Function at 0x14002b860
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x4b0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x14012df80]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov rbp, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rdx
lea r9, str.nMdlIdx_u
lea r8, str.ExecModule
lea rdx, [0x1400fea88]
mov rcx, qword [rcx + 8]
call fcn.140080c70
xor r13d, r13d
mov rax, qword [rdi + 0x28]
mov rax, qword [rax + 8]
test rax, rax
je 0x14002bbbc
test rbp, rbp
js 0x14002bbb6
cmp rbp, qword [rax + 0x10]
jge 0x14002bbb6
mov rax, qword [rax + 8]
mov r12, qword [rax + rbp*8]
test r12, r12
je 0x14002bbbc
mov rdx, qword [r12 + 0x20]
test rdx, rdx
je 0x14002b933
mov rcx, qword [rdi + 0x18]
call fcn.14000e810
test rax, rax
je 0x14002bbbc
test byte [rdi + 0x34], 2
je 0x14002b922
mov al, byte [rax + 0x24]
shr eax, 1
and eax, 1
jmp 0x14002b92b
mov al, byte [rax + 0x24]
shr eax, 6
and eax, 1
test eax, eax
je 0x14002bbbc
mov dword [rsp + 0x20], 0x104
mov r9, qword [r12 + 8]
mov r8, qword [r12]
lea rdx, [rsp + 0x290]
mov rcx, qword [rdi + 0x10]
call fcn.140013060
mov ebx, r13d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14002bbbc
mov r14d, 1
nop
test byte [rsp + 0x40], 0x10
cmove ebx, r14d
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14002b99f
test ebx, ebx
je 0x14002b980
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
je 0x14002bbbc
test byte [rdi + 0x34], 2
jne 0x14002ba0e
mov rax, qword [rdi + 0x28]
movabs rdx, 0x400000000000000
test byte [rax], 2
je 0x14002b9d0
mov rax, qword [rdi + 0x18]
or qword [rax], rdx
mov rax, qword [rdi + 0x28]
test byte [rax], 4
je 0x14002ba0e
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
test rdx, rax
jne 0x14002ba0e
shr rax, 0x17
and ax, r14w
or ax, 0x3e8
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8d, [r9 + 0x40]
movzx edx, ax
call fcn.14000dab0
mov rcx, qword [rdi + 0x18]
call fcn.14000dbd0
mov ebx, r13d
mov rsi, qword [r12 + 0x18]
test rsi, rsi
je 0x14002baad
mov rax, qword [rdi + 0x28]
test byte [rax], r14b
jne 0x14002baad
mov eax, dword [rdi + 0x34]
test r14b, al
je 0x14002ba3b
mov ebx, 8
jmp 0x14002ba73
test al, 2
je 0x14002ba5a
mov rbx, rbp
shl rbx, 0x18
and ebx, 0xff00000e
movzx eax, byte [rdi + 0x30]
shl eax, 0x10
or ebx, eax
or ebx, 0xe
jmp 0x14002ba73
mov rbx, rbp
shl rbx, 0x18
and ebx, 0xff00000c
movzx eax, byte [rdi + 0x30]
shl eax, 0x10
or ebx, eax
or ebx, 0xc
call fcn.14000abb0
mov r9, rsi
xor r8d, r8d
mov edx, 0x2b10
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
call fcn.14000abb0
mov r8d, ebx
mov edx, 0x2b12
mov r9d, 0x40001
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebx, r14d
mov rax, qword [r12 + 0x10]
lea rcx, [0x1400fb278]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0x28], rcx
lea rax, [rsp + 0x290]
mov qword [rsp + 0x20], rax
lea r9, [0x1400feaf0]
lea r8, str.ExecModule
lea rdx, [0x1400fea88]
mov rcx, qword [rdi + 8]
call fcn.140080a70
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, qword [r12 + 0x10]
lea rdx, [rsp + 0x290]
mov rcx, qword [rdi + 0x10]
call fcn.140014b80
mov rsi, rax
test rax, rax
je 0x14002bbbc
mov rax, qword [rdi + 0x28]
test byte [rax], r14b
jne 0x14002bb42
call fcn.14000abb0
xor r9d, r9d
lea r8, [rsp + 0x290]
mov edx, 0x2b2b
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x20
lea ecx, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r11, rax
mov qword [rax], rbp
mov rax, qword [rdi + 0x38]
mov qword [r11 + 8], rax
mov qword [r11 + 0x10], rsi
mov rax, qword [rdi + 0x28]
movzx ecx, byte [rax]
and cl, r14b
movzx edx, cl
shl dx, 8
movzx eax, bl
or dx, ax
mov word [r11 + 0x18], dx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, r11
lea rcx, [0x14002c4d0]
call fcn.1400a16ac
mov r11, rax
mov rax, qword [rdi + 0x48]
mov qword [rax + rbp*8], r11
mov rax, qword [rdi + 0x48]
cmp qword [rax + rbp*8], r13
setne r13b
jmp 0x14002bbbc
call fcn.1400a0610
int3
mov dword [rsp + 0x20], r13d
lea r9, [0x1400fb428]
lea r8, str.ExecModule
lea rdx, [0x1400fea88]
mov rcx, qword [rdi + 8]
call fcn.140080c70
mov eax, r13d
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.1400cd6e0
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret