Function at 0x1400b5c10
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5e0]
sub rsp, 0x6e0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x738], rbx
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rbp + 0x5d0], rax
mov r15, r8
mov qword [rsp + 0x20], rdx
mov rbx, rcx
lea r8, [0x140103e2c]
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400b5f18
xor r13b, r13b
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1400b5f0f
xor r12d, r12d
lea esi, [r12 + 1]
nop dword [rax]
test r13b, r13b
jne 0x1400b5f0f
lea rdx, [0x140103e54]
lea rcx, [rbp - 0x74]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400b5ec2
lea rdx, [0x1401081fc]
lea rcx, [rbp - 0x74]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400b5ec2
mov esi, r12d
lea rdx, [0x140103e8c]
lea rcx, [rbx + 0x220]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400b5d6c
cmp dword [rbx + 0x430], 0
je 0x1400b5d43
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x74]
repne scasw ax, word [rdi]
not rcx
lea rdx, [rbp + rcx*2 - 0x76]
lea r8, [rbx + 0x440]
lea r9d, [rax + 0x10]
lea rcx, [rbp - 0x74]
call fcn.140019c60
mov edi, 1
test al, al
je 0x1400b5d73
jmp 0x1400b5d71
xor r8d, r8d
cmp dword [rbx + 0x434], r8d
sete r8b
lea rdx, [rbp - 0x74]
lea rcx, [rbx + 0x220]
call fcn.140096140
mov edi, 1
test eax, eax
je 0x1400b5d73
jmp 0x1400b5d71
mov edi, 1
mov esi, edi
mov edx, dword [rbx + 0x42c]
mov ecx, dword [rsp + 0x60]
test edx, edx
je 0x1400b5d89
mov eax, edx
and eax, ecx
cmp eax, edx
jne 0x1400b5d8c
mov r12d, edi
test esi, esi
je 0x1400b5e0b
test r12d, r12d
je 0x1400b5e0b
test cl, 0x10
je 0x1400b5da2
inc dword [rbx + 0x48c]
jmp 0x1400b5da8
inc dword [rbx + 0x490]
xor r12d, r12d
mov qword [rsp + 0x28], r12
lea r8, [rbp - 0x74]
mov rsi, qword [rsp + 0x20]
mov rdx, rsi
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rdx, [rsp + 0x28]
lea rcx, [rbp + 0x1b0]
call fcn.140094590
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.SHELL32.dll_ILClone]
mov r8, rax
xor r9d, r9d
mov edx, 0x8001
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [rsp + 0x60]
jmp 0x1400b5e13
xor r12d, r12d
mov rsi, qword [rsp + 0x20]
test cl, 0x10
je 0x1400b5ebd
lea r8, [rbp - 0x74]
mov rdx, rsi
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r12
mov word [rsp + 0x38], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1b0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x1b0]
lea rcx, [rsp + 0x38]
call fcn.140009a30
nop
mov rdi, qword [r15]
lea r8, [rsp + 0x38]
mov rdx, qword [rdi + 8]
mov rcx, rdi
call fcn.14000a770
mov rdx, qword [r15 + 8]
movabs rcx, 0x666666666666665
sub rcx, rdx
cmp rcx, 1
jb 0x1400b5f02
lea rcx, [rdx + 1]
mov qword [r15 + 8], rcx
mov qword [rdi + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
cmp qword [rsp + 0x50], 8
jb 0x1400b5ebd
mov rcx, qword [rsp + 0x38]
call fcn.14004b088
mov esi, 1
lea rcx, [rbx + 0x460]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx r13d, r13b
cmp dword [rbx + 0x488], 0
cmovne r13d, esi
lea rcx, [rbx + 0x460]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rdx, [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1400b5f0f
jmp 0x1400b5cb0
lea rcx, str.list_T__too_long
call fcn.14002ba2c
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x5d0]
xor rcx, rsp
call fcn.14004ae00
mov rbx, qword [rsp + 0x738]
add rsp, 0x6e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret