Function at 0x14009e240
Capabilities:
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r9
mov ebp, r8d
mov r14, rdx
mov rdi, rcx
mov qword [rcx], 0xffffffffffffffff
lea rax, [rcx + 0x258]
cmp byte [rdx + 0x17], 0
js 0x14009e286
mov rcx, qword [r14 + 0x10]
mov qword [rax + 0x10], rcx
movdqu xmm0, xmmword [r14]
movdqu xmmword [rax], xmm0
jmp 0x14009e323
mov r15, qword [r14]
mov rbx, qword [r14 + 8]
cmp rbx, 0xa
ja 0x14009e29b
mov byte [rdi + 0x26f], bl
jmp 0x14009e310
mov byte [rsp + 0x2f], bpl
movabs rbp, 0x7fffffffffffffef
cmp rbx, rbp
ja 0x14009e6a4
mov r13, rbx
or r13, 7
inc r13
js 0x14009e6a9
mov r12, r13
add r12, r13
nop dword [rax]
mov rcx, r12
call sub.msvcrt.dll_malloc
test rax, rax
jne 0x14009e2ef
mov rax, qword [0x14027c368]
test rax, rax
je 0x14009e2ed
call rax
jmp 0x14009e2d0
xor eax, eax
mov qword [rdi + 0x258], rax
add rbp, 0x11
or r13, rbp
mov qword [rdi + 0x268], r13
mov qword [rdi + 0x260], rbx
movzx ebp, byte [rsp + 0x2f]
lea r8, [rbx + rbx]
add r8, 2
mov rcx, rax
mov rdx, r15
call fcn.140122c10
pxor xmm0, xmm0
movdqa xmmword [rdi + 0x270], xmm0
mov qword [rdi + 0x280], 0
mov word [rdi + 0x2b8], 0
movabs rax, 0xffff0000ffff
mov qword [rdi + 0x2b0], rax
pcmpeqd xmm0, xmm0
movdqa xmmword [rdi + 0x290], xmm0
movabs rax, 0x8000000000000000
mov qword [rdi + 0x2a8], rax
mov qword [rdi + 0x2a0], 0
movzx eax, byte [r14 + 0x17]
test al, al
jns 0x14009e389
mov rax, qword [r14 + 8]
test rax, rax
je 0x14009e3f6
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
mov byte [rsp + 0x47], 1
mov word [rsp + 0x30], 0x2a
lea rcx, [rsp + 0x30]
xor edx, edx
xor r8d, r8d
call fcn.140048fe0
mov r12, rax
movzx ecx, byte [rsp + 0x67]
mov r15, rcx
test cl, cl
jns 0x14009e3d0
mov r15, qword [rsp + 0x58]
mov rax, r12
add rax, r15
cmp r15, rax
jae 0x14009e41b
lea rcx, [rsp + 0x50]
mov rdx, r12
call fcn.14003b080
cmp byte [rsp + 0x67], 0
js 0x14009e441
lea rax, [rsp + 0x50]
jmp 0x14009e446
movzx eax, byte [0x140277aa0]
test al, al
je 0x14009e673
mov dword [rsi], 2
lea rax, str.p__
mov qword [rsi + 8], rax
jmp 0x14009e662
test cl, cl
js 0x14009e42a
mov byte [rsp + 0x67], al
lea rcx, [rsp + 0x50]
jmp 0x14009e434
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov word [rcx + rax*2], 0
cmp byte [rsp + 0x67], 0
jns 0x14009e3ef
mov rax, qword [rsp + 0x50]
lea rdx, [rax + r15*2]
lea r15, [rsp + 0x30]
mov rcx, r15
mov r8, r12
call fcn.140048fe0
cmp byte [rsp + 0x47], 0
js 0x14009e481
cmp byte [r14 + 0x17], 0
js 0x14009e492
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0x40], rax
movdqu xmm0, xmmword [r14]
movdqa xmmword [rsp + 0x30], xmm0
jmp 0x14009e530
mov rcx, qword [rsp + 0x30]
call sub.msvcrt.dll_free
cmp byte [r14 + 0x17], 0
jns 0x14009e468
mov r12, qword [r14]
mov r13, qword [r14 + 8]
cmp r13, 0xa
ja 0x14009e4ab
mov byte [rsp + 0x47], r13b
lea rax, [rsp + 0x30]
jmp 0x14009e51a
mov byte [rsp + 0x2f], bpl
movabs rbp, 0x7fffffffffffffef
cmp r13, rbp
ja 0x14009e6a4
mov rbx, r13
or rbx, 7
inc rbx
js 0x14009e6a9
lea r14, [rbx + rbx]
nop word [rax + rax]
mov rcx, r14
call sub.msvcrt.dll_malloc
test rax, rax
jne 0x14009e4ff
mov rax, qword [0x14027c368]
test rax, rax
je 0x14009e4fd
call rax
jmp 0x14009e4e0
xor eax, eax
mov qword [rsp + 0x30], rax
add rbp, 0x11
or rbx, rbp
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
movzx ebp, byte [rsp + 0x2f]
lea r8, [r13 + 2]
add r8, r13
mov rcx, rax
mov rdx, r12
call fcn.140122c10
lea rdx, [rsp + 0x50]
mov rcx, r15
call fcn.140032412
cmp byte [rsp + 0x47], 0
jns 0x14009e549
mov r15, qword [rsp + 0x30]
lea r14, [rdi + 8]
mov rcx, r15
mov rdx, r14
call qword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov qword [rdi], rax
cmp byte [rsp + 0x47], 0
js 0x14009e5b1
cmp byte [rsp + 0x67], 0
js 0x14009e5c2
cmp qword [rdi], 0xffffffffffffffff
je 0x14009e5d2
mov rcx, rdi
call fcn.14009f220
test al, al
jne 0x14009e662
mov rsi, qword [sym.imp.KERNEL32.DLL_FindNextFileW]
nop word [rax + rax]
mov rcx, qword [rdi]
mov rdx, r14
call rsi
test eax, eax
je 0x14009e62a
mov rcx, rdi
call fcn.14009f220
test al, al
je 0x14009e590
jmp 0x14009e662
mov rcx, qword [rsp + 0x30]
call sub.msvcrt.dll_free
cmp byte [rsp + 0x67], 0
jns 0x14009e56a
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_free
cmp qword [rdi], 0xffffffffffffffff
jne 0x14009e570
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.140046640
mov edi, eax
movzx eax, byte [0x140277aa0]
test al, al
je 0x14009e6ae
mov dword [rsi], edi
lea rax, str.p__
mov qword [rsi + 8], rax
test bpl, 2
je 0x14009e662
cmp edi, 0xd
jne 0x14009e662
mov dword [rsi], 0
movzx eax, byte [0x140277a98]
test al, al
je 0x14009e6df
lea rax, [0x140275190]
mov qword [rsi + 8], rax
jmp 0x14009e662
movzx eax, byte [0x140277a98]
test al, al
je 0x14009e710
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.DLL_FindClose]
test eax, eax
jne 0x14009e65b
call qword [sym.imp.KERNEL32.DLL_GetLastError]
movzx eax, byte [0x140277aa0]
test al, al
je 0x14009e741
mov qword [rdi], 0xffffffffffffffff
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140277aa0]
call fcn.140043169
test eax, eax
je 0x14009e405
lea rcx, [0x14003b5a0]
call fcn.140001440
lea rcx, [0x140277aa0]
call fcn.1400431eb
jmp 0x14009e405
call sub.msvcrt.dll_abort
call fcn.140015ae8
lea rcx, [0x140277aa0]
call fcn.140043169
test eax, eax
je 0x14009e5f0
lea rcx, [0x14003b5a0]
call fcn.140001440
lea rcx, [0x140277aa0]
call fcn.1400431eb
jmp 0x14009e5f0
lea rcx, [0x140277a98]
call fcn.140043169
test eax, eax
je 0x14009e61d
lea rcx, [0x14003b650]
call fcn.140001440
lea rcx, [0x140277a98]
call fcn.1400431eb
jmp 0x14009e61d
lea rcx, [0x140277a98]
call fcn.140043169
test eax, eax
je 0x14009e639
lea rcx, [0x14003b650]
call fcn.140001440
lea rcx, [0x140277a98]
call fcn.1400431eb
jmp 0x14009e639
lea rcx, [0x140277aa0]
call fcn.140043169
test eax, eax
je 0x14009e65b
lea rcx, [0x14003b5a0]
call fcn.140001440
lea rcx, [0x140277aa0]
call fcn.1400431eb
jmp 0x14009e65b