Function at 0x140031200
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [0x140064018]
xor rax, rsp
mov qword [rsp + 0x180], rax
movsxd rdi, dword [r8]
mov r13, r8
mov rbp, qword [rsp + 0x1f8]
mov r12, rdx
mov qword [rsp + 0x38], r8
mov r14, rcx
mov dword [rsp + 0x20], edi
test edi, edi
jne 0x140031257
lea edx, [rdi + 8]
mov ecx, 0x104
call fcn.14003853c
mov qword [r12], rax
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [r14 + rbx], 0
jne 0x140031260
add rbx, 3
mov qword [rsp + 0x1e8], rsi
mov rcx, rbx
mov edx, 1
call fcn.14003853c
mov qword [rsp + 0x30], rax
mov r15, rax
test rax, rax
je 0x1400314ca
mov r8, r14
mov rdx, rbx
mov rcx, rax
call fcn.140038690
lea r8, [0x14005e7ac]
mov rdx, rbx
mov rcx, r15
call fcn.1400386f0
lea rdx, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x28], rax
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400314ca
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1400314ca
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1400313e1
mov r15d, dword [rsp + 0x1f0]
mov r13, rdi
nop dword [rax + rax]
cmp r15d, 1
jne 0x140031322
test byte [rsp + 0x40], 0x10
jne 0x140031336
jmp 0x1400313bd
test r15d, r15d
jne 0x1400313bd
test byte [rsp + 0x40], 0x10
jne 0x1400313bd
test rbp, rbp
je 0x140031419
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rax + rbp], 0
jne 0x140031346
test rax, rax
je 0x140031419
lea rsi, [rsp + 0x6c]
nop dword [rax]
movzx ecx, byte [rbp]
mov rbx, rbp
call fcn.140039db8
movzx ecx, byte [rsi]
mov edi, eax
call fcn.140039db8
cmp eax, edi
jne 0x1400313a9
nop word [rax + rax]
cmp byte [rbx], 0
je 0x140031410
mov rax, rsi
inc rbx
sub rax, rbp
movzx ecx, byte [rax + rbx]
call fcn.140039db8
movzx ecx, byte [rbx]
mov edi, eax
call fcn.140039db8
cmp edi, eax
je 0x140031380
cmp byte [rbx], 0
je 0x140031410
movzx eax, byte [rsi]
inc rsi
test al, al
jne 0x140031360
mov rsi, qword [rsp + 0x28]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edi, dword [rsp + 0x20]
test eax, eax
jne 0x140031310
mov r15, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
test r12, r12
je 0x1400313fd
cmp edi, 0x104
jge 0x1400313fd
mov rax, qword [r12]
movsxd rcx, edi
mov qword [rax + rcx*8], 0
mov rcx, r15
mov dword [r13], edi
call fcn.140038520
xor eax, eax
jmp 0x1400314cf
mov rsi, qword [rsp + 0x28]
mov edi, dword [rsp + 0x20]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140031420
lea rdx, [rsp + 0x6c]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp byte [rdx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140031440
lea rbx, [rax + 2]
mov edx, 1
add rbx, rcx
mov rcx, rbx
call fcn.14003853c
mov rcx, qword [r12]
mov qword [rcx + r13*8], rax
mov rax, qword [r12]
mov rcx, qword [rax + r13*8]
test rcx, rcx
je 0x1400313bd
cmp r13, 0x103
jge 0x1400313bd
mov r8, r14
mov rdx, rbx
call fcn.140038690
mov rcx, qword [r12]
lea r8, [0x14005e050]
mov rdx, rbx
mov rcx, qword [rcx + r13*8]
call fcn.1400386f0
mov rcx, qword [r12]
lea r8, [rsp + 0x6c]
mov rdx, rbx
mov rcx, qword [rcx + r13*8]
call fcn.1400386f0
inc edi
mov dword [rsp + 0x20], edi
inc r13
jmp 0x1400313bd
mov eax, 1
mov rsi, qword [rsp + 0x1e8]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140036180
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret