Function at 0x14001df20
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x178
movaps xmmword [rsp + 0x160], xmm8
movaps xmmword [rsp + 0x150], xmm7
movaps xmmword [rsp + 0x140], xmm6
mov r13, rdx
mov rdi, rcx
mov rax, qword [0x140163028]
xor rax, rsp
mov qword [rsp + 0x138], rax
movaps xmm6, xmmword [0x140141df0]
lea rsi, [rsp + 0xa0]
movaps xmmword [rsi + 0x40], xmm6
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
lea rdx, str.Next
lea r8, str..._.._base_files_file_enumerator_win.cc
lea rbx, [rsp + 0x110]
mov rcx, rbx
mov r9d, 0x83
call fcn.140006710
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.140019a90
lea rax, [rdi + 4]
mov qword [rsp + 0x50], rax
lea r14, [rdi + 0x2a8]
lea r15, [rdi + 0x260]
lea rax, [rdi + 0x280]
mov qword [rsp + 0x30], rax
lea rax, [rdi + 0x30]
mov qword [rsp + 0x48], rax
movabs rsi, 0xaaaaaaaaaaaaaaaa
xorps xmm7, xmm7
movaps xmm8, xmmword [0x140145950]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r15
cmp byte [rdi], 0
je 0x14001e03f
mov rcx, qword [rdi + 0x258]
mov rdx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001e20b
mov rcx, qword [rdi + 0x258]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rdi + 0x258], 0xffffffffffffffff
jmp 0x14001e20b
mov rax, qword [rdi + 0x2c0]
cmp qword [rdi + 0x2b8], rax
je 0x14001e904
test rax, rax
mov rcx, qword [rdi + 0x2b0]
mov rdx, rax
cmove rdx, rcx
dec rdx
cmp rcx, rdx
jb 0x14001e96e
mov rcx, qword [r14]
lea rbp, [rdx + rdx*2]
lea rdx, [rcx + rbp*8]
cmp r15, rdx
je 0x14001e0a1
movzx r8d, byte [rdx + 0x17]
test r8b, r8b
jns 0x14001e092
mov r8, qword [rcx + rbp*8 + 8]
mov rdx, qword [rdx]
mov rcx, r15
call fcn.140025aa4
mov rax, qword [rdi + 0x2c0]
mov rdx, qword [rdi + 0x2b0]
test rax, rax
je 0x14001e0ca
lea rcx, [rax - 1]
mov qword [rdi + 0x2c0], rcx
cmp rdx, rax
lea rbx, [rsp + 0x110]
jae 0x14001e0e0
jmp 0x14001e977
lea rcx, [rdx - 1]
mov qword [rdi + 0x2c0], rcx
mov rax, rdx
lea rbx, [rsp + 0x110]
cmp rdx, rcx
jb 0x14001e971
movabs rdx, 0x8000000000000000
cmp rax, rdx
je 0x14001e974
mov rax, qword [r14]
lea rcx, [rcx + rcx*2]
cmp byte [rax + rcx*8 + 0x17], 0
jns 0x14001e116
lea rax, [rax + rcx*8]
mov rcx, qword [rax]
call fcn.140105028
mov rcx, r14
call fcn.14009ef10
mov qword [rsp + 0x120], rsi
movaps xmmword [rsp + 0x110], xmm6
mov eax, dword [rdi + 0x298]
cmp eax, 1
je 0x14001e16d
test eax, eax
jne 0x14001e19d
movzx eax, byte [rdi + 0x297]
test al, al
mov rcx, qword [rdi + 0x280]
cmovns rcx, qword [rsp + 0x30]
mov qword [rsp + 0xf8], rcx
cmovs rax, qword [rdi + 0x288]
mov qword [rsp + 0x100], rax
jmp 0x14001e188
lea rax, [0x140145960]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], 1
mov rcx, r15
mov rdx, rbx
lea r8, [rsp + 0xf8]
call fcn.14002e0d0
jmp 0x14001e1b1
movaps xmmword [rsp + 0x110], xmm7
mov qword [rsp + 0x120], 0
cmp byte [rsp + 0x127], 0
jns 0x14001e1c3
mov rbx, qword [rsp + 0x110]
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 1
mov r8, qword [rsp + 0x50]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov qword [rdi + 0x258], rax
mov byte [rdi], 1
cmp byte [rsp + 0x127], 0
jns 0x14001e20b
mov rcx, qword [rsp + 0x110]
call fcn.140105028
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rdi + 0x258], 0xffffffffffffffff
je 0x14001e2ca
mov qword [rsp + 0x90], rsi
movaps xmmword [rsp + 0x80], xmm6
mov rax, qword [rsp + 0x48]
cmp word [rax], 0
je 0x14001e30a
xor r15d, r15d
xor r14d, r14d
mov r12, r14
inc r14
add r15, 2
cmp word [rdi + r12*2 + 0x32], 0
jne 0x14001e244
test r14, r14
je 0x14001e30a
movaps xmmword [rsp + 0x80], xmm7
mov qword [rsp + 0x90], 0
movabs rax, 0x8000000000000000
add rax, 0xffffffffffffffef
cmp r14, rax
ja 0x14001e961
cmp r14, 0xb
jae 0x14001e327
mov byte [rsp + 0x97], r14b
lea rbp, [rsp + 0x80]
cmp r14, 2
jne 0x14001e368
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov dword [rsp + 0x80], eax
lea rbp, [rsp + 0x80]
jmp 0x14001e378
mov ebp, eax
mov byte [rdi], 0
cmp dword [rdi + 0x298], 0
jne 0x14001e2ef
mov r8d, 1
mov rcx, qword [rsp + 0x30]
lea rdx, [0x140145960]
call fcn.140025aa4
cmp ebp, 0x12
je 0x14001e003
cmp dword [rdi + 0x29c], 0
je 0x14001e003
jmp 0x14001e8f7
movaps xmmword [rsp + 0x80], xmm7
mov qword [rsp + 0x90], 0
xor eax, eax
mov r15, qword [rsp + 0x38]
jmp 0x14001e390
mov rbx, r13
lea r13, [r14 + 8]
and r13, 0xfffffffffffffff8
mov rcx, r13
add rcx, r13
call fcn.140105030
mov rbp, rax
mov qword [rsp + 0x80], rax
movabs rax, 0x8000000000000000
or r13, rax
mov qword [rsp + 0x90], r13
mov r13, rbx
mov qword [rsp + 0x88], r14
mov rcx, rbp
mov rdx, qword [rsp + 0x48]
mov r8, r15
call fcn.14010a000
mov r15, qword [rsp + 0x38]
mov word [rbp + r12*2 + 2], 0
mov al, byte [rsp + 0x97]
test al, al
js 0x14001e3a0
movzx eax, al
lea r12, [rsp + 0x80]
mov rcx, r12
jmp 0x14001e3b8
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x88]
lea r12, [rsp + 0x80]
test rax, rax
mov r14, qword [rsp + 0x40]
movabs rsi, 0xaaaaaaaaaaaaaaaa
je 0x14001e3e2
xor edx, edx
cmp word [rcx + rdx], 0
je 0x14001e646
add rdx, 2
dec rax
jne 0x14001e3ce
mov rcx, rdi
mov rdx, r12
call fcn.14002a970
test al, al
jne 0x14001e61c
mov bl, byte [rdi + 4]
mov qword [rsp + 0x70], rsi
movaps xmmword [rsp + 0x60], xmm6
mov rcx, r15
lea rdx, [rsp + 0x60]
mov r8, r12
call fcn.14002e070
mov ebp, 1
test bl, 0x10
je 0x14001e44b
mov ebp, 2
cmp byte [rdi + 0x278], 0
je 0x14001e44b
cmp byte [rsp + 0x77], 0
lea rcx, [rsp + 0x60]
jns 0x14001e43b
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xa
jae 0x14001e667
test dword [rdi + 0x27c], ebp
je 0x14001e60b
mov eax, dword [rdi + 0x298]
cmp eax, 1
jne 0x14001e63c
movaps xmmword [rsp + 0x120], xmm6
movaps xmmword [rsp + 0x110], xmm6
mov ecx, 0x50
call fcn.140105030
mov rbp, rax
mov qword [rsp + 0xf8], rax
movups xmmword [rsp + 0x100], xmm8
mov r8d, 0x4e
mov rcx, rax
lea rdx, str.api_ms_win_downlevel_shlwapi_l1_1_0.dll
call fcn.14010a000
mov word [rbp + 0x4e], 0
mov eax, 2
xor edx, edx
cmp rdx, 0xffffffffffffffda
je 0x14001e4d7
dec rdx
lea rcx, [rax + 2]
cmp word [rbp + rax], 0
mov rax, rcx
jne 0x14001e4b6
test rcx, rcx
jne 0x14001e809
mov qword [rsp + 0x118], 0
xor eax, eax
mov byte [rsp + 0x120], al
lea rcx, [0x140140bb0]
mov qword [rsp + 0x110], rcx
mov dword [rsp + 0x128], 0
mov byte [rsp + 0x130], al
lea rcx, [rsp + 0xf8]
lea rdx, [rsp + 0x130]
lea r8, [rsp + 0x128]
call fcn.14003c2c0
mov rbp, rax
mov rcx, qword [rsp + 0x118]
test rcx, rcx
je 0x14001e543
cmp rcx, rbp
je 0x14001e97a
test rcx, rcx
jne 0x14001e7f1
mov qword [rsp + 0x118], rbp
cmp byte [rsp + 0x10f], 0
jns 0x14001e573
mov rcx, qword [rsp + 0xf8]
call fcn.140105028
mov rbp, qword [rsp + 0x118]
test rbp, rbp
je 0x14001e7a3
test rbp, rbp
je 0x14001e7a3
mov rcx, rbp
lea rdx, [0x1401459e2]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001e7a3
mov rdx, qword [rsp + 0x30]
cmp byte [rdx + 0x17], 0
js 0x14001e7fc
cmp byte [rsp + 0x97], 0
jns 0x14001e5bf
mov r12, qword [rsp + 0x80]
mov rcx, r12
call rax
mov ebp, eax
lea rax, [0x140140bb0]
mov qword [rsp + 0x110], rax
cmp byte [rsp + 0x120], 0
jne 0x14001e97f
mov rcx, qword [rsp + 0x118]
test rcx, rcx
je 0x14001e602
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x118], 0
cmp ebp, 1
je 0x14001e825
cmp byte [rsp + 0x77], 0
jns 0x14001e61c
mov rcx, qword [rsp + 0x60]
call fcn.140105028
cmp byte [rsp + 0x97], 0
jns 0x14001e003
mov rcx, qword [rsp + 0x80]
call fcn.140105028
jmp 0x14001e003
test eax, eax
je 0x14001e825
jmp 0x14001e60b
cmp rdx, 0xfffffffffffffffe
je 0x14001e3e2
sar rdx, 1
mov rcx, r12
mov r8, 0xffffffffffffffff
call fcn.140028254
jmp 0x14001e3e2
mov rcx, r14
call fcn.14001d980
mov rax, qword [rdi + 0x2c0]
cmp qword [rdi + 0x2b0], rax
jb 0x14001e982
mov rcx, qword [r14]
lea r12, [rax + rax*2]
lea rsi, [rcx + r12*8]
movups xmmword [rsi], xmm7
mov qword [rsi + 0x10], 0
cmp byte [rsp + 0x77], 0
js 0x14001e6be
mov rax, qword [rsp + 0x70]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi], xmm0
lea r12, [rsp + 0x80]
jmp 0x14001e758
mov r14, qword [rsp + 0x68]
movabs rax, 0x8000000000000000
add rax, 0xffffffffffffffef
cmp r14, rax
ja 0x14001e985
mov rdx, qword [rsp + 0x60]
cmp r14, 0xb
jb 0x14001e72a
lea rbx, [r14 + 8]
and rbx, 0xfffffffffffffff8
mov r15, rcx
lea rcx, [rbx + rbx]
mov qword [rsp + 0x58], rdx
call fcn.140105030
mov rdx, qword [rsp + 0x58]
mov qword [rsi], rax
movabs rcx, 0x8000000000000000
or rbx, rcx
mov qword [r15 + r12*8 + 0x10], rbx
mov qword [r15 + r12*8 + 8], r14
mov rsi, rax
lea r12, [rsp + 0x80]
jmp 0x14001e73b
mov byte [rsi + 0x17], r14b
test r14, r14
lea r12, [rsp + 0x80]
je 0x14001e747
lea r8, [r14 + r14]
mov rcx, rsi
call fcn.14010a000
mov word [rsi + r14*2], 0
mov r14, qword [rsp + 0x40]
mov r15, qword [rsp + 0x38]
mov rax, qword [rdi + 0x2b0]
mov rcx, qword [rdi + 0x2c0]
lea rdx, [rax - 1]
lea rbx, [rcx + 1]
cmp rcx, rdx
mov ecx, 0
cmovne rcx, rbx
mov qword [rdi + 0x2c0], rcx
test rcx, rcx
cmove rcx, rax
dec rcx
cmp rax, rcx
movabs rsi, 0xaaaaaaaaaaaaaaaa
jae 0x14001e44b
jmp 0x14001e98d
mov rdx, qword [rsp + 0x30]
cmp byte [rdx + 0x17], 0
jns 0x14001e7b6
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax]
cmp byte [rsp + 0x97], 0
lea rcx, [rsp + 0x80]
jns 0x14001e7d0
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
mov ebp, eax
mov r14, qword [rsp + 0x40]
mov r15, qword [rsp + 0x38]
movabs rsi, 0xaaaaaaaaaaaaaaaa
jmp 0x14001e5c6
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14001e54c
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
jmp 0x14001e5ad
neg rdx
lea rcx, [rsp + 0xf8]
mov r8, 0xffffffffffffffff
call fcn.140028254
jmp 0x14001e4d7
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], 0
cmp byte [rsp + 0x77], 0
js 0x14001e854
mov rax, qword [rsp + 0x70]
mov qword [r13 + 0x10], rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [r13], xmm0
jmp 0x14001e8de
mov rbx, qword [rsp + 0x68]
movabs rax, 0x8000000000000000
add rax, 0xffffffffffffffef
cmp rbx, rax
ja 0x14001e990
mov rsi, qword [rsp + 0x60]
cmp rbx, 0xb
jb 0x14001e8ac
lea rbp, [rbx + 8]
and rbp, 0xfffffffffffffff8
mov rcx, rbp
add rcx, rbp
call fcn.140105030
mov rdi, rax
mov qword [r13], rax
movabs rax, 0x8000000000000000
or rbp, rax
mov qword [r13 + 0x10], rbp
mov qword [r13 + 8], rbx
jmp 0x14001e8b8
mov byte [r13 + 0x17], bl
mov rdi, r13
test rbx, rbx
je 0x14001e8c7
lea r8, [rbx + rbx]
mov rcx, rdi
mov rdx, rsi
call fcn.14010a000
mov word [rdi + rbx*2], 0
cmp byte [rsp + 0x77], 0
jns 0x14001e8de
mov rcx, qword [rsp + 0x60]
call fcn.140105028
cmp byte [rsp + 0x97], 0
jns 0x14001e914
mov rcx, qword [rsp + 0x80]
call fcn.140105028
jmp 0x14001e914
mov ecx, ebp
call fcn.14002df50
mov dword [rdi + 0x2a0], eax
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], 0
lea rcx, [rsp + 0xa0]
call fcn.140018cb0
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.140107cc0
mov rax, r13
movaps xmm6, xmmword [rsp + 0x140]
movaps xmm7, xmmword [rsp + 0x150]
movaps xmm8, xmmword [rsp + 0x160]
add rsp, 0x178
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x80]
call fcn.14007ce46
int3
int3
int3
int3
call fcn.140106230
int3
int3
mov rcx, rsi
call fcn.14007ce46
int3
mov rcx, r13
call fcn.14007ce46
int3