Function at 0x140028060
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov dword [rax + 0x18], r8d
push r13
push r14
push r15
sub rsp, 0x180
mov r9d, dword [rcx]
mov r13d, 1
mov qword [rax + 0x10], rbx
mov r14, rdx
mov ebx, r13d
mov qword [rax - 0x20], rbp
mov dword [rsp + 0x1a0], ebx
mov ebp, r8d
mov r15, rcx
cmp r9d, ebx
jle 0x140028486
mov qword [rax - 0x28], rsi
mov esi, r13d
mov qword [rax - 0x30], rdi
mov qword [rax - 0x38], r12
mov r8, qword [r14 + rsi*8]
mov rcx, r8
movzx eax, byte [r8]
test al, al
je 0x140028456
movzx edx, al
cmp dl, 0x2a
je 0x1400280f0
movzx eax, dl
cmp dl, 0x3f
je 0x1400280e1
movzx eax, byte [rcx + 1]
inc rcx
movzx edx, al
test al, al
jne 0x1400280c6
test al, al
je 0x140028456
nop dword [rax]
inc rcx
cmp byte [rcx], 0
jne 0x1400280f0
sub rcx, r8
add rcx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140028456
mov rdx, qword [r14 + rsi*8]
mov rcx, rax
movzx r8d, byte [rdx]
cmp r8b, 0x2f
je 0x140028128
cmp r8b, 0x5c
jne 0x140028140
cmp byte [rdx + 1], 0
lea r8, [rdx + 1]
je 0x140028140
cmp byte [rdx + 2], 0x3a
cmove rdx, r8
nop word [rax + rax]
movzx eax, byte [rdx]
cmp al, 0x2f
jne 0x140028152
mov byte [rcx], 0x5c
inc rcx
inc rdx
jmp 0x140028140
mov byte [rcx], al
inc rcx
test al, al
je 0x140028160
inc rdx
jmp 0x140028140
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x1b8], rax
mov r10, rax
cmp rax, 0xffffffffffffffff
je 0x14002844d
mov rcx, qword [r14 + rsi*8]
xor r12d, r12d
mov rbx, rdi
mov byte [rcx], r12b
cmp byte [rdi], r12b
je 0x1400281af
inc rbx
cmp byte [rbx], r12b
jne 0x140028195
cmp rbx, rdi
jbe 0x1400281af
cmp byte [rbx], 0x5c
je 0x1400281b4
dec rbx
cmp rbx, rdi
ja 0x1400281a2
cmp byte [rbx], 0x5c
jne 0x1400281b7
inc rbx
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rdi + rax], r12b
jne 0x1400281c0
movsxd r8, eax
add r8, rdi
test eax, eax
js 0x1400281e9
movzx ecx, byte [r8]
cmp cl, 0x5c
je 0x1400281e9
cmp cl, 0x2f
je 0x1400281e9
dec r8
sub eax, r13d
jns 0x1400281d3
movzx eax, byte [r8 + 1]
lea r9, [rsp + 0x4c]
inc r8
test al, al
je 0x140028224
nop word [rax + rax]
cmp al, 0x2a
je 0x1400284e3
cmp al, 0x3f
jne 0x140028215
cmp byte [r9], r12b
je 0x1400282ad
movzx eax, byte [r8 + 1]
inc r8
inc r9
test al, al
jne 0x140028200
xor eax, eax
cmp byte [r9], al
sete al
test eax, eax
je 0x1400282ad
mov r12d, r13d
lea rax, [rsp + 0x4c]
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x140028240
mov rax, rbx
sub rax, rdi
inc rax
add rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r9, rax
test rax, rax
je 0x1400282a1
mov rdx, rax
cmp rdi, rbx
jae 0x140028281
mov r8, rdi
nop
movzx ecx, byte [r8]
inc r8
mov byte [rdx], cl
inc rdx
cmp r8, rbx
jb 0x140028270
lea rcx, [rsp + 0x4c]
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140028290
mov r10, qword [rsp + 0x1b8]
mov qword [r14 + rsi*8], r9
dec ebp
cmp dword [r15], ebp
jge 0x140028410
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140028410
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x1400282e0
movsxd r8, eax
add r8, rdi
test eax, eax
js 0x140028309
movzx ecx, byte [r8]
cmp cl, 0x5c
je 0x140028309
cmp cl, 0x2f
je 0x140028309
dec r8
sub eax, r13d
jns 0x1400282f3
movzx eax, byte [r8 + 1]
lea r9, [rsp + 0x4c]
inc r8
test al, al
je 0x140028345
nop word [rax + rax]
cmp al, 0x2a
je 0x140028527
cmp al, 0x3f
jne 0x140028336
cmp byte [r9], 0
je 0x1400283ff
movzx eax, byte [r8 + 1]
inc r8
inc r9
test al, al
jne 0x140028320
xor eax, eax
cmp byte [r9], al
sete al
test eax, eax
je 0x1400283ff
movsxd rcx, dword [r15]
inc r12d
mov rdx, rcx
lea eax, [rcx + 1]
mov dword [r15], eax
cmp rcx, rsi
jle 0x140028381
nop dword [rax]
mov rax, qword [r14 + rdx*8]
mov qword [r14 + rdx*8 + 8], rax
dec rdx
cmp rdx, rsi
jg 0x140028370
lea rax, [rsp + 0x4c]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140028390
mov rax, rbx
sub rax, rdi
inc rax
add rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r9, rax
test rax, rax
je 0x1400283f1
mov rdx, rax
cmp rdi, rbx
jae 0x1400283d1
mov r8, rdi
nop
movzx ecx, byte [r8]
inc r8
mov byte [rdx], cl
inc rdx
cmp r8, rbx
jb 0x1400283c0
lea rcx, [rsp + 0x4c]
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400283e0
inc dword [rsp + 0x1a0]
inc rsi
mov qword [r14 + rsi*8], r9
mov r10, qword [rsp + 0x1b8]
cmp dword [r15], ebp
jl 0x1400282c0
test r12d, r12d
jne 0x140028431
mov rdx, qword [r14 + rsi*8]
mov rcx, rdi
nop dword [rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140028420
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [rsp + 0x1a0]
mov ebp, dword [rsp + 0x1b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r9d, dword [r15]
inc ebx
inc rsi
mov dword [rsp + 0x1a0], ebx
cmp ebx, r9d
jl 0x1400280b0
mov r12, qword [rsp + 0x160]
mov rdi, qword [rsp + 0x168]
mov rsi, qword [rsp + 0x170]
mov rbp, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x1a8]
cmp r9d, r13d
jle 0x14002857a
lea r10, [r14 + 8]
mov rax, qword [r10]
cmp byte [rax], 0
jne 0x14002856a
lea eax, [r9 - 1]
mov edx, r13d
cmp r13d, eax
jge 0x1400284d8
mov r8, r10
nop
mov rax, qword [r8 + 8]
inc edx
mov qword [r8], rax
lea r8, [r8 + 8]
mov r9d, dword [r15]
lea eax, [r9 - 1]
cmp edx, eax
jl 0x1400284c0
dec r9d
mov dword [r15], r9d
jmp 0x140028571
cmp byte [r8 + 1], r12b
je 0x140028230
lea rdx, [r8 + 1]
mov rcx, r9
call fcn.140029320
test eax, eax
jne 0x140028518
nop dword [rax]
inc r9
cmp byte [r9], r12b
je 0x140028520
lea rdx, [r8 + 1]
mov rcx, r9
call fcn.140029320
test eax, eax
je 0x140028500
mov eax, r13d
jmp 0x14002822c
xor eax, eax
jmp 0x14002822c
cmp byte [r8 + 1], 0
je 0x140028355
lea rdx, [r8 + 1]
mov rcx, r9
call fcn.140029320
test eax, eax
jne 0x14002855b
inc r9
cmp byte [r9], 0
je 0x140028563
lea rdx, [r8 + 1]
mov rcx, r9
call fcn.140029320
test eax, eax
je 0x140028542
mov eax, r13d
jmp 0x14002834d
xor eax, eax
jmp 0x14002834d
inc r13d
add r10, 8
cmp r13d, r9d
jl 0x1400284a3
add rsp, 0x180
pop r15
pop r14
pop r13
ret