Function at 0x1400359b0
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
mov r11, rsp
push rbp
push rbx
push r12
push r13
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0xf0
mov rax, qword [0x1400d61c0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov qword [r11 + 0x18], rsi
lea r13, [0x1400c2dc4]
mov qword [r11 - 0x30], rdi
mov r15, rdx
mov qword [r11 - 0x38], r14
mov rbx, rcx
xor r12d, r12d
movabs r9, 0x7fffffffffffffff
nop word [rax + rax]
movzx eax, byte [rbx]
test al, al
jne 0x140035c69
cmp qword [rbx + 0x2d0], r12
je 0x140035f25
test al, al
jne 0x140035c69
mov rcx, qword [rbx + 0x2d0]
mov rax, r12
add rcx, qword [rbx + 0x2c8]
mov rdx, qword [rbx + 0x2b0]
test rdx, rdx
je 0x140035a48
mov rdx, qword [rdx]
test rdx, rdx
je 0x140035a48
mov rax, qword [rdx]
lea rdx, [rcx - 1]
test rax, rax
je 0x140035a66
mov rcx, qword [rax]
test rcx, rcx
je 0x140035a66
mov rax, qword [rcx]
test rax, rax
je 0x140035a66
mov rax, qword [rax]
jmp 0x140035a69
mov rax, r12
mov rcx, qword [rax + 0x10]
lea rsi, [rbx + 0x260]
mov rax, qword [rax + 8]
dec rcx
and rcx, rdx
mov rdx, qword [rax + rcx*8]
cmp rsi, rdx
je 0x140035aa0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rcx, rsi
call fcn.140003170
movabs r9, 0x7fffffffffffffff
mov rdx, qword [rbx + 0x2d0]
mov rax, qword [rbx + 0x2c0]
dec rdx
add rdx, qword [rbx + 0x2c8]
dec rax
and rdx, rax
mov rax, qword [rbx + 0x2b8]
mov rdi, qword [rax + rdx*8]
mov rax, qword [rdi + 0x18]
cmp rax, 8
jb 0x140035b22
mov rcx, qword [rdi]
inc rax
cmp rax, r9
ja 0x140035fdd
add rax, rax
cmp rax, 0x1000
jb 0x140035b1d
test cl, 0x1f
jne 0x140035fd7
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140035fd1
sub rcx, rax
cmp rcx, 8
jb 0x140035fcb
cmp rcx, 0x27
ja 0x140035fc5
mov rcx, rax
call fcn.140080c40
mov qword [rdi + 0x18], 7
cmp qword [rdi + 0x18], 8
mov qword [rdi + 0x10], r12
jb 0x140035b38
mov rdi, qword [rdi]
mov word [rdi], r12w
sub qword [rbx + 0x2d0], 1
jne 0x140035b4d
mov qword [rbx + 0x2c8], r12
mov edx, dword [rbx + 0x2a8]
test edx, edx
je 0x140035b81
cmp edx, 1
je 0x140035b6f
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], r12
mov word [rbp - 9], r12w
jmp 0x140035bd0
mov qword [rbp - 0x79], r13
mov qword [rbp - 0x71], 1
movaps xmm0, xmmword [rbp - 0x79]
jmp 0x140035bae
cmp qword [rbx + 0x2a0], 8
jb 0x140035b94
mov rax, qword [rbx + 0x288]
jmp 0x140035b9b
lea rax, [rbx + 0x288]
mov qword [rbp - 0x69], rax
mov rax, qword [rbx + 0x298]
mov qword [rbp - 0x61], rax
movaps xmm0, xmmword [rbp - 0x69]
lea r8, [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rbp - 9]
mov rcx, rsi
call fcn.14001dd60
cmp qword [rbp + 0xf], 8
mov rcx, qword [rbp - 9]
jae 0x140035bd4
lea rcx, [rbp - 9]
xor r9d, r9d
mov dword [rsp + 0x28], 2
lea r14, [rbx + 4]
mov qword [rsp + 0x20], r12
mov r8, r14
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov qword [rbx + 0x258], rax
mov rax, qword [rbp + 0xf]
mov byte [rbx], 1
cmp rax, 8
jb 0x140035c99
mov rcx, qword [rbp - 9]
inc rax
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
ja 0x140035ffb
add rax, rax
cmp rax, 0x1000
jb 0x140035c62
test cl, 0x1f
jne 0x140035ff5
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140035fef
sub rcx, rax
cmp rcx, 8
jb 0x140035fe9
cmp rcx, 0x27
ja 0x140035fe3
mov rcx, rax
call fcn.140080c40
jmp 0x140035c99
mov rcx, qword [rbx + 0x258]
lea r14, [rbx + 4]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140035c99
mov rcx, qword [rbx + 0x258]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rbx + 0x258], 0xffffffffffffffff
cmp qword [rbx + 0x258], 0xffffffffffffffff
jne 0x140035cd7
movabs r9, 0x7fffffffffffffff
mov byte [rbx], r12b
cmp dword [rbx + 0x2a8], r12d
jne 0x140035a00
lea rcx, [rbx + 0x288]
mov r8d, 1
mov rdx, r13
call fcn.14000b820
jmp 0x1400359f0
lea rdx, [rbx + 0x30]
test rdx, rdx
jne 0x140035ce5
mov r8, r12
jmp 0x140035cfe
cmp word [rdx], r12w
jne 0x140035cf0
mov r8, r12
jmp 0x140035cfe
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r12w
jne 0x140035cf4
mov qword [rbp - 0x39], r12
mov esi, 7
mov qword [rbp - 0x31], rsi
mov word [rbp - 0x49], r12w
test r8, r8
jne 0x140035d23
mov rdi, r12
mov qword [rbp - 0x39], r12
mov word [rbp - 0x49], r12w
jmp 0x140035d34
lea rcx, [rbp - 0x49]
call fcn.14000b820
mov rsi, qword [rbp - 0x31]
mov rdi, qword [rbp - 0x39]
xor edx, edx
lea rcx, [rbp - 0x49]
xor r8d, r8d
call fcn.140014cf0
cmp rax, 0xffffffffffffffff
je 0x140035d67
lea rcx, [rbp - 0x49]
cmp rdi, rax
jb 0x140036001
cmp rsi, 8
mov qword [rbp - 0x39], rax
cmovae rcx, qword [rbp - 0x49]
mov word [rcx + rax*2], r12w
lea rdx, [rbp - 0x49]
mov rcx, rbx
call fcn.140037840
test al, al
jne 0x140035ef8
mov esi, dword [r14]
lea rax, [rbp - 0x49]
shr esi, 4
lea rcx, [rbx + 0x260]
cmp qword [rbp - 0x31], 8
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x29]
cmovae rax, qword [rbp - 0x49]
mov qword [rbp - 0x59], rax
mov rax, qword [rbp - 0x39]
mov qword [rbp - 0x51], rax
movaps xmm0, xmmword [rbp - 0x59]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.14001dd60
and sil, 1
je 0x140035e7d
cmp byte [rbx + 0x280], r12b
je 0x140035e7d
cmp qword [rbp - 0x11], 8
lea rcx, [rbp - 0x29]
cmovae rcx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xa
jb 0x140035e7d
lea rdi, [rbx + 0x2b0]
mov rax, qword [rdi + 0x20]
inc rax
cmp qword [rdi + 0x10], rax
ja 0x140035e0b
mov rcx, rdi
call fcn.140036270
mov rax, qword [rdi + 0x10]
dec rax
and qword [rdi + 0x18], rax
mov rdx, qword [rdi + 0x18]
add rdx, qword [rdi + 0x20]
mov rax, qword [rdi + 0x10]
dec rax
and rdx, rax
mov rax, qword [rdi + 8]
lea r14, [rdx*8]
cmp qword [r14 + rax], r12
jne 0x140035e4c
mov ecx, 0x20
call fcn.140080c00
mov rcx, qword [rdi + 8]
mov qword [r14 + rcx], rax
mov rax, qword [rdi + 8]
mov rcx, qword [r14 + rax]
test rcx, rcx
je 0x140035e79
mov qword [rcx + 0x18], 7
lea rdx, [rbp - 0x29]
mov qword [rcx + 0x10], r12
or r9, 0xffffffffffffffff
xor r8d, r8d
mov word [rcx], r12w
call fcn.140003170
inc qword [rdi + 0x20]
test sil, sil
mov eax, r12d
setne al
inc eax
test dword [rbx + 0x284], eax
je 0x140035ecd
mov ecx, dword [rbx + 0x2a8]
test ecx, ecx
je 0x140035f37
cmp ecx, 1
jne 0x140035ecd
lea rdx, [rbx + 0x288]
cmp qword [rdx + 0x18], 8
jb 0x140035eb4
mov rdx, qword [rdx]
cmp qword [rbp - 0x31], 8
lea rcx, [rbp - 0x49]
cmovae rcx, qword [rbp - 0x49]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
cmp eax, 1
je 0x140035f37
mov r8, qword [rbp - 0x11]
cmp r8, 8
jb 0x140035ee7
mov rdx, qword [rbp - 0x29]
lea rcx, [rbp - 0x29]
inc r8
call fcn.140004d70
mov qword [rbp - 0x11], 7
mov qword [rbp - 0x19], r12
mov word [rbp - 0x29], r12w
mov r8, qword [rbp - 0x31]
movabs r9, 0x7fffffffffffffff
cmp r8, 8
jb 0x140035a00
mov rdx, qword [rbp - 0x49]
lea rcx, [rbp - 0x49]
inc r8
call fcn.140004d70
jmp 0x1400359f0
mov qword [r15 + 0x18], 7
mov qword [r15 + 0x10], r12
mov word [r15], r12w
jmp 0x140035f8e
mov qword [r15 + 0x18], 7
lea rdx, [rbp - 0x29]
mov qword [r15 + 0x10], r12
or r9, 0xffffffffffffffff
xor r8d, r8d
mov word [r15], r12w
mov rcx, r15
call fcn.140003170
mov r8, qword [rbp - 0x11]
cmp r8, 8
jb 0x140035f74
mov rdx, qword [rbp - 0x29]
lea rcx, [rbp - 0x29]
inc r8
call fcn.140004d70
lea rcx, [rbp - 0x49]
mov qword [rbp - 0x11], 7
mov qword [rbp - 0x19], r12
mov word [rbp - 0x29], r12w
call fcn.140002120
mov r14, qword [rsp + 0xe0]
mov rax, r15
mov rdi, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0x130]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400812a0
add rsp, 0xf0
pop r15
pop r13
pop r12
pop rbx
pop rbp
ret
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400053b0
int3