Function at 0x140012490
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x8e0]
sub rsp, 0x9e0
mov rax, qword [0x14009c020]
xor rax, rsp
mov qword [rbp + 0x8d0], rax
mov rdi, rcx
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp + 0x420]
call fcn.14004b2f0
nop
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], rax
lea r15, [0x14009cc90]
mov qword [rsp + 0x78], r15
mov word [rbp - 0x68], 0
mov dword [rbp - 0x60], 0xabcd
mov dword [rbp - 0x54], 0xabcd
lea rax, [rsp + 0x78]
mov qword [rbp - 0x5c], rax
mov dword [rbp + 0x1ba], 0xabcd
lea rax, [rbp - 0x50]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x78], 0x104
mov qword [rbp - 0x70], 0x104
xor esi, esi
mov qword [rbp - 0x80], rsi
mov word [rbp - 0x50], si
lea rax, [rbp - 0x50]
mov qword [rsp + 0x68], rax
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140007410
nop
lea rcx, [rsp + 0x60]
call fcn.140006480
lea rbx, str.postrestart
mov r8, qword [rsp + 0x60]
test r8, r8
je 0x1400125c0
mov rcx, qword [r8 - 0xc]
test rcx, rcx
je 0x1400125c0
mov rdx, qword [rcx + 8]
test rdx, rdx
je 0x1400125c0
movsxd rax, edx
dec rax
cmp rax, qword [rcx + 0x10]
ja 0x140012e1b
cmp word [r8 + rax*2], 0x5c
je 0x1400125c0
movsxd rax, edx
dec rax
cmp rax, qword [rcx + 0x10]
ja 0x140012e1b
cmp word [r8 + rax*2], 0x2f
je 0x1400125c0
lea edx, [rsi + 0x5c]
lea rcx, [rsp + 0x60]
call fcn.140006fb0
nop dword [rax + rax]
movzx eax, word [rbx]
cmp ax, 0x5c
je 0x1400125cf
cmp ax, 0x2f
jne 0x1400125d5
add rbx, 2
jmp 0x1400125c0
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140007130
lea rbx, str..bd_
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x140012642
mov rcx, qword [rdx - 0xc]
test rcx, rcx
je 0x140012642
mov r8, qword [rcx + 8]
test r8, r8
je 0x140012642
movsxd rax, r8d
dec rax
cmp rax, qword [rcx + 0x10]
ja 0x140012e1b
cmp word [rdx + rax*2], 0x5c
je 0x140012642
movsxd rax, r8d
dec rax
cmp rax, qword [rcx + 0x10]
ja 0x140012e1b
cmp word [rdx + rax*2], 0x2f
je 0x140012642
mov edx, 0x5c
lea rcx, [rsp + 0x60]
call fcn.140006fb0
movzx eax, word [rbx]
cmp ax, 0x5c
je 0x140012651
cmp ax, 0x2f
jne 0x140012657
add rbx, 2
jmp 0x140012642
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140007130
lea r14, [0x14008d480]
mov rcx, r14
mov rax, qword [rsp + 0x60]
test rax, rax
cmovne rcx, rax
lea rdx, [rbp + 0x420]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x1400126a6
lea edx, [rcx + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140007630
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov rcx, rsi
mov rax, qword [rsp + 0x60]
cmp word [rax], si
je 0x1400126ca
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1400126c0
test rax, rax
je 0x1400126de
mov rdx, qword [rax - 0xc]
test rdx, rdx
je 0x1400126de
mov r8, qword [rdx + 0x10]
jmp 0x1400126e1
mov r8, rsi
cmp rcx, r8
ja 0x140012e1b
test rax, rax
je 0x1400126f5
mov rdx, qword [rax - 0xc]
jmp 0x1400126f8
mov rdx, rsi
mov qword [rdx + 8], rcx
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001273b
mov rax, qword [rcx - 0xc]
test rax, rax
je 0x14001273b
cmp dword [rcx - 0x10], 0xabcd
jne 0x140012e1b
cmp dword [rcx - 4], 0xabcd
jne 0x140012e1b
mov rax, qword [rax + 0x10]
cmp dword [rcx + rax*2 + 2], 0xabcd
jne 0x140012e1b
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov ecx, 0x280
call fcn.140048438
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x38], rax
cmp rbx, 0xffffffffffffffff
je 0x14001294a
nop
test byte [rbp + 0x420], 0x10
jne 0x140012929
mov byte [rsp + 0x30], 0
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x44c]
lea rdx, str.postrestart
mov rcx, rdi
call fcn.14000ef70
test al, al
jne 0x140012929
cmp byte [rsp + 0x30], al
jne 0x140012929
lea rax, [rbp + 0x1e0]
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x1d8], r15
mov word [rbp + 0x1f8], 0
mov dword [rbp + 0x200], 0xabcd
mov dword [rbp + 0x20c], 0xabcd
lea rax, [rbp + 0x1d8]
mov qword [rbp + 0x204], rax
mov dword [rbp + 0x41a], 0xabcd
lea rax, [rbp + 0x210]
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x1e8], 0x104
mov qword [rbp + 0x1f0], 0x104
mov qword [rbp + 0x1e0], rsi
mov word [rbp + 0x210], si
lea rax, [rbp + 0x210]
mov qword [rbp + 0x1c8], rax
mov r8, 0xffffffffffffffff
lea rdx, [rbp + 0x44c]
lea rcx, [rbp + 0x1c0]
call fcn.140007510
test al, al
je 0x140012e25
mov rcx, qword [rbp + 0x1c0]
test rcx, rcx
je 0x14001289c
mov rax, qword [rcx - 0xc]
test rax, rax
je 0x14001289c
cmp dword [rcx - 0x10], 0xabcd
jne 0x140012e25
cmp dword [rcx - 4], 0xabcd
jne 0x140012e25
mov rax, qword [rax + 0x10]
cmp dword [rcx + rax*2 + 2], 0xabcd
jne 0x140012e25
test rcx, rcx
je 0x1400128e9
call fcn.140056b9c
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x1400128e9
mov rax, qword [rdx - 0xc]
test rax, rax
je 0x1400128ec
cmp dword [rdx - 0x10], 0xabcd
jne 0x140012e07
cmp dword [rdx - 4], 0xabcd
jne 0x140012e07
mov rax, qword [rax + 0x10]
cmp dword [rdx + rax*2 + 2], 0xabcd
jne 0x140012e07
jmp 0x1400128ec
mov rdx, r14
lea rcx, [rbp + 0x670]
call fcn.140006700
nop
lea r8, [rbp + 0x670]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.140015bf0
nop
lea rcx, [rbp + 0x670]
call fcn.140006d00
nop
lea rcx, [rbp + 0x1c0]
call fcn.140006d00
lea rdx, [rbp + 0x420]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140012770
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x60]
call fcn.140006480
lea rbx, str.postrestart
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400129b4
mov rdx, qword [rcx - 0xc]
test rdx, rdx
je 0x1400129b4
mov r8, qword [rdx + 8]
test r8, r8
je 0x1400129b4
movsxd rax, r8d
dec rax
cmp rax, qword [rdx + 0x10]
ja 0x140012dfd
cmp word [rcx + rax*2], 0x5c
je 0x1400129b4
movsxd rax, r8d
dec rax
cmp rax, qword [rdx + 0x10]
ja 0x140012dfd
cmp word [rcx + rax*2], 0x2f
je 0x1400129b4
mov edx, 0x5c
lea rcx, [rsp + 0x60]
call fcn.140006fb0
movzx eax, word [rbx]
cmp ax, 0x5c
je 0x1400129c3
cmp ax, 0x2f
jne 0x1400129c9
add rbx, 2
jmp 0x1400129b4
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140007130
lea rbx, str..gpx
mov r8, qword [rsp + 0x60]
test r8, r8
je 0x140012a40
mov rcx, qword [r8 - 0xc]
test rcx, rcx
je 0x140012a40
mov r9, qword [rcx + 8]
test r9, r9
je 0x140012a40
movsxd rax, r9d
dec rax
cmp rax, qword [rcx + 0x10]
ja 0x140012dfd
cmp word [r8 + rax*2], 0x5c
je 0x140012a40
movsxd rax, r9d
dec rax
cmp rax, qword [rcx + 0x10]
ja 0x140012dfd
cmp word [r8 + rax*2], 0x2f
je 0x140012a40
mov edx, 0x5c
lea rcx, [rsp + 0x60]
call fcn.140006fb0
nop dword [rax + rax]
movzx eax, word [rbx]
cmp ax, 0x5c
je 0x140012a4f
cmp ax, 0x2f
jne 0x140012a55
add rbx, 2
jmp 0x140012a40
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140007130
mov rcx, r14
mov rax, qword [rsp + 0x60]
test rax, rax
cmovne rcx, rax
lea rdx, [rbp + 0x420]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x140012a9d
lea edx, [rcx + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140007630
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov rcx, rsi
mov rdx, qword [rsp + 0x60]
cmp word [rdx], si
je 0x140012aba
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x140012ab0
test rdx, rdx
je 0x140012ace
mov rax, qword [rdx - 0xc]
test rax, rax
je 0x140012ace
mov r8, qword [rax + 0x10]
jmp 0x140012ad1
mov r8, rsi
cmp rcx, r8
ja 0x140012dfd
test rdx, rdx
je 0x140012ae5
mov rax, qword [rdx - 0xc]
jmp 0x140012ae8
mov rax, rsi
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140012b2b
mov rax, qword [rcx - 0xc]
test rax, rax
je 0x140012b2b
cmp dword [rcx - 0x10], 0xabcd
jne 0x140012dfd
cmp dword [rcx - 4], 0xabcd
jne 0x140012dfd
mov rax, qword [rax + 0x10]
cmp dword [rcx + rax*2 + 2], 0xabcd
jne 0x140012dfd
cmp rbx, 0xffffffffffffffff
je 0x140012d1a
nop word [rax + rax]
test byte [rbp + 0x420], 0x10
jne 0x140012cf9
mov byte [rsp + 0x30], 0
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x44c]
lea rdx, str.postrestart
mov rcx, rdi
call fcn.14000ef70
test al, al
jne 0x140012cf9
cmp byte [rsp + 0x30], al
jne 0x140012cf9
lea rax, [rbp + 0x1e0]
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x1d8], r15
mov word [rbp + 0x1f8], 0
mov dword [rbp + 0x200], 0xabcd
mov dword [rbp + 0x20c], 0xabcd
lea rax, [rbp + 0x1d8]
mov qword [rbp + 0x204], rax
mov dword [rbp + 0x41a], 0xabcd
lea rax, [rbp + 0x210]
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x1e8], 0x104
mov qword [rbp + 0x1f0], 0x104
mov qword [rbp + 0x1e0], rsi
mov word [rbp + 0x210], si
lea rax, [rbp + 0x210]
mov qword [rbp + 0x1c8], rax
mov r8, 0xffffffffffffffff
lea rdx, [rbp + 0x44c]
lea rcx, [rbp + 0x1c0]
call fcn.140007510
test al, al
je 0x140012e2f
mov rcx, qword [rbp + 0x1c0]
test rcx, rcx
je 0x140012c6c
mov rax, qword [rcx - 0xc]
test rax, rax
je 0x140012c6c
cmp dword [rcx - 0x10], 0xabcd
jne 0x140012e2f
cmp dword [rcx - 4], 0xabcd
jne 0x140012e2f
mov rax, qword [rax + 0x10]
cmp dword [rcx + rax*2 + 2], 0xabcd
jne 0x140012e2f
test rcx, rcx
je 0x140012cb9
call fcn.140056b9c
mov rdx, qword [rbp + 0x1c0]
test rdx, rdx
je 0x140012cb9
mov rax, qword [rdx - 0xc]
test rax, rax
je 0x140012cbc
cmp dword [rdx - 0x10], 0xabcd
jne 0x140012e11
cmp dword [rdx - 4], 0xabcd
jne 0x140012e11
mov rax, qword [rax + 0x10]
cmp dword [rdx + rax*2 + 2], 0xabcd
jne 0x140012e11
jmp 0x140012cbc
mov rdx, r14
lea rcx, [rbp + 0x670]
call fcn.140006700
nop
lea r8, [rbp + 0x670]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.140015bf0
nop
lea rcx, [rbp + 0x670]
call fcn.140006d00
nop
lea rcx, [rbp + 0x1c0]
call fcn.140006d00
lea rdx, [rbp + 0x420]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140012b40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140012dba
nop dword [rax + rax]
mov rax, qword [rbx + 0x20]
mov r8, r14
test rax, rax
cmovne r8, rax
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea rdx, str.postrestart
mov rcx, rdi
call fcn.14000f210
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140012d88
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140012d83
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x140012d83
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140012d70
mov rbx, rax
jmp 0x140012daf
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x140012daf
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140012da0
cmp rbx, qword [rsp + 0x38]
jne 0x140012d30
lea rcx, [rsp + 0x38]
call fcn.140014c00
nop
lea rcx, [rsp + 0x60]
call fcn.140006d00
xor eax, eax
mov rcx, qword [rbp + 0x8d0]
xor rcx, rsp
call fcn.140048410
lea r11, [rsp + 0x9e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
int3