Function at 0x1400087f0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
xor r15d, r15d
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], r15
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rcx + r8], r15b
jne 0x140008844
mov rdx, rcx
lea rcx, [rbp - 0x28]
call fcn.140006e20
nop
lea r8, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova r8, qword [rbp - 0x28]
add r8, qword [rbp - 0x18]
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova rdx, qword [rbp - 0x28]
lea rcx, [rbp + 0x18]
call fcn.140006670
nop
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 7
cmova rcx, qword [rbp + 0x18]
xor r9d, r9d
lea r8, [rbp + 0x1a0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], r15
lea rax, [rbp + 0x1a0]
mov rbx, r14
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400088c1
movabs rsi, 0x7ffffffffffffffe
cmp rbx, rsi
ja 0x140009265
movabs r12, 0x7fffffffffffffff
cmp rbx, 7
ja 0x14000891c
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], 7
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x1a0]
lea rcx, [rsp + 0x78]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x78], r15w
jmp 0x1400089b6
mov rax, rbx
or rax, 7
cmp rax, rsi
jbe 0x140008961
lea rcx, [r12 + r12]
cmp rcx, 0x1000
jb 0x140008987
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000925f
mov rcx, rax
call fcn.1400098d0
test rax, rax
je 0x14000915e
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000898f
mov ecx, 0xa
cmp rax, rcx
cmovb rax, rcx
mov rsi, rax
lea rcx, [rax + 1]
cmp rcx, r12
ja 0x14000925f
add rcx, rcx
jne 0x14000892c
mov rdi, r15
jmp 0x14000898f
call fcn.1400098d0
mov rdi, rax
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x1a0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r15w
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 7
cmova rdx, qword [rsp + 0x78]
mov rax, qword [rbp - 0x78]
lea rsi, [rdx + rax*2]
lea rbx, [rsp + 0x78]
cmova rbx, qword [rsp + 0x78]
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
movabs rcx, 0x8000000000000000
mov edx, 0x16
cmp rbx, rsi
jne 0x140008a0c
mov rbx, r15
mov qword [rbp - 0x58], rbx
mov eax, 0xf
mov qword [rbp - 0x50], rax
mov byte [rbp - 0x68], bl
jmp 0x140008b03
sub rsi, rbx
sar rsi, 1
mov qword [rbp - 0x58], r15
mov edi, 0xf
mov qword [rbp - 0x50], rdi
cmp rsi, r12
ja 0x14000926b
cmp rsi, rdi
jbe 0x140008ab2
mov rdi, rsi
or rdi, 0xf
cmp rdi, r12
jbe 0x140008a6e
mov rdi, r12
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.1400098d0
mov rcx, rax
test rax, rax
je 0x140009119
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x50], rdi
jmp 0x140008ab6
cmp rdi, rdx
cmovb rdi, rdx
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140008a8b
mov rax, r15
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x50], rdi
jmp 0x140008ab6
cmp rcx, 0x1000
jb 0x140008aa3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140009247
jmp 0x140008a44
call fcn.1400098d0
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x50], rdi
jmp 0x140008ab6
mov rax, qword [rbp - 0x68]
lea r8, [rbp - 0x68]
cmp rdi, 0xf
cmova r8, rax
mov rcx, r8
mov rdx, rsi
test rsi, rsi
je 0x140008ae3
nop dword [rax]
movzx eax, byte [rbx]
mov byte [rcx], al
lea rcx, [rcx + 1]
lea rbx, [rbx + 2]
sub rdx, 1
jne 0x140008ad0
mov qword [rbp - 0x58], rsi
mov byte [r8 + rsi], 0
mov rbx, qword [rbp - 0x58]
mov rax, qword [rbp - 0x50]
movabs rcx, 0x8000000000000000
mov edx, 0x16
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], r15
lea rdi, [rbp - 0x68]
cmp rax, 0xf
cmova rdi, qword [rbp - 0x68]
cmp rbx, r12
ja 0x140009271
cmp rbx, 0xf
ja 0x140008b52
mov qword [rbp + 8], rbx
mov r13d, 0xf
mov qword [rbp + 0x10], r13
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 8], xmm0
movq rsi, xmm0
mov qword [rsp + 0x20], rsi
jmp 0x140008be5
mov r13, rbx
or r13, 0xf
cmp r13, r12
jbe 0x140008b89
mov r13, r12
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.1400098d0
test rax, rax
je 0x140008e79
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsp + 0x20], rsi
mov qword [rsi - 8], rax
jmp 0x140008bc9
cmp r13, 0x16
cmovb r13, rdx
lea rcx, [r13 + 1]
test rcx, rcx
jne 0x140008ba4
mov rsi, r15
mov qword [rsp + 0x20], r15
jmp 0x140008bc9
cmp rcx, 0x1000
jb 0x140008bbc
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000924d
jmp 0x140008b65
call fcn.1400098d0
mov rsi, rax
mov qword [rsp + 0x20], rax
mov qword [rbp - 8], rsi
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], r13
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
nop
mov rax, r12
sub rax, rbx
cmp rax, 2
jb 0x140009277
lea r12, [rbp - 8]
cmp r13, 0xf
cmova r12, rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r15
lea r15, [rbx + 2]
mov edi, 0xf
lea rsi, [rsp + 0x28]
cmp r15, rdi
jbe 0x140008caf
mov rdi, r15
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
jbe 0x140008c70
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400098d0
test rax, rax
je 0x140008d29
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140008caa
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140008c8a
xor esi, esi
jmp 0x140008caa
cmp rcx, 0x1000
jb 0x140008ca2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140009253
jmp 0x140008c51
call fcn.1400098d0
mov rsi, rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], rdi
mov r8, rbx
mov rdx, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx ecx, word [0x14000ccf4]
mov word [rsi + rbx], cx
mov byte [rsi + r15], 0
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0xf
cmova rcx, qword [rsp + 0x28]
lea rdx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140008d35
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008d30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008d30
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400099dc
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], r15b
cmp rbx, 0xffffffffffffffff
je 0x140008e3a
test byte [rbp + 0x60], 0x10
je 0x140008e25
cmp byte [rbp + 0x8c], 0x2e
je 0x140008e25
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], r15
lea rax, [rbp + 0x8c]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x140008d85
lea rdx, [rbp + 0x8c]
lea rcx, [rbp - 0x48]
call fcn.140006e20
nop
lea rax, [rbp - 0x48]
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
cmova rax, rcx
mov r8, qword [rbp - 0x38]
cmp r8, 3
jb 0x140008dcf
cmp word [rax], 0x646a
jne 0x140008dcf
cmp byte [rax + 2], 0x6b
je 0x140008e80
lea rax, [rbp - 0x48]
cmp rdx, 0xf
cmova rax, rcx
cmp r8, 3
jb 0x140008df2
cmp word [rax], 0x726a
jne 0x140008df2
cmp byte [rax + 2], 0x65
je 0x140008e80
cmp rdx, 0xf
jbe 0x140008e25
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400090da
call fcn.1400099dc
lea rdx, [rbp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140008d55
mov r14, r15
cmp r13, 0xf
jbe 0x1400090e7
lea rdx, [r13 + 1]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400090e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400090e1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rsi, qword [rbp - 0x18]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 1
jb 0x140009241
lea r12, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova r12, qword [rbp - 0x28]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
lea r15, [rsi + 1]
mov edi, 0xf
lea rbx, [rsp + 0x48]
cmp r15, rdi
jbe 0x140008f53
mov rdi, r15
or rdi, 0xf
cmp rdi, rcx
jbe 0x140008f0d
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400098d0
test rax, rax
je 0x140008f3f
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140008f4e
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140008f27
xor ebx, ebx
jmp 0x140008f4e
cmp rcx, 0x1000
jb 0x140008f46
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140009259
jmp 0x140008ef2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400098d0
mov rbx, rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rdi
mov r8, rsi
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
movzx ecx, word [0x14000cb78]
mov byte [rbx + rsi], cl
mov byte [rbx + r15], 0
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova rdx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x38]
lea rcx, [rsp + 0x48]
call fcn.140006470
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rbp + 0x48], xmm0
xor r15d, r15d
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140009006
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ffc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008ffc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400099dc
movups xmm0, xmmword [rsp + 0x68]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
lea rbx, [rbp + 0x38]
mov rdi, qword [rsp + 0x28]
psrldq xmm0, 8
movq rsi, xmm0
cmp rsi, 0xf
cmova rbx, rdi
lea r14, [r14 + 1]
cmp byte [rbx + r14], 0
jne 0x140009034
lea rcx, [r14 + 1]
call fcn.140009a10
mov r14, rax
mov rcx, rax
sub rcx, rbx
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x140009051
cmp rsi, 0xf
jbe 0x14000909a
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140009091
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009091
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400099dc
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x140008e3d
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400090d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400090da
call fcn.1400099dc
jmp 0x140008e3d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400099dc
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140009126
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009120
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009120
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400099dc
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x14000916a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009165
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009165
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400099dc
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r15w
mov rdx, qword [rbp + 0x30]
cmp rdx, 7
jbe 0x1400091bf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400091ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400091ba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400099dc
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x30], 7
mov word [rbp + 0x18], r15w
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x14000920e
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009209
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009209
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400099dc
mov rax, r14
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.1400098b0
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011c0
nop
call fcn.140001120
nop
call fcn.140001120
nop
call fcn.140001120
nop
call fcn.140001120
nop
call fcn.140001120
int3
call fcn.1400011c0
nop
call fcn.1400011c0
nop
call fcn.1400011c0
nop
call fcn.1400011c0
int3