Function at 0x1400165a0
Capabilities:
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x218
movaps xmmword [rsp + 0x200], xmm8
movaps xmmword [rsp + 0x1f0], xmm7
movaps xmmword [rsp + 0x1e0], xmm6
cmp byte [0x1400286c2], 0
lea rax, str.SWDWireGuard
lea rdx, str.ROOTWIREGUARD
cmove rdx, rax
xorps xmm8, xmm8
movups xmmword [rsp + 0x20], xmm8
mov qword [rsp + 0x30], 0
lea rcx, [0x14001df3c]
xor ebx, ebx
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsExW]
cmp rax, 0xffffffffffffffff
je 0x140016abc
mov r13, rax
movups xmm7, xmmword [0x14001df60]
movups xmm6, xmmword [0x14001df50]
lea r12, [rsp + 0x80]
mov rdi, qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
lea rsi, [rsp + 0xa0]
lea r14, str.WireGuardNameKey
lea rbp, [rsp + 0x48]
xor eax, eax
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x60], rax
jmp 0x140016681
call r15
cmp eax, 0x103
je 0x140016947
add ebx, 1
movaps xmmword [rsp + 0x90], xmm7
movaps xmmword [rsp + 0x80], xmm6
mov rcx, r13
mov edx, ebx
mov r8, r12
call rdi
test eax, eax
je 0x140016670
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov rcx, r13
mov rdx, r12
mov r8, r14
mov r9, rbp
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDevicePropertyW]
test eax, eax
je 0x14001667e
cmp dword [rsp + 0x48], 0x12
jne 0x14001667e
mov word [rsp + 0x19e], 0x30
cmp word [rsp + 0xa0], 0
je 0x14001667e
movups xmmword [rsp + 0x30], xmm8
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rsp + 0x4c], eax
test eax, eax
je 0x1400167ed
mov ebp, eax
mov rdi, r14
mov ecx, eax
call sub.msvcrt.dll_malloc
test rax, rax
je 0x1400167e3
mov r14, rax
movups xmmword [rsp + 0x30], xmm8
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rsp + 0x4c], eax
test eax, eax
je 0x1400167db
mov r8d, dword [rsp + 0x94]
lea rcx, [rsp + 0x6c]
lea rdx, [rsp + 0x7c]
xor r9d, r9d
call qword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
test eax, eax
lea rbp, [rsp + 0x48]
jne 0x14001685c
mov eax, dword [rsp + 0x6c]
and eax, 0xa
cmp eax, 0xa
jne 0x14001685c
mov rcx, r14
call sub.msvcrt.dll_strlen
test rax, rax
je 0x14001685c
lea rsi, [rax + 1]
mov rdx, qword [rsp + 0x60]
mov rcx, rdx
mov rbp, qword [rsp + 0x50]
sub rcx, rbp
cmp rsi, rcx
jae 0x1400167f7
mov r15, qword [rsp + 0x58]
mov qword [rsp + 0x70], rdx
jmp 0x140016824
mov rcx, r14
call sub.msvcrt.dll_free
mov r14, rdi
mov rdi, qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
lea rbp, [rsp + 0x48]
jmp 0x14001667e
add rdx, rdx
add rax, rbp
add rax, 2
cmp rdx, rax
cmovb rdx, rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x70], rdx
call sub.msvcrt.dll_realloc
mov rbp, qword [rsp + 0x50]
mov r15, rax
test rax, rax
je 0x140016851
lea rcx, [r15 + rbp]
mov rdx, r14
mov r8, rsi
call sub.msvcrt.dll_memcpy
add rbp, rsi
mov qword [rsp + 0x50], rbp
mov byte [r15 + rbp], 0
mov qword [rsp + 0x58], r15
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x60], rax
jmp 0x140016857
call qword [sym.imp.msvcrt.dll__errno]
lea rbp, [rsp + 0x48]
lea rcx, [0x140025470]
mov rdx, r14
call fcn.140016b80
mov r15, rax
mov rcx, r14
call sub.msvcrt.dll_free
test r15, r15
je 0x14001689b
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
mov rcx, r13
mov rdx, r12
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
test eax, eax
je 0x1400168bc
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
lea rsi, [rsp + 0xa0]
mov r14, rdi
mov rdi, qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
add ebx, 1
jmp 0x140016681
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov r14, rdi
mov rdi, qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
jne 0x140016930
mov ebp, dword [rsp + 0x4c]
mov ecx, 2
mov rdx, rbp
call sub.msvcrt.dll_calloc
mov qword [r15 + 8], rax
test rax, rax
je 0x14001691c
lea rcx, [rsp + 0x4c]
mov qword [rsp + 0x20], rcx
mov rcx, r13
mov rdx, r12
mov r8, rax
mov r9d, ebp
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
test eax, eax
jne 0x14001691c
mov rcx, qword [r15 + 8]
call sub.msvcrt.dll_free
mov qword [r15 + 8], 0
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
lea rsi, [rsp + 0xa0]
jmp 0x1400167ed
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
lea rsi, [rsp + 0xa0]
add ebx, 1
jmp 0x140016681
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov byte [0x140028677], 1
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
lea rcx, str..pipe
lea rdx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x140016ae6
mov r15, rax
lea rsi, [rsp + 0xcc]
xor r13d, r13d
lea rbx, [rsp + 0xf5]
lea rdi, str.ProtectedPrefixAdministratorsWireGuard_
lea rbp, [rsp + 0xa0]
jmp 0x140016a14
mov rbp, r14
lea rcx, [r12 + rsi]
lea rbx, [rsp + 0xf5]
mov rdx, rbx
mov r8, rdi
call sub.msvcrt.dll_memcpy
add rsi, rdi
mov qword [rsp + 0x50], rsi
mov byte [r12 + rsi], 0
mov r14, rbp
lea rsi, [rsp + 0xcc]
lea rdi, str.ProtectedPrefixAdministratorsWireGuard_
lea rbp, [rsp + 0xa0]
lea rcx, [0x140023470]
mov rdx, rbx
call fcn.140016b80
test rax, rax
je 0x140016afd
mov rcx, r15
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140016add
mov r8d, 0x29
mov rcx, rdi
mov rdx, rsi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140016a00
mov rcx, rbx
call sub.msvcrt.dll_strlen
xor r13d, r13d
test rax, rax
je 0x1400169e8
lea rdi, [rax + 1]
mov rcx, r14
mov rsi, qword [rsp + 0x50]
sub rcx, rsi
cmp rdi, rcx
jb 0x1400169a7
lea rbp, [r14 + r14]
add rax, rsi
add rax, 2
cmp rbp, rax
cmovb rbp, rax
mov rcx, r12
mov rdx, rbp
call sub.msvcrt.dll_realloc
mov rsi, qword [rsp + 0x50]
mov rcx, r12
mov r12, rax
test rax, rax
jne 0x1400169aa
mov r12, rcx
call qword [sym.imp.msvcrt.dll__errno]
mov eax, dword [rax]
mov r13d, eax
neg r13d
test eax, eax
lea rsi, [rsp + 0xcc]
lea rbx, [rsp + 0xf5]
lea rdi, str.ProtectedPrefixAdministratorsWireGuard_
lea rbp, [rsp + 0xa0]
jle 0x1400169e8
jmp 0x140016b09
mov rsi, qword [sym.imp.msvcrt.dll__errno]
call rsi
mov dword [rax], 0xd
call rsi
mov r13d, dword [rax]
xor r14d, r14d
test r13d, r13d
jle 0x140016aee
neg r13d
jmp 0x140016b15
mov byte [0x140028676], 1
jmp 0x140016b09
mov r13d, 0xfffffffb
jmp 0x140016b12
xor eax, eax
mov qword [rsp + 0x50], rax
xor r12d, r12d
jmp 0x140016961
call qword [sym.imp.msvcrt.dll__errno]
xor r13d, r13d
sub r13d, dword [rax]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r14, r12
neg r13d
mov rsi, qword [sym.imp.msvcrt.dll__errno]
call rsi
mov dword [rax], r13d
call rsi
cmp dword [rax], 0
je 0x140016b38
mov rcx, r14
call sub.msvcrt.dll_free
xor r14d, r14d
jmp 0x140016b4c
test r14, r14
jne 0x140016b4c
lea rcx, [0x14001dfba]
call sub.msvcrt.dll__strdup
mov r14, rax
mov rax, r14
movaps xmm6, xmmword [rsp + 0x1e0]
movaps xmm7, xmmword [rsp + 0x1f0]
movaps xmm8, xmmword [rsp + 0x200]
add rsp, 0x218
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret