
call fcn.140032c90
cmp qword [rax + 0x18], 8
jb 0x14003c71d
mov rax, qword [rax]
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov rdi, rax
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x14003c74a
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.140007b00
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r14w
cmp rdi, 0xffffffffffffffff
jne 0x14003c780
mov rcx, qword [rbp - 0x40]
mov qword [rbx], rcx
mov rcx, qword [rbp - 0x38]
mov qword [rbx + 8], rcx
mov rcx, qword [rbp - 0x30]
mov qword [rbx + 0x10], rcx
jmp 0x14003ca79
movabs r15, 0x7fffffffffffffff
nop word [rax + rax]
lea r8, [0x14023cad0]
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140032c90
nop
lea r8, [rbp + 0x2c]
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14003fb30
nop
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x14003c812
inc rax
mov rcx, qword [rsp + 0x48]
cmp rax, r15
ja 0x14003c9f9
add rax, rax
cmp rax, 0x1000
jb 0x14003c80d
test cl, 0x1f
jne 0x14003c9f3
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14003c9ed
sub rcx, rax
cmp rcx, 8
jb 0x14003c9e7
cmp rcx, 0x27
ja 0x14003c9e1
mov rcx, rax
call fcn.140193788
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r14w
test byte [rbp], 0x10
je 0x14003c88b
mov rax, qword [rbp - 0x10]
cmp rax, 8
jb 0x14003c9cb
inc rax
mov rcx, qword [rbp - 0x28]
cmp rax, r15
ja 0x14003ca17
add rax, rax
cmp rax, 0x1000
jb 0x14003c9c6
test cl, 0x1f
jne 0x14003ca11
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14003ca0b
sub rcx, rax
cmp rcx, 8
jb 0x14003ca05
cmp rcx, 0x27
ja 0x14003c9ff
jmp 0x14003c9c3
lea rax, [rsp + 0x68]
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r14w
mov r8d, 5
lea rdx, str..json
lea rcx, [rsp + 0x68]
call fcn.140006bd0
nop
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r14w
lea rax, [rbp + 0x2c]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14003c8e0
lea rdx, [rbp + 0x2c]
lea rcx, [rbp - 0x78]
call fcn.140006bd0
nop
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x78]
call fcn.14003cc10
test al, al
jne 0x14003c967
mov rax, qword [rbp - 0x10]
cmp rax, 8
jb 0x14003c9cb
inc rax
mov rcx, qword [rbp - 0x28]
cmp rax, r15
ja 0x14003ca35
add rax, rax
cmp rax, 0x1000
jb 0x14003c9c6
test cl, 0x1f
jne 0x14003ca2f
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14003ca29
sub rcx, rax
cmp rcx, 8
jb 0x14003ca23
cmp rcx, 0x27
ja 0x14003ca1d
jmp 0x14003c9c3
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x40]
call fcn.140040070
nop
mov rax, qword [rbp - 0x10]
cmp rax, 8
jb 0x14003c9cb
inc rax
mov rcx, qword [rbp - 0x28]
cmp rax, r15
ja 0x14003ca53
add rax, rax
cmp rax, 0x1000
jb 0x14003c9c6
test cl, 0x1f
jne 0x14003ca4d
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14003ca47
sub rcx, rax
cmp rcx, 8
jb 0x14003ca41
cmp rcx, 0x27
ja 0x14003ca3b
mov rcx, rax
call fcn.140193788
lea rdx, [rbp]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
je 0x14003ca59
jmp 0x14003c790
call fcn.1401a1868
int3
call fcn.1401a1868
int3
call fcn.1401a1868
int3
call fcn.1401a1868
int3
call fcn.1401a1868
nop
call fcn.1401a1868
int3
call fcn.1401a1868
int3
call fcn.1401a1868
int3
call fcn.1401a1868
int3
call fcn.1401a1868
int3
call fcn.1401a1868
int3
call fcn.1401a1868
int3
call fcn.1401a1868
int3
call fcn.1401a1868
int3
call fcn.1401a1868
int3
call fcn.1401a1868
int3
call fcn.1401a1868
int3
call fcn.1401a1868
int3
call fcn.1401a1868
int3
call fcn.1401a1868
int3
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
mov rax, qword [rbp - 0x40]
mov qword [rbx], rax
mov rax, qword [rbp - 0x38]
mov qword [rbx + 8], rax
mov rax, qword [rbp - 0x30]
mov qword [rbx + 0x10], rax
mov rax, rbx
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.1401938e0
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x360
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret