Function at 0x140086230
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x700
mov rax, qword [0x1401f4df8]
xor rax, rsp
mov qword [rsp + 0x6f0], rax
mov qword [r11 + 8], rbx
lea rcx, [rsp + 0x30]
xor edx, edx
mov qword [r11 + 0x18], rdi
mov r8d, 0x104
call fcn.140099f70
lea rdx, [0x14010f208]
lea rcx, str.HOME_ROOT__nTEMP_TEMP__nDV_DVDIR__nLOG_DATA_log_nBIN_DATA__bin_nLOCK_DATA__nEXE_DRIVER__nDLL_DRIVER__nDLLALT_SYSTEM_IntelDPTF_n_nDPTF_ROOT_ui_nDSP_ROOT_dsp_nCMD_ROOT_cmd_nUI_ROOT_ui_n
call fcn.140085a00
mov rdi, rax
test rax, rax
jne 0x140086298
lea rdx, [0x14010f208]
lea rcx, str.LEGDRIVERDIR_SYSTEM_IntelDPTF_nDATADIR_DRVDATA_IntelDPTF_nLEGDATADIR_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_nSSDVDIR_DATA_dv_nLEGDVDIR_DATA__n
call fcn.140085a00
mov rdi, rax
lea rdx, str.LEGDATADIR
lea rcx, str.HOME_ROOT__nTEMP_TEMP__nDV_DVDIR__nLOG_DATA_log_nBIN_DATA__bin_nLOCK_DATA__nEXE_DRIVER__nDLL_DRIVER__nDLLALT_SYSTEM_IntelDPTF_n_nDPTF_ROOT_ui_nDSP_ROOT_dsp_nCMD_ROOT_cmd_nUI_ROOT_ui_n
call fcn.140085a00
mov rbx, rax
test rax, rax
jne 0x1400862c9
lea rdx, str.LEGDATADIR
lea rcx, str.LEGDRIVERDIR_SYSTEM_IntelDPTF_nDATADIR_DRVDATA_IntelDPTF_nLEGDATADIR_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_nSSDVDIR_DATA_dv_nLEGDVDIR_DATA__n
call fcn.140085a00
mov rbx, rax
lea rdx, [0x14010f21c]
lea rcx, str.HOME_ROOT__nTEMP_TEMP__nDV_DVDIR__nLOG_DATA_log_nBIN_DATA__bin_nLOCK_DATA__nEXE_DRIVER__nDLL_DRIVER__nDLLALT_SYSTEM_IntelDPTF_n_nDPTF_ROOT_ui_nDSP_ROOT_dsp_nCMD_ROOT_cmd_nUI_ROOT_ui_n
call fcn.140085a00
mov rsi, rax
test rax, rax
jne 0x1400862fa
lea rdx, [0x14010f21c]
lea rcx, str.LEGDRIVERDIR_SYSTEM_IntelDPTF_nDATADIR_DRVDATA_IntelDPTF_nLEGDATADIR_WINDOWS_ServiceProfilesLocalServiceAppDataLocalIntelDPTF_nSSDVDIR_DATA_dv_nLEGDVDIR_DATA__n
call fcn.140085a00
mov rsi, rax
test rdi, rdi
je 0x140086499
test rbx, rbx
je 0x140086491
test rsi, rsi
je 0x140086491
mov rcx, rdi
call fcn.1400855b0
test eax, eax
jne 0x140086491
mov qword [rsp + 0x718], rbp
lea r8, str._s_s
lea rbp, str.dsp.dv
mov r9, rsi
lea rdx, [rsp + 0x4d0]
mov qword [rsp + 0x20], rbp
mov ecx, 0x104
call fcn.140085730
mov r9, rdi
mov qword [rsp + 0x20], rbp
lea r8, str._s_s
mov ecx, 0x104
lea rdx, [rsp + 0x3c0]
call fcn.140085730
mov r8b, 1
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0x4d0]
call fcn.140084c10
lea rax, str..dv
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x14010e32c]
lea rax, [0x14010e328]
mov ecx, 0x104
lea rdx, [rsp + 0x5e0]
mov qword [rsp + 0x20], rax
call fcn.140085730
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140086489
lea r8, [rsp + 0x16c]
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.1400a7108
lea rax, [rsp + 0x30]
mov r9, rbx
lea r8, str._s_s
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x4d0]
mov ecx, 0x104
call fcn.140085730
lea rax, [rsp + 0x30]
mov r9, rdi
lea r8, str._s_s
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x3c0]
mov ecx, 0x104
call fcn.140085730
xor r8d, r8d
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0x4d0]
call fcn.140084c10
lea rdx, [rsp + 0x280]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140086489
lea r8, [rsp + 0x2ac]
jmp 0x1400863ed
mov rbp, qword [rsp + 0x718]
mov rcx, rdi
call fcn.1400a7024
mov rdi, qword [rsp + 0x720]
test rbx, rbx
je 0x1400864ae
mov rcx, rbx
call fcn.1400a7024
mov rbx, qword [rsp + 0x710]
test rsi, rsi
je 0x1400864c3
mov rcx, rsi
call fcn.1400a7024
mov rcx, qword [rsp + 0x6f0]
xor rcx, rsp
call fcn.140098420
add rsp, 0x700
pop rsi
ret