Function at 0x140003424
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x7f0]
sub rsp, 0x8f0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x7e0], rax
mov rbx, rcx
lea rdx, str.insertFiles
lea rcx, str.SACSrvETV
xor edi, edi
call fcn.140001208
lea rdx, str.path
mov rcx, rax
mov r8, rbx
mov r15, rax
call fcn.140001354
mov rcx, r15
call fcn.140001214
lea rax, [rsp + 0x40]
lea rcx, [rbp + 0x3c2]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x40]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x3c0], di
mov qword [rsp + 0x48], rax
call fcn.140009540
mov rcx, rbx
call fcn.140009480
lea rcx, [rbp + 0x1a1]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x1a0], dil
mov r12, rax
call fcn.140009540
lea rdx, [rbp + 0x1a0]
lea rcx, str.EtvExtensions
call qword [sym.imp.eToken.dll_etPropGetStr]
mov esi, 0x104
lea rcx, [rbp + 0x5d0]
mov r8d, esi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
lea rcx, [rbp + 0x2b0]
mov r8d, esi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
lea rdx, [0x140014c08]
lea rcx, [rbp + 0x2b0]
mov r8d, esi
call qword [sym.imp.SHLWAPI.dll_StrCatBuffA]
lea r8, [rbp + 0x2b0]
lea rdx, str.filter
mov rcx, r15
call fcn.140001354
lea rdx, str.filter
mov rcx, r15
call fcn.1400012b0
lea rax, [rbp + 0x3c0]
lea r8, [rbp + 0x2b0]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [rbp + 0x3c0]
lea rdx, str.filterW
mov rcx, r15
call fcn.140002570
lea rdx, str.filterW
mov rcx, r15
call fcn.1400012b0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14000376a
mov rbx, qword [rsp + 0x40]
mov ecx, 0x260
call qword [sym.imp.eToken.dll_etAllocateMemory]
mov rsi, rax
test rax, rax
je 0x14000375c
lea r9, [rax + 0x10]
lea rdx, [rsp + 0x50]
lea rax, [rsp + 0x50]
mov rcx, rdx
or rcx, r9
and ecx, 0xf
jne 0x140003686
lea eax, [rcx + 4]
movaps xmm0, xmmword [rdx]
lea rdx, [rdx + 0x80]
movaps xmmword [r9], xmm0
movaps xmm1, xmmword [rdx - 0x70]
lea r9, [r9 + 0x80]
movaps xmmword [r9 - 0x70], xmm1
movaps xmm0, xmmword [rdx - 0x60]
movaps xmmword [r9 - 0x60], xmm0
movaps xmm1, xmmword [rdx - 0x50]
movaps xmmword [r9 - 0x50], xmm1
movaps xmm0, xmmword [rdx - 0x40]
movaps xmmword [r9 - 0x40], xmm0
movaps xmm1, xmmword [rdx - 0x30]
movaps xmmword [r9 - 0x30], xmm1
movaps xmm0, xmmword [rdx - 0x20]
movaps xmmword [r9 - 0x20], xmm0
movaps xmm1, xmmword [rdx - 0x10]
movaps xmmword [r9 - 0x10], xmm1
dec rax
jne 0x140003600
movaps xmm0, xmmword [rdx]
movaps xmmword [r9], xmm0
movaps xmm1, xmmword [rdx + 0x10]
movaps xmmword [r9 + 0x10], xmm1
movaps xmm0, xmmword [rdx + 0x20]
movaps xmmword [r9 + 0x20], xmm0
movaps xmm1, xmmword [rdx + 0x30]
movaps xmmword [r9 + 0x30], xmm1
movaps xmm0, xmmword [rdx + 0x40]
movaps xmmword [r9 + 0x40], xmm0
jmp 0x1400036af
mov r8d, 0x250
mov rdx, rax
mov rcx, r9
call fcn.140009660
jmp 0x1400036af
lea rdx, [rbx + 0x3c]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
js 0x1400036b9
mov rbx, qword [rbx]
lea rax, [rsp + 0x40]
cmp rbx, rax
jne 0x140003699
mov rdx, rbx
mov rcx, rsi
call fcn.14000846c
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400035c4
mov rbx, qword [rsp + 0x40]
jmp 0x140003750
test byte [rbx + 0x10], 0x10
jne 0x14000374d
mov qword [rsp + 0x38], rdi
movsxd rax, r12d
mov qword [rsp + 0x30], rdi
lea rcx, [rbp + 0x5d0]
lea r8, [rbx + 0x3c]
mov dword [rsp + 0x28], 0x104
add rcx, rax
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rcx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rax, qword [0x14001b580]
test rax, rax
je 0x14000374d
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x5d0]
call qword [rax + 0x70]
test eax, eax
je 0x14000374d
lea rcx, [rbp + 0x5d0]
call fcn.1400033ac
mov rbx, qword [rbx]
lea rax, [rsp + 0x40]
cmp rbx, rax
jne 0x1400036e1
jmp 0x140003761
mov edi, 0xe
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x40]
call fcn.140008600
mov edx, edi
mov rcx, r15
call fcn.140001238
mov rcx, qword [rbp + 0x7e0]
xor rcx, rsp
call fcn.140009450
lea r11, [rsp + 0x8f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret