Function at 0x1400052ec
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0xbc8]
sub rsp, 0xcc0
mov rdi, rcx
xor ebx, ebx
mov rcx, qword [0x140023c50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x184
mov esi, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
call fcn.1400046a4
lea r14d, [rbx + 0x5c]
cmp word [rdi], r14w
jne 0x140005426
cmp word [rdi + 2], bx
je 0x140005351
cmp word [rdi + 2], r14w
jne 0x140005426
mov edx, r14d
lea rcx, [rdi + 4]
call fcn.140006f28
test rax, rax
jne 0x140005380
cmp word [rdi + 2], r14w
lea edx, [rax + 1]
cmove rbx, rdi
mov rcx, rbx
call fcn.140005bac
call fcn.1400047c0
jmp 0x1400055a6
cmp word [rax + 2], bx
jne 0x140005426
mov rdx, rdi
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp + 0x380]
call fcn.140003820
call fcn.140005aec
xor edx, edx
xor ecx, ecx
call fcn.140005bac
cmp qword [0x140023c78], rbx
je 0x1400055a4
call fcn.140005ab8
jmp 0x140005410
mov rdx, rax
lea rcx, [rbp + 0x7a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0x7a0]
call fcn.14000d4a0
test eax, eax
jne 0x14000540b
lea rcx, [rbp + 0x7a0]
call fcn.1400059b8
call fcn.140005ad0
test rax, rax
jne 0x1400053c8
call fcn.140005ab0
mov esi, eax
call fcn.140005aa8
jmp 0x1400055a4
mov rdx, rdi
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
movzx ecx, word [rsp + 0x20]
call fcn.14000d410
test eax, eax
je 0x14000547f
movzx eax, word [rsp + 0x22]
cmp ax, 0x3a
je 0x140005452
test ax, ax
jne 0x14000547f
test ax, ax
jne 0x140005460
lea rdx, [0x140016ad0]
jmp 0x140005474
cmp ax, 0x3a
jne 0x14000547f
cmp word [rsp + 0x24], bx
jne 0x14000547f
lea rdx, [0x140016944]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x20]
call fcn.140009e20
mov edx, r14d
mov rcx, rax
mov rdi, rax
call fcn.140006c60
mov r14, rax
test rax, rax
jne 0x1400054ae
mov rcx, rdi
call fcn.14000a1e8
xor eax, eax
jmp 0x1400055a6
mov rdx, rdi
mov word [rax], bx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [r14 + 2]
lea rcx, [rbp + 0x9b0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea r9, [rbp + 0x9b0]
lea r8, [rsp + 0x20]
lea rdx, [0x140016ad8]
lea rcx, [rbp + 0x590]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, rdi
call fcn.14000a1e8
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400054a7
test byte [rbp + 0x130], 0x10
je 0x140005583
lea rdx, [0x1400166cc]
lea rcx, [rbp + 0x15c]
call fcn.14000d41c
test eax, eax
je 0x140005583
lea rdx, [0x1400166d0]
lea rcx, [rbp + 0x15c]
call fcn.14000d41c
test eax, eax
je 0x140005583
test byte [rbp + 0x130], 6
jne 0x140005583
lea r9, [rbp + 0x15c]
lea r8, [rsp + 0x20]
lea rdx, str._s_s
lea rcx, [rbp + 0x590]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x590]
call fcn.1400046b0
inc esi
lea rdx, [rbp + 0x130]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140005515
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
lea r11, [rsp + 0xcc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret