Function at 0x140004910
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x298]
sub rsp, 0x398
mov r14, rdx
mov rbx, rcx
xor r13d, r13d
mov eax, r13d
mov dword [rsp + 0x20], eax
mov dword [rbp - 0x80], eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r13
lea rax, [rbp - 0x70]
mov qword [rbp + 0x2f8], rax
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], r13
lea r8d, [r13 + 1]
lea rdx, [0x14005b1a4]
lea rcx, [rbp - 0x70]
call fcn.1400053c0
nop
mov rdx, r14
lea rcx, [rbp - 8]
call fcn.1400051d0
nop
lea r8, [rbp - 0x70]
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.1400041a0
cmp qword [rax + 0x18], 8
jb 0x1400049ae
mov rax, qword [rax]
lea rdx, [rbp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
mov qword [rbp - 0x78], rax
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140004a02
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400049fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005132
call fcn.140021394
movdqa xmm0, xmmword [0x14005c8c0]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r13w
cmp rdi, 0xffffffffffffffff
jne 0x140004a44
mov qword [rbx], r13
mov qword [rbx + 8], r13
mov qword [rbx + 0x10], r13
mov rcx, r14
call fcn.140003a80
mov rax, rbx
add rsp, 0x398
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
movabs r15, 0x7ffffffffffffffe
mov r12, qword [rsp + 0x70]
mov ecx, 0xa
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r13
lea rax, [rbp + 0x6c]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140004a72
cmp rdi, r15
ja 0x14000512c
cmp rdi, 8
jae 0x140004ac7
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 7
lea rbx, [rdi + rdi]
mov r8, rbx
lea rdx, [rbp + 0x6c]
lea rcx, [rsp + 0x28]
call fcn.1400233b0
mov word [rsp + rbx + 0x28], r13w
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov r13, qword [rsp + 0x28]
xor esi, esi
jmp 0x140004b1a
mov r14, rdi
or r14, 7
cmp r14, r15
jbe 0x140004ad8
mov r14, r15
jmp 0x140004ae0
cmp r14, 0xa
cmovb r14, rcx
lea rdx, [r14 + 1]
lea rcx, [rsp + 0x28]
call fcn.140003ba0
mov r13, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r14
lea rbx, [rdi + rdi]
mov r8, rbx
lea rdx, [rbp + 0x6c]
mov rcx, rax
call fcn.1400233b0
xor esi, esi
mov word [rbx + r13], si
mov r9d, dword [rsp + 0x20]
or r9d, 2
mov dword [rsp + 0x20], r9d
mov dword [rbp - 0x80], r9d
lea r8, [rsp + 0x28]
cmp r14, 8
setae byte [rbp + 0x2f8]
cmovae r8, r13
cmp rdi, 1
jne 0x140004b7b
mov rdx, rdi
lea rax, [0x14005b1a8]
mov rcx, rax
sub r8, rax
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x140004b7b
add rcx, 2
sub rdx, 1
jne 0x140004b56
mov rsi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x48]
xor bl, bl
jmp 0x140004c8a
mov qword [rsp + 0x48], rsi
lea rax, [rbp + 0x6c]
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140004b90
cmp rdi, r15
ja 0x140005126
cmp rdi, 8
jae 0x140004be2
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
lea rbx, [rdi + rdi]
mov r8, rbx
lea rdx, [rbp + 0x6c]
lea rcx, [rsp + 0x48]
call fcn.1400233b0
mov word [rsp + rbx + 0x48], si
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x48]
jmp 0x140004c3a
mov rsi, rdi
or rsi, 7
cmp rsi, r15
jbe 0x140004bf3
mov rsi, r15
jmp 0x140004c00
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x48]
call fcn.140003ba0
mov r15, rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
lea rbx, [rdi + rdi]
mov r8, rbx
lea rdx, [rbp + 0x6c]
mov rcx, rax
call fcn.1400233b0
xor eax, eax
mov word [rbx + r15], ax
mov r9d, dword [rsp + 0x20]
or r9d, 4
mov dword [rsp + 0x20], r9d
lea r8, [rsp + 0x48]
cmp rsi, 8
cmovae r8, r15
cmp rdi, 2
jne 0x140004c88
mov rdx, rdi
lea rax, [0x14005b1ac]
mov rcx, rax
sub r8, rax
nop dword [rax + rax]
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x140004c88
add rcx, 2
sub rdx, 1
jne 0x140004c70
xor bl, bl
jmp 0x140004c8a
mov bl, 1
test r9b, 4
je 0x140004cd9
and r9d, 0xfffffffb
mov dword [rsp + 0x20], r9d
cmp rsi, 8
jb 0x140004cd9
lea rdx, [rsi*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x140004ccc
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005138
mov rcx, r15
call fcn.140021394
mov r9d, dword [rsp + 0x20]
test r9b, 2
je 0x140004d26
and r9d, 0xfffffffd
mov dword [rsp + 0x20], r9d
cmp byte [rbp + 0x2f8], 0
je 0x140004d26
lea rdx, [r14*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x140004d1e
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005144
mov rcx, r13
call fcn.140021394
test bl, bl
je 0x1400050db
lea rax, [rbp + 0x6c]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140004d40
mov r15, qword [rbp + 0x2f0]
xor r13d, r13d
test r15, r15
jne 0x140004e9b
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r13
movabs r15, 0x7ffffffffffffffe
cmp rbx, r15
ja 0x14000513e
cmp rbx, 8
jae 0x140004daf
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], 7
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x6c]
lea rcx, [rsp + 0x28]
call fcn.1400233b0
mov word [rsp + rbx + 0x28], r13w
jmp 0x140004e04
mov rsi, rbx
or rsi, 7
cmp rsi, r15
jbe 0x140004dc0
mov rsi, r15
jmp 0x140004dcd
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x28]
call fcn.140003ba0
mov rdi, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x6c]
mov rcx, rax
call fcn.1400233b0
mov word [rdi + rbx], r13w
cmp r12, qword [rsp + 0x78]
je 0x140004e36
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [r12], xmm0
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [r12 + 0x10], xmm1
mov edx, 7
mov word [rsp + 0x28], r13w
add r12, 0x20
mov qword [rsp + 0x70], r12
jmp 0x140004e52
lea r8, [rsp + 0x28]
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.140005e30
mov r12, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140004e8f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005144
call fcn.140021394
mov r14, qword [rbp + 0x2e8]
jmp 0x1400050ef
lea rax, [rbp - 0x50]
mov qword [rbp + 0x2f8], rax
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
mov r8, rbx
lea rdx, [rbp + 0x6c]
lea rcx, [rbp - 0x50]
call fcn.1400053c0
nop
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
mov r14, qword [rbp + 0x2e8]
mov rsi, r14
cmp qword [r14 + 0x18], 8
jb 0x140004ee6
mov rsi, qword [r14]
mov rdi, qword [r14 + 0x10]
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
ja 0x14000514a
mov qword [rsp + 0x60], 7
cmp rdi, 8
jae 0x140004f26
mov qword [rsp + 0x58], rdi
mov r8d, 0x10
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.1400233b0
jmp 0x140004f75
mov rbx, rdi
or rbx, 7
cmp rbx, rax
jbe 0x140004f37
mov rbx, rax
jmp 0x140004f44
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x48]
call fcn.140003ba0
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rbx
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.1400233b0
nop
lea r8, [rbp - 0x50]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x18]
call fcn.1400041a0
mov rcx, rax
call r15
test al, al
je 0x1400050e5
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r13
lea rax, [rbp + 0x6c]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140004fb0
movabs r15, 0x7ffffffffffffffe
cmp rbx, r15
ja 0x14000512c
cmp rbx, 8
jae 0x140004ffd
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], 7
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x6c]
lea rcx, [rsp + 0x28]
call fcn.1400233b0
mov word [rsp + rbx + 0x28], r13w
jmp 0x140005052
mov rsi, rbx
or rsi, 7
cmp rsi, r15
jbe 0x14000500e
mov rsi, r15
jmp 0x14000501b
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x28]
call fcn.140003ba0
mov rdi, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x6c]
mov rcx, rax
call fcn.1400233b0
mov word [rdi + rbx], r13w
cmp r12, qword [rsp + 0x78]
je 0x140005084
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [r12], xmm0
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [r12 + 0x10], xmm1
mov edx, 7
mov word [rsp + 0x28], r13w
add r12, 0x20
mov qword [rsp + 0x70], r12
jmp 0x1400050a0
lea r8, [rsp + 0x28]
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.140005e30
mov r12, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x1400050ef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400050d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005144
call fcn.140021394
jmp 0x1400050ef
mov r14, qword [rbp + 0x2e8]
xor r13d, r13d
movabs r15, 0x7ffffffffffffffe
lea rdx, [rbp + 0x40]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140004a53
mov rax, qword [rsp + 0x68]
mov rbx, qword [rbp + 0x2e0]
mov qword [rbx], rax
mov qword [rbx + 8], r12
mov rax, qword [rsp + 0x78]
mov qword [rbx + 0x10], rax
jmp 0x140004a25
call fcn.140003400
nop
call fcn.140003400
int3
call fcn.140027fa4
nop
call fcn.140027fa4
nop
call fcn.140003400
int3
call fcn.140027fa4
nop
call fcn.140003400
int3