Function at 0x14001ec70
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x118
movaps xmmword [rsp + 0x100], xmm6
mov qword [rsp + 0x48], rdx
mov r13, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0xf8], rax
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0xa0]
mov qword [rsi + 0x50], r14
movaps xmm6, xmmword [0x1401efb80]
movaps xmmword [rsi + 0x40], xmm6
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
lea rdx, str.Next
lea r8, str..._.._base_files_file_enumerator_win.cc
lea rdi, [rsp + 0x80]
mov rcx, rdi
mov r9d, 0x82
call fcn.1400ddbb0
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
call fcn.1400f4d70
lea r15, [r13 + 4]
lea rax, [r13 + 0x260]
mov qword [rsp + 0x38], rax
lea r12, [r13 + 0x280]
lea rdi, [r13 + 0x30]
lea rax, [r13 + 0x2a8]
mov qword [rsp + 0x40], rax
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp byte [r13], 0
je 0x14001ee59
mov rcx, qword [r13 + 0x258]
mov rdx, r15
call rsi
test eax, eax
je 0x14001efdb
call rbx
cmp qword [r13 + 0x258], 0xffffffffffffffff
je 0x14001ef4c
mov qword [rsp + 0x90], r14
movaps xmmword [rsp + 0x80], xmm6
mov qword [rsp + 0x70], rdi
test rdi, rdi
je 0x14001f19c
mov rbp, r14
mov r14, rdi
mov rcx, rdi
call fcn.14011dc44
mov qword [rsp + 0x78], rax
lea rdi, [rsp + 0x80]
mov rcx, rdi
lea rdx, [rsp + 0x70]
call fcn.14010a450
mov rcx, r13
mov rdx, rdi
call fcn.14001f2d0
test al, al
jne 0x14001ef32
mov rax, rbp
mov ebp, dword [r13 + 4]
mov qword [rsp + 0x60], rax
movaps xmmword [rsp + 0x50], xmm6
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov r8, rdi
call fcn.14001f270
test bpl, 0x10
jne 0x14001f112
and ebp, 0x10
shr ebp, 4
mov rcx, r13
mov edx, ebp
call fcn.14001f260
test al, al
mov rdi, r14
je 0x14001f16c
mov eax, dword [r13 + 0x298]
cmp eax, 1
jne 0x14001f073
cmp byte [r12 + 0x17], 0
mov rdx, r12
js 0x14001f1b1
cmp byte [rsp + 0x97], 0
lea rcx, [rsp + 0x80]
jns 0x14001ee45
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
cmp eax, 1
je 0x14001f07b
jmp 0x14001f16c
mov rax, qword [r13 + 0x2c0]
cmp qword [r13 + 0x2b8], rax
je 0x14001f0fd
test rax, rax
mov rcx, qword [r13 + 0x2b0]
cmove rax, rcx
dec rax
cmp rcx, rax
jb 0x14001f1a8
lea rdx, [rax + rax*2]
shl rdx, 3
add rdx, qword [r13 + 0x2a8]
mov rcx, qword [rsp + 0x38]
call fcn.140014b30
mov rcx, qword [r13 + 0x2b0]
mov rdx, qword [r13 + 0x2c0]
test rdx, rdx
je 0x14001f1ba
lea rax, [rdx - 1]
mov qword [r13 + 0x2c0], rax
cmp rcx, rdx
jb 0x14001f199
cmp rcx, rax
jb 0x14001f1ab
movabs rcx, 0x8000000000000000
cmp rdx, rcx
je 0x14001f1ae
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
lea rax, [rax + rax*2]
lea rcx, [rcx + rax*8]
call fcn.14010a440
mov rax, qword [r13 + 0x2b0]
cmp rax, 5
jae 0x14001f1cd
mov qword [rsp + 0x90], r14
movaps xmmword [rsp + 0x80], xmm6
mov eax, dword [r13 + 0x298]
cmp eax, 1
je 0x14001eff8
jmp 0x14001f03f
mov rcx, rdi
call fcn.14010a440
mov rsi, qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rdi, r14
mov r14, rbp
jmp 0x14001ed3c
mov byte [r13], 0
cmp dword [r13 + 0x298], 0
mov rsi, qword [sym.imp.KERNEL32.dll_FindNextFileW]
je 0x14001f01f
cmp eax, 0x12
je 0x14001ed3c
jmp 0x14001f0e1
mov rcx, qword [rsp + 0x38]
lea rsi, [rsp + 0x80]
mov rdx, rsi
lea r8, [rsp + 0x50]
call fcn.1400f42c0
cmp byte [rsp + 0x97], 0
js 0x14001f012
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov edx, 1
mov r8, r15
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov qword [r13 + 0x258], rax
mov byte [r13], 1
lea rcx, [rsp + 0x80]
call fcn.14010a440
jmp 0x14001ed5b
mov rcx, qword [r13 + 0x258]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [r13 + 0x258], 0xffffffffffffffff
jmp 0x14001ed5b
lea rax, [0x1401fc170]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
jmp 0x14001ef74
mov rsi, qword [rsp + 0x80]
jmp 0x14001ef98
cmp byte [r12 + 0x17], 0
js 0x14001f155
mov byte [r12 + 0x17], 1
mov rcx, r12
mov dword [rcx], 0x2a
jmp 0x14001ef66
test eax, eax
jne 0x14001f22e
movzx eax, byte [r13 + 0x297]
test al, al
mov rcx, qword [r13 + 0x280]
cmovns rcx, r12
mov qword [rsp + 0x50], rcx
cmovs rax, qword [r13 + 0x288]
mov qword [rsp + 0x58], rax
jmp 0x14001ef74
test eax, eax
jne 0x14001f16c
lea rsi, [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call fcn.1400f5d80
mov rcx, rsi
call fcn.14010a440
lea rcx, [rsp + 0x80]
call fcn.14010a440
lea rcx, [rsp + 0xa0]
call fcn.1400f5540
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.14011fe20
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x100]
add rsp, 0x118
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp dword [r13 + 0x29c], 0
je 0x14001ed3c
mov ecx, eax
call fcn.14001c440
mov dword [r13 + 0x2a0], eax
xorps xmm0, xmm0
mov rdi, qword [rsp + 0x48]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
jmp 0x14001f0a5
cmp byte [r13 + 0x278], 0
je 0x14001edf1
cmp byte [rsp + 0x67], 0
lea rcx, [rsp + 0x50]
jns 0x14001f131
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xa
jb 0x14001edf1
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
call fcn.14001e8b0
jmp 0x14001edf1
mov qword [r13 + 0x288], 1
mov rcx, qword [r13 + 0x280]
jmp 0x14001f034
lea rcx, [rsp + 0x50]
call fcn.14010a440
lea rcx, [rsp + 0x80]
call fcn.14010a440
mov rsi, qword [sym.imp.KERNEL32.dll_FindNextFileW]
movabs r14, 0xaaaaaaaaaaaaaaaa
jmp 0x14001ed3c
int3
mov qword [rsp + 0x78], 0
int3
int3
int3
int3
mov rdx, qword [r12]
jmp 0x14001ee2b
lea rax, [rcx - 1]
mov qword [r13 + 0x2c0], rax
mov rdx, rcx
jmp 0x14001eecb
mov rdx, qword [r13 + 0x2b8]
mov r9, qword [r13 + 0x2c0]
xor ecx, ecx
cmp r9, rdx
cmovb rcx, rax
sub rcx, rdx
add rcx, r9
dec rax
mov rdx, rax
sub rdx, rcx
cmp rdx, rcx
jb 0x14001ef0d
mov r8, r14
mov r9, rcx
shr r9, 2
add r9, rcx
cmp r9, 4
mov edx, 3
cmovae rdx, r9
cmp rdx, rax
jae 0x14001ef0d
mov rcx, qword [rsp + 0x40]
call fcn.1401541f0
jmp 0x14001ef0d
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], 0
lea rsi, [rsp + 0x80]
jmp 0x14001ef8e