Function at 0x1400115d2
Capabilities:
Enumerate files on windows

Disassembly:
jmp 0x140020e60
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xac8
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x2b2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xae8]
mov qword [rbp + 0xa68], 0xfffffffffffffffe
mov rax, qword [0x14003ad50]
xor rax, rbp
mov qword [rbp + 0xa90], rax
mov qword [rbp + 8], 0
lea rax, [rbp + 8]
mov qword [rbp + 0x10], rax
xor eax, eax
test eax, eax
jne 0x140020eaa
mov ecx, gethostname
call fcn.14001121c
mov qword [rbp + 0x728], rax
cmp qword [rbp + 0x728], 0
je 0x140020ef0
mov rcx, qword [rbp + 0x728]
call fcn.1400112ee
mov qword [rbp + 0xa78], rax
jmp 0x140020efb
mov qword [rbp + 0xa78], 0
mov rax, qword [rbp + 0xa78]
mov qword [rbp + 0x38], rax
cmp qword [rbp + 0x38], 0
jne 0x140020f1e
mov rcx, qword [rbp + 0xac0]
call fcn.140011933
jmp 0x14002145b
mov rax, qword [rbp + 0x38]
mov rdx, qword [rbp + 0xac0]
mov rcx, rax
call fcn.1400117fd
mov rax, qword [rbp + 0x38]
mov qword [rax + 0x28], 0
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x10]
mov qword [rax + 0x30], rcx
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x38]
mov qword [rax], rcx
mov rax, qword [rbp + 0x38]
add rax, 0x28
mov qword [rbp + 0x10], rax
xor eax, eax
test eax, eax
jne 0x140020f31
cmp qword [rbp + 8], 0
je 0x14002144f
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2c8], rax
cmp qword [rbp + 0x2c8], 0
jne 0x140020f8b
jmp 0x14002144f
mov rax, qword [rbp + 0x2c8]
mov rdx, rax
lea rcx, [rbp + 0x2e8]
call fcn.140011401
nop
lea rax, [rbp + 0x748]
mov qword [rbp + 0x788], rax
lea rdx, [rbp + 0x2e8]
mov rcx, qword [rbp + 0x788]
call fcn.140011401
mov qword [rbp + 0xa78], rax
mov rdx, qword [rbp + 0xa78]
lea rcx, [rbp + 0x328]
call fcn.140020bd0
nop
lea rcx, [rbp + 0x328]
call fcn.140011ab4
lea rdx, [rbp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x368], rax
cmp qword [rbp + 0x368], 0xffffffffffffffff
jne 0x1400210cd
mov rax, qword [rbp + 0x2c8]
cmp qword [rax + 0x28], 0
je 0x140021036
mov rax, qword [rbp + 0x2c8]
mov rax, qword [rax + 0x28]
mov rcx, qword [rbp + 0x2c8]
mov rcx, qword [rcx + 0x30]
mov qword [rax + 0x30], rcx
jmp 0x140021045
mov rax, qword [rbp + 0x2c8]
mov rax, qword [rax + 0x30]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x2c8]
mov rax, qword [rax + 0x30]
mov rcx, qword [rbp + 0x2c8]
mov rcx, qword [rcx + 0x28]
mov qword [rax], rcx
xor eax, eax
test eax, eax
jne 0x14002100c
mov rax, qword [rbp + 0x2c8]
mov qword [rbp + 0x7c8], rax
mov rax, qword [rbp + 0x7c8]
mov qword [rbp + 0x7a8], rax
cmp qword [rbp + 0x7a8], 0
je 0x1400210a4
mov edx, 1
mov rcx, qword [rbp + 0x7a8]
call fcn.1400116db
mov qword [rbp + 0xa78], rax
jmp 0x1400210af
mov qword [rbp + 0xa78], 0
lea rcx, [rbp + 0x328]
call fcn.140011933
nop
lea rcx, [rbp + 0x2e8]
call fcn.140011933
jmp 0x140020f66
lea rdx, [0x140034144]
lea rcx, [rbp + 0x7e4]
call fcn.14001108c
mov rcx, rax
call fcn.14001165e
mov rdx, rax
lea rcx, [rbp + 0x8c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140021137
lea rdx, [0x140034148]
lea rcx, [rbp + 0x804]
call fcn.140011235
mov rcx, rax
call fcn.1400112cb
mov rdx, rax
lea rcx, [rbp + 0x8c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140021137
mov eax, dword [rbp + 0x60]
and eax, 0x400
test eax, eax
je 0x14002113c
jmp 0x14002135c
mov eax, dword [rbp + 0x60]
and eax, 0x10
test eax, eax
je 0x140021288
lea rcx, [rbp + 0x8c]
call fcn.140020630
test eax, eax
je 0x140021288
lea rax, [rbp + 0x828]
mov qword [rbp + 0x868], rax
lea rax, [rbp + 0x888]
mov qword [rbp + 0x8c8], rax
lea rdx, [rbp + 0x8c]
mov rcx, qword [rbp + 0x868]
call fcn.1400111cc
mov qword [rbp + 0xa78], rax
mov rax, qword [rbp + 0xa78]
mov qword [rbp + 0xa80], rax
lea rdx, [rbp + 0x2e8]
mov rcx, qword [rbp + 0x8c8]
call fcn.140011401
mov qword [rbp + 0xa88], rax
mov r8, qword [rbp + 0xa80]
mov rdx, qword [rbp + 0xa88]
lea rcx, [rbp + 0x388]
call fcn.1400208d0
nop
mov ecx, gethostname
call fcn.14001121c
mov qword [rbp + 0x8e8], rax
cmp qword [rbp + 0x8e8], 0
je 0x140021207
mov rcx, qword [rbp + 0x8e8]
call fcn.1400112ee
mov qword [rbp + 0xa78], rax
jmp 0x140021212
mov qword [rbp + 0xa78], 0
mov rax, qword [rbp + 0xa78]
mov qword [rbp + 0x3c8], rax
mov rax, qword [rbp + 0x3c8]
lea rdx, [rbp + 0x388]
mov rcx, rax
call fcn.1400117fd
mov rax, qword [rbp + 0x3c8]
mov qword [rax + 0x28], 0
mov rax, qword [rbp + 0x3c8]
mov rcx, qword [rbp + 0x10]
mov qword [rax + 0x30], rcx
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x3c8]
mov qword [rax], rcx
mov rax, qword [rbp + 0x3c8]
add rax, 0x28
mov qword [rbp + 0x10], rax
xor eax, eax
test eax, eax
jne 0x140021236
lea rcx, [rbp + 0x388]
call fcn.140011933
jmp 0x14002135c
lea rcx, [rbp + 0x8c]
call fcn.140020860
test eax, eax
je 0x14002135c
lea rax, [rbp + 0x908]
mov qword [rbp + 0x948], rax
lea rax, [rbp + 0x968]
mov qword [rbp + 0x9a8], rax
lea rdx, [rbp + 0x8c]
mov rcx, qword [rbp + 0x948]
call fcn.1400111cc
mov qword [rbp + 0xa78], rax
mov rax, qword [rbp + 0xa78]
mov qword [rbp + 0xa80], rax
lea rdx, [rbp + 0x2e8]
mov rcx, qword [rbp + 0x9a8]
call fcn.140011401
mov qword [rbp + 0xa88], rax
mov r8, qword [rbp + 0xa80]
mov rdx, qword [rbp + 0xa88]
lea rcx, [rbp + 0x3e8]
call fcn.1400208d0
nop
lea rax, [rbp + 0x9c8]
mov qword [rbp + 0xa08], rax
lea rdx, [rbp + 0x3e8]
mov rcx, qword [rbp + 0xa08]
call fcn.140011401
mov qword [rbp + 0xa78], rax
mov rdx, qword [rbp + 0xa78]
mov ecx, dword [rbp + 0xac8]
call fcn.140011794
nop
lea rcx, [rbp + 0x3e8]
call fcn.140011933
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x368]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400210cd
mov rax, qword [rbp + 0x2c8]
cmp qword [rax + 0x28], 0
je 0x14002139f
mov rax, qword [rbp + 0x2c8]
mov rax, qword [rax + 0x28]
mov rcx, qword [rbp + 0x2c8]
mov rcx, qword [rcx + 0x30]
mov qword [rax + 0x30], rcx
jmp 0x1400213ae
mov rax, qword [rbp + 0x2c8]
mov rax, qword [rax + 0x30]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x2c8]
mov rax, qword [rax + 0x30]
mov rcx, qword [rbp + 0x2c8]
mov rcx, qword [rcx + 0x28]
mov qword [rax], rcx
xor eax, eax
test eax, eax
jne 0x140021375
mov rax, qword [rbp + 0x2c8]
mov qword [rbp + 0xa48], rax
mov rax, qword [rbp + 0xa48]
mov qword [rbp + 0xa28], rax
cmp qword [rbp + 0xa28], 0
je 0x14002140d
mov edx, 1
mov rcx, qword [rbp + 0xa28]
call fcn.1400116db
mov qword [rbp + 0xa78], rax
jmp 0x140021418
mov qword [rbp + 0xa78], 0
mov rcx, qword [rbp + 0x368]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, gethostbyname
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rbp + 0x328]
call fcn.140011933
nop
lea rcx, [rbp + 0x2e8]
call fcn.140011933
jmp 0x140020f66
mov rcx, qword [rbp + 0xac0]
call fcn.140011933
lea rcx, [rbp - 0x20]
lea rdx, [0x140033bd0]
call fcn.14001141f
mov rcx, qword [rbp + 0xa90]
xor rcx, rbp
call fcn.140011974
lea rsp, [rbp + 0xaa8]
pop rdi
pop rbp
ret