Function at 0x140099ac0
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2c8]
sub rsp, 0x3a0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rbp + 0x290], rax
mov r13, rcx
xor ebx, ebx
mov edi, ebx
mov dword [rsp + 0x30], ebx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x1401e3030]
movdqu xmmword [rbp + 0x30], xmm1
mov word [rbp + 0x20], bx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7d8
mov rcx, qword [rcx + 8]
call fcn.14000fa00
lea r9, [rax - 0x104]
mov qword [rsp + 0x20], rax
mov r8d, 0x105
lea rdx, [rbp + 0x40]
mov rcx, qword [r13 + 8]
call fcn.140111510
lea rax, [rbp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140013d72
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.140006d60
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], rbx
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], 7
mov word [rbp - 0x20], bx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1401e3030]
movdqu xmmword [rbp + 0x10], xmm1
mov word [rbp], bx
lea r8, [rbp]
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x20]
call fcn.140011d10
test al, al
je 0x1400142c5
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bx
lea rdx, [rbp]
lea rcx, [rsp + 0x60]
call fcn.1400118c0
nop
lea r8, [0x1401e42d0]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x40]
call fcn.140001cb0
nop
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400141ca
mov r15d, ebx
nop
inc r15d
cmp r15d, 0x7d0
ja 0x1400140cd
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], bx
lea rax, [rbp + 0x6c]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140013e73
lea rdx, [rbp + 0x6c]
lea rcx, [rbp - 0x60]
call fcn.140006d60
nop
or edi, 1
mov dword [rsp + 0x30], edi
lea r8, [rbp - 0x60]
mov rsi, qword [rbp - 0x60]
mov r14, qword [rbp - 0x48]
cmp r14, 8
cmovae r8, rsi
cmp qword [rbp - 0x50], 1
jne 0x140013ee3
mov edx, 1
lea rax, [0x1401e3cd0]
mov rcx, rax
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140013ee3
add rcx, 2
sub rdx, 1
jne 0x140013ec0
mov r10, qword [rbp - 0x68]
mov r9, qword [rbp - 0x80]
mov bl, 1
jmp 0x140013f7a
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], bx
lea rax, [rbp + 0x6c]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140013f10
lea rdx, [rbp + 0x6c]
lea rcx, [rbp - 0x80]
call fcn.140006d60
nop
or edi, 2
mov dword [rsp + 0x30], edi
lea r8, [rbp - 0x80]
mov r9, qword [rbp - 0x80]
mov r10, qword [rbp - 0x68]
cmp r10, 8
cmovae r8, r9
cmp qword [rbp - 0x70], 2
jne 0x140013f78
mov edx, 2
lea rax, [0x1401e42d8]
mov rcx, rax
sub r8, rax
nop dword [rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140013f78
add rcx, 2
sub rdx, 1
jne 0x140013f60
mov bl, 1
jmp 0x140013f7a
xor bl, bl
test dil, 2
je 0x140013fd4
and edi, 0xfffffffd
mov dword [rsp + 0x30], edi
cmp r10, 8
jb 0x140013fc2
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x140013fba
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400143ef
mov rcx, r9
call fcn.14017f5e4
xor eax, eax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], ax
test dil, 1
je 0x14001402e
and edi, 0xfffffffe
mov dword [rsp + 0x30], edi
cmp r14, 8
jb 0x14001401c
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140014014
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400143f5
mov rcx, rsi
call fcn.14017f5e4
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], ax
test bl, bl
jne 0x1400140b6
cmp qword [rsp + 0x50], 0
je 0x140014055
mov r8d, 1
lea rdx, [0x1401e2760]
lea rcx, [rsp + 0x40]
call fcn.140006a90
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.140006a90
lea rax, [rbp + 0x6c]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140014080
lea rdx, [rbp + 0x6c]
lea rcx, [rsp + 0x40]
call fcn.140006a90
test byte [rbp + 0x40], 0x10
je 0x1400140b6
mov r8d, 1
lea rdx, [0x1401e42c8]
lea rcx, [rsp + 0x40]
call fcn.140006a90
lea rdx, [rbp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor ebx, ebx
test eax, eax
jne 0x140013e40
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x140014117
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014112
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400143e9
call fcn.14017f5e4
movdqa xmm0, xmmword [0x1401e3030]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], bx
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14001416a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014165
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400143fb
call fcn.14017f5e4
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], bx
xor r9d, r9d
mov edx, 0x83a
lea r8d, [r9 + 0xa]
mov rcx, qword [r13 + 8]
call fcn.14000fa00
xor r9d, r9d
mov edx, 0x843
lea r8d, [r9 + 1]
mov rcx, qword [r13 + 8]
call fcn.14000fa00
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r8, qword [rsp + 0x40]
mov rdx, qword [rbp - 0x10]
mov rcx, qword [r13 + 8]
call fcn.14011a3b0
jmp 0x140014270
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14001420a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014205
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014401
call fcn.14017f5e4
movdqa xmm0, xmmword [0x1401e3030]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], bx
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14001425d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014258
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014407
call fcn.14017f5e4
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], bx
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400142b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400142ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001440d
call fcn.14017f5e4
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bx
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x140014305
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014300
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014413
call fcn.14017f5e4
movdqa xmm0, xmmword [0x1401e3030]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], bx
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x140014356
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014351
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014419
call fcn.14017f5e4
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], 7
mov word [rbp - 0x20], bx
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x1400143a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001439d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400143e3
call fcn.14017f5e4
movdqa xmm0, xmmword [0x1401e3030]
movdqu xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x20], bx
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.14017f700
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1401a10ac
nop
call fcn.1401a10ac
nop
call fcn.1401a10ac
nop
call fcn.1401a10ac
nop
call fcn.1401a10ac
nop
call fcn.1401a10ac
nop
call fcn.1401a10ac
nop
call fcn.1401a10ac
nop
call fcn.1401a10ac
nop
call fcn.1401a10ac
int3
mov rdx, rcx
lea rax, [rcx + 0x6f0]
mov r8d, 0x328
mov ecx, 0x1e0
cmp qword [rdx + 0x8d0], rax
cmovne ecx, r8d
add rcx, rdx
jmp 0x140013cd0