Function at 0x1400524d0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x680]
sub rsp, 0x780
mov rax, qword [0x140125350]
xor rax, rsp
mov qword [rbp + 0x670], rax
mov rax, qword [rcx + 8]
mov r14d, dword [rcx]
mov rbx, qword [rcx + 0x10]
xor r13d, r13d
lea rcx, [rbp + 0x341]
xor edx, edx
mov esi, r13d
mov r8d, 0x103
mov qword [rsp + 0x58], rax
mov byte [rbp + 0x340], sil
mov edi, 1
call fcn.14008ca20
mov rcx, qword [rsp + 0x58]
lea r12, [0x1400ddf98]
lea r15d, [rdi + 1]
cmp r14d, edi
jle 0x14005255a
mov rsi, qword [rcx + 8]
mov edi, r15d
cmp r14d, 3
jl 0x1400525a3
movsxd rax, edi
mov rax, qword [rcx + rax*8]
mov rcx, rax
mov qword [rsp + 0x60], rax
call fcn.14000170d
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140052599
mov rcx, qword [rsp + 0x60]
lea r8d, [rax + 5]
lea rdx, str.eventlog
call fcn.14008eacc
test eax, eax
jne 0x1400525a3
mov eax, dword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov r15d, eax
inc edi
cmp r14d, 1
jle 0x140052a43
lea rdx, str.list
mov rcx, rsi
call fcn.14008d268
test eax, eax
je 0x140052a43
lea rdx, str.scan
mov rcx, rsi
call fcn.14008d268
test eax, eax
jne 0x140052783
lea rcx, [rbp - 0x6f]
xor edx, edx
mov r8d, 0x103
mov byte [rbp - 0x70], r13b
call fcn.14008ca20
lea rcx, [rbp + 0x451]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x450], r13b
call fcn.14008ca20
lea rsi, str..log
cmp r14d, edi
jle 0x140052623
mov rsi, qword [rsp + 0x58]
movsxd rax, edi
mov rsi, qword [rsi + rax*8]
xor r9d, r9d
lea rcx, [rbp + 0x450]
mov edx, 0x104
lea r8d, [r9 + 3]
mov qword [rsp + 0x20], r13
call fcn.140001b59
cmp dword [0x14013d438], 1
jne 0x140052665
mov ecx, dword [0x1401214d4]
lea r9, str._logs__n
lea r8, [0x1400e7ba0]
mov rdx, rbx
call fcn.140056eb0
lea rax, [0x1400dd47c]
lea r9, [rbp + 0x450]
lea r8, [0x1400dd480]
lea rdx, [rbp + 0x560]
mov ecx, 0x104
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.140056eb0
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x560]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140052755
lea r8, [rbp + 0x20c]
lea rcx, [rbp - 0x70]
or r9, 0xffffffffffffffff
mov edx, 0x104
call fcn.14008cdb8
movzx ecx, byte [rbp - 0x70]
movzx eax, byte [rbp - 0x6f]
cmp cl, byte [0x1400ee12c]
jne 0x1400526e7
cmp al, byte [0x1400ee12d]
je 0x14005272c
cmp cl, byte [0x1400dda04]
jne 0x140052703
cmp al, byte [0x1400dda05]
jne 0x140052703
movzx eax, byte [rbp - 0x6e]
cmp al, byte [0x1400dda06]
je 0x14005272c
cmp dword [0x14013d438], 1
mov ecx, dword [0x1401214d4]
lea r9, [rbp - 0x70]
mov rdx, rbx
lea r8, str._name__s__name__n
je 0x140052727
lea r8, [0x1400e3fa4]
call fcn.140056f00
lea rdx, [rbp + 0xa0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x14005274c
lea r8, [rbp + 0xcc]
jmp 0x1400526bd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [0x14013d438], 1
jne 0x140052a48
mov ecx, dword [0x1401214d4]
lea r9, str.__logs__n
lea r8, [0x1400e7ba0]
mov rdx, rbx
call fcn.140056f00
jmp 0x140052a48
lea rdx, str.close
mov rcx, rsi
call fcn.14008d268
test eax, eax
jne 0x1400527e4
mov ecx, r15d
call fcn.14000154b
test eax, eax
jne 0x1400527bf
mov ecx, dword [0x1401214d4]
lea r8, str._s_log_not_open_n
mov r9, r12
mov rdx, rbx
call fcn.140056eb0
jmp 0x140052a48
mov ecx, r15d
call fcn.140001014
mov ecx, dword [0x1401214d4]
lea r8, str._s_log_closed_n
mov r9, r12
mov rdx, rbx
call fcn.140056eb0
jmp 0x140052a48
cmp r14d, 2
je 0x140052880
cmp r14d, edi
jle 0x1400529be
lea rdx, str.open
mov rcx, rsi
call fcn.14008d268
test eax, eax
je 0x140052880
lea rdx, str.write
mov rcx, rsi
call fcn.14008d268
test eax, eax
je 0x140052834
lea rdx, [0x1400ee270]
mov rcx, rsi
call fcn.14008d268
test eax, eax
jne 0x1400529be
mov rsi, qword [rsp + 0x58]
movsxd rax, edi
mov ecx, r15d
mov rdi, qword [rsi + rax*8]
call fcn.14000154b
test eax, eax
jne 0x140052869
mov ecx, dword [0x1401214d4]
lea r8, str._s_log_not_opened_n
mov r9, r12
mov rdx, rbx
call fcn.140056eb0
jmp 0x140052a48
lea rdx, [0x1400e3fa4]
mov r8, rdi
mov ecx, r15d
call fcn.1400013c0
jmp 0x140052a48
mov dword [rsp + 0x50], r13d
cmp r14d, 2
jle 0x1400529a7
mov rsi, qword [rsp + 0x58]
movsxd rax, edi
inc edi
mov rsi, qword [rsi + rax*8]
mov edx, 0x25
mov rcx, rsi
call fcn.14009107c
test rax, rax
je 0x14005297a
xor eax, eax
xor ecx, ecx
mov byte [rbp + 0x320], r13b
mov qword [rbp + 0x321], rax
mov qword [rbp + 0x329], rax
mov word [rbp + 0x331], ax
mov byte [rbp + 0x333], al
call fcn.140091edc
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], rax
xor eax, eax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov dword [rsp + 0x68], r13d
call fcn.140091908
test eax, eax
jne 0x14005297a
mov eax, dword [rsp + 0x68]
mov edx, dword [rsp + 0x78]
mov r9d, dword [rsp + 0x7c]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x6c]
inc edx
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x70]
lea r8, str._04d__02d__02d__02d_02d_02d
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x74]
add r9d, 0x76c
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
lea rdx, [rbp + 0x320]
mov ecx, socket
call fcn.140056eb0
lea r8, [rbp + 0x320]
lea rdx, str._DATETIME_
mov rcx, rsi
call fcn.140001627
mov r13, rax
mov rsi, rax
cmp r14d, edi
jle 0x1400529c5
mov rax, qword [rsp + 0x58]
movsxd rcx, edi
lea rdx, str.append
mov rcx, qword [rax + rcx*8]
call fcn.14008d268
mov ecx, dword [rsp + 0x50]
test eax, eax
mov eax, 1
cmove ecx, eax
jmp 0x1400529c9
lea rdx, str.open
mov rcx, rsi
call fcn.14008d268
test eax, eax
jne 0x14005289d
xor eax, eax
jmp 0x140052a4b
mov ecx, dword [rsp + 0x50]
mov r8d, ecx
mov rdx, rsi
mov ecx, r15d
call fcn.14000128f
lea rcx, [rbp + 0x340]
mov r8, rsi
mov edx, 0x104
call fcn.140001bd6
mov ecx, r15d
call fcn.14000154b
test eax, eax
jne 0x140052a00
lea r8, str._s_log:_ERROR_opening__s_n
jmp 0x140052a17
cmp dword [0x14013d438], 0
lea r8, str._s_log_opened:__s_n
je 0x140052a17
lea r8, str._result__n___logid__s__logid__n___logfilename__s__logfilename__n____result_
mov ecx, dword [0x1401214d4]
lea rax, [rbp + 0x340]
mov r9, r12
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.140056eb0
test r13, r13
je 0x140052a48
mov rcx, r13
call fcn.14008c8c8
jmp 0x140052a48
call fcn.140001780
mov rax, rbx
mov rcx, qword [rbp + 0x670]
xor rcx, rsp
call fcn.14008d900
lea r11, [rsp + 0x780]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret