Function at 0x140035a00
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x610
mov rax, qword [0x14016c4a0]
xor rax, rsp
mov qword [rsp + 0x600], rax
mov qword [rsp + 0x630], r12
lea rcx, [rsp + 0x3e0]
xor r12d, r12d
xor edx, edx
mov r8d, 0x104
mov esi, r12d
call fcn.1400033e1
xor edx, edx
lea rcx, [rsp + 0x2d0]
mov r8d, 0x104
call fcn.1400033e1
mov rcx, qword [0x14016d928]
lea rbx, [0x140126420]
mov rdx, rbx
call fcn.140001d89
mov rbp, rax
test rax, rax
je 0x140035c5f
mov qword [rsp + 0x638], r14
lea ecx, [r12 + 0x24]
mov r9d, 0x80000000
mov qword [rsp + 0x640], r15
xor r8d, r8d
mov rdx, rbx
call fcn.140002121
xor edx, edx
xor r9d, r9d
or r8d, 0xffffffff
mov r15, rax
lea ecx, [rdx + 0x24]
call fcn.140002121
xor edx, edx
xor r9d, r9d
or r8d, 0xffffffff
mov rdi, rax
lea ecx, [rdx + 0x24]
call fcn.140002121
cmp dword [reloc.WSOCK32.dll_accept], 4
mov r14, rax
mov qword [rsp + 0x40], r12
jl 0x140035b29
test dword [0x14016ba50], 0x200
je 0x140035b29
lea rax, [rsp + 0x2d0]
mov ecx, 0x200
mov qword [rsp + 0x38], rax
lea r9, str.....esif_uf_dspmgr.c
lea rax, str.SCAN_CONFIG_For_DSP_Files_NameSpace___s__Pattern__s
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea r8, str.esif_dsp_file_scan
lea edx, [r12 + 4]
mov dword [rsp + 0x20], 0x35b
call fcn.140003693
test r15, r15
je 0x140035c37
test rdi, rdi
je 0x140035c37
test r14, r14
je 0x140035c37
lea r9, [rsp + 0x40]
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.140003a08
mov esi, eax
test eax, eax
jne 0x140035c37
mov eax, dword [rdi + 0x10]
cmp eax, 5
jb 0x140035bd6
mov ecx, eax
lea rdx, [0x140126f88]
mov rax, qword [rdi + 4]
add rax, 0xfffffffffffffffb
add rcx, rax
call fcn.140004525
test eax, eax
jne 0x140035bd6
mov ecx, 0x104
call fcn.1400037c9
mov rbx, rax
test rax, rax
je 0x140035ba8
xor edx, edx
mov r8d, 0x104
mov rcx, rax
call fcn.1400033e1
mov r8, qword [rdi + 4]
or r9, 0xffffffffffffffff
mov edx, 0x104
mov rcx, rbx
call fcn.140003c4c
mov rcx, rbx
call fcn.140034430
test eax, eax
je 0x140035bd6
test rbx, rbx
je 0x140035bd6
mov rcx, rbx
call fcn.140002d65
xor r8d, r8d
mov dword [rsp + 0x20], r12d
or r9d, 0xffffffff
mov rcx, rdi
lea edx, [r8 + 0x24]
call fcn.140004b2e
xor r8d, r8d
mov dword [rsp + 0x20], r12d
or r9d, 0xffffffff
mov rcx, r14
lea edx, [r8 + 0x24]
call fcn.140004b2e
lea r9, [rsp + 0x40]
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.140003bf7
mov esi, eax
test eax, eax
je 0x140035b61
lea rcx, [rsp + 0x40]
call fcn.1400039c7
cmp esi, 0x3ed
cmove esi, r12d
mov rcx, r15
call fcn.1400025db
mov rcx, rdi
call fcn.1400025db
mov rcx, r14
call fcn.1400025db
mov r15, qword [rsp + 0x640]
mov r14, qword [rsp + 0x638]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov edx, 0x104
lea rcx, [rsp + 0x3e0]
lea r8d, [r9 + 9]
call fcn.140002ced
or r9, 0xffffffffffffffff
lea r8, str..edp
mov edx, 0x104
lea rcx, [rsp + 0x2d0]
call fcn.140003c4c
cmp dword [reloc.WSOCK32.dll_accept], 4
mov r12, qword [rsp + 0x630]
jl 0x140035d02
test dword [0x14016ba50], 0x200
je 0x140035d02
lea rax, [rsp + 0x2d0]
mov edx, 4
mov qword [rsp + 0x38], rax
lea r9, str.....esif_uf_dspmgr.c
lea rax, [rsp + 0x3e0]
mov ecx, 0x200
mov qword [rsp + 0x30], rax
lea r8, str.esif_dsp_file_scan
lea rax, str.SCAN_File_System_For_DSP_Files_Path___s__Pattern__s
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x379
call fcn.140003693
mov ecx, 0x104
call fcn.1400037c9
mov rbx, rax
test rax, rax
je 0x140035d24
xor edx, edx
mov r8d, 0x104
mov rcx, rax
call fcn.1400033e1
test rbx, rbx
jne 0x140035d77
cmp dword [reloc.WSOCK32.dll_accept], 1
jl 0x140035d6d
test dword [0x14016ba1d], 0x200
je 0x140035d6d
lea rax, str.Fail_to_allocate_esif_ccb_file_n
mov ecx, 0x200
mov qword [rsp + 0x28], rax
lea r9, str.....esif_uf_dspmgr.c
lea r8, str.esif_dsp_file_scan
mov dword [rsp + 0x20], 0x37d
lea edx, [rbx + 1]
call fcn.140003693
mov eax, 0x708
jmp 0x140035e8c
lea rax, [rsp + 0x2d0]
mov ecx, 0x104
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3e0]
lea rax, [0x14011d674]
lea r8, [0x14011d678]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x4f0]
call fcn.140034130
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140035e78
or r9, 0xffffffffffffffff
lea r8, [rsp + 0x7c]
mov edx, 0x104
mov rcx, rbx
call fcn.140003c4c
test rbp, rbp
je 0x140035e00
mov rcx, qword [rbp + 0x84]
mov rdx, rbx
call fcn.140003ae4
test rax, rax
jne 0x140035e36
mov rcx, rbx
call fcn.140034430
test eax, eax
je 0x140035e14
mov rcx, rbx
call fcn.140002d65
mov ecx, 0x104
call fcn.1400037c9
mov rbx, rax
test rax, rax
je 0x140035e36
xor edx, edx
mov r8d, 0x104
mov rcx, rax
call fcn.1400033e1
lea rdx, [rsp + 0x190]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140035e6d
or r9, 0xffffffffffffffff
lea r8, [rsp + 0x1bc]
mov edx, 0x104
mov rcx, rbx
call fcn.140003c4c
test rbx, rbx
jne 0x140035de7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x140035e7d
mov esi, 0x3eb
test rbx, rbx
je 0x140035e8a
mov rcx, rbx
call fcn.140002d65
mov eax, esi
mov rcx, qword [rsp + 0x600]
xor rcx, rsp
call fcn.140004ca5
mov rbx, qword [rsp + 0x648]
add rsp, 0x610
pop rdi
pop rsi
pop rbp
ret