Function at 0x14001dc60
Capabilities:
Enumerate files on windows

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x13c0
call fcn.140061300
sub rsp, rax
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov qword [rsp + 0x13f8], rbx
mov qword [rsp + 0x1400], rbp
mov rax, qword [0x140087990]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0xe0], 7
mov qword [rsp + 0xd8], rbp
mov word [rsp + 0xc8], bp
xor r8d, r8d
lea rdx, [0x140073800]
lea rcx, [rsp + 0xc0]
call fcn.14003b810
nop
test rdi, rdi
je 0x14001dd01
mov ecx, 0x800
mov rax, rdi
cmp word [rax], 0
je 0x14001dd01
add rax, 2
sub rcx, 1
jne 0x14001dcf1
mov edx, 0x800
lea rcx, [rsp + 0x3b0]
lea rax, [rsp + 0x3b0]
sub rdi, rax
nop dword [rax]
lea rax, [rdx + 0x7ffff7fe]
test rax, rax
je 0x14001dd44
movzx eax, word [rdi + rcx]
test ax, ax
je 0x14001dd44
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14001dd20
jmp 0x14001dd49
test rdx, rdx
jne 0x14001dd4d
sub rcx, 2
mov word [rcx], bp
lea r8, [0x140074854]
mov edx, 0x800
lea rcx, [rsp + 0x3b0]
call fcn.1400028e0
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001ddcb
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rbp
mov word [rbx + 8], bp
xor r8d, r8d
lea rdx, [0x140073800]
mov rcx, rbx
call fcn.14003b810
nop
cmp qword [rsp + 0xe0], 8
jb 0x14001ddc3
mov rcx, qword [rsp + 0xc8]
call fcn.140044814
mov rax, rbx
jmp 0x14001e6e6
or r12, 0xffffffffffffffff
movabs r13, 0xd6bf94d5e57a42bd
movabs r14, 0x2b6109100
nop word [rax + rax]
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x28], bp
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x16c]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x16c]
lea rcx, [rsp + 0x20]
call fcn.14003b810
nop
lea rcx, [rsp + 0x28]
mov r10, qword [rsp + 0x28]
mov r9, qword [rsp + 0x40]
cmp r9, 8
cmovae rcx, r10
mov edi, 1
mov r8, qword [rsp + 0x38]
cmp r8, rdi
cmovb rdi, r8
lea rdx, [0x14007485c]
test rdi, rdi
je 0x14001de87
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001de79
add rcx, 2
add rdx, 2
sub rdi, 1
jne 0x14001de61
jmp 0x14001de87
mov edi, 1
cmp word [rcx], ax
cmovb edi, r12d
jmp 0x14001de89
mov edi, ebp
movsxd rax, edi
test edi, edi
jne 0x14001dea4
cmp r8, 1
jae 0x14001de9b
mov eax, r12d
jmp 0x14001dea4
mov eax, ebp
cmp r8, 1
setne al
test eax, eax
sete dil
cmp r9, 8
jb 0x14001deb8
mov rcx, r10
call fcn.140044814
test dil, dil
jne 0x14001e682
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x28], bp
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x16c]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x16c]
lea rcx, [rsp + 0x20]
call fcn.14003b810
nop
lea rcx, [rsp + 0x28]
mov r10, qword [rsp + 0x28]
mov r9, qword [rsp + 0x40]
cmp r9, 8
cmovae rcx, r10
mov edi, 2
mov r8, qword [rsp + 0x38]
cmp r8, rdi
cmovb rdi, r8
lea rdx, [0x140074860]
test rdi, rdi
je 0x14001df58
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001df4a
add rcx, 2
add rdx, 2
sub rdi, 1
jne 0x14001df32
jmp 0x14001df58
mov edi, 1
cmp word [rcx], ax
cmovb edi, r12d
jmp 0x14001df5a
mov edi, ebp
movsxd rax, edi
test edi, edi
jne 0x14001df75
cmp r8, 2
jae 0x14001df6c
mov eax, r12d
jmp 0x14001df75
mov eax, ebp
cmp r8, 2
setne al
test eax, eax
sete dil
cmp r9, 8
jb 0x14001df89
mov rcx, r10
call fcn.140044814
test dil, dil
jne 0x14001e682
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x28], bp
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x16c]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x16c]
lea rcx, [rsp + 0x20]
call fcn.14003b810
nop
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xc0]
call fcn.14003b540
nop
cmp qword [rsp + 0x40], 8
jb 0x14001dffa
mov rcx, qword [rsp + 0x28]
call fcn.140044814
mov edx, dword [rsp + 0x15c]
imul edx, edx, 0x3b9aca00
add edx, dword [rsp + 0x160]
lea rcx, [rsp + 0x68]
call fcn.14000b570
nop
mov r8, rax
lea rdx, [0x140074870]
lea rcx, [rsp + 0x90]
call fcn.14003e020
nop
lea r8, [0x140074868]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14003dc60
nop
mov r9, r12
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.14003b540
nop
cmp qword [rsp + 0x40], 8
jb 0x14001e06f
mov rcx, qword [rsp + 0x28]
call fcn.140044814
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x28], bp
cmp qword [rsp + 0xb0], 8
jb 0x14001e09a
mov rcx, qword [rsp + 0x98]
call fcn.140044814
mov qword [rsp + 0xb0], 7
mov qword [rsp + 0xa8], rbp
mov word [rsp + 0x98], bp
cmp qword [rsp + 0x88], 8
jb 0x14001e0cb
mov rcx, qword [rsp + 0x70]
call fcn.140044814
mov eax, dword [rsp + 0x140]
test al, 0x10
je 0x14001e0f7
mov r8d, 4
lea rdx, str.dir
lea rcx, [rsp + 0xc0]
call fcn.14003b690
mov eax, dword [rsp + 0x140]
test al, 0x20
je 0x14001e11c
mov r8d, 5
lea rdx, str.arch
lea rcx, [rsp + 0xc0]
call fcn.14003b690
mov eax, dword [rsp + 0x140]
bt eax, 0xb
jae 0x14001e143
mov r8d, 5
lea rdx, str.comp
lea rcx, [rsp + 0xc0]
call fcn.14003b690
mov eax, dword [rsp + 0x140]
bt eax, 0xe
jae 0x14001e16a
mov r8d, 4
lea rdx, str.enc
lea rcx, [rsp + 0xc0]
call fcn.14003b690
mov eax, dword [rsp + 0x140]
test al, 2
je 0x14001e18f
mov r8d, 4
lea rdx, str.hid
lea rcx, [rsp + 0xc0]
call fcn.14003b690
mov eax, dword [rsp + 0x140]
test al, 1
je 0x14001e1b4
mov r8d, 3
lea rdx, [0x1400748c8]
lea rcx, [rsp + 0xc0]
call fcn.14003b690
mov eax, dword [rsp + 0x140]
test al, 4
je 0x14001e1d9
mov r8d, 4
lea rdx, str.sys
lea rcx, [rsp + 0xc0]
call fcn.14003b690
mov eax, dword [rsp + 0x140]
bt eax, 8
jae 0x14001e200
mov r8d, 4
lea rdx, str.tmp
lea rcx, [rsp + 0xc0]
call fcn.14003b690
mov eax, dword [rsp + 0x140]
bt eax, 0x10
jae 0x14001e227
mov r8d, 5
lea rdx, str.virt
lea rcx, [rsp + 0xc0]
call fcn.14003b690
mov eax, dword [rsp + 0x140]
bt eax, 0xc
jae 0x14001e24e
mov r8d, 8
lea rdx, str.offline
lea rcx, [rsp + 0xc0]
call fcn.14003b690
mov eax, dword [rsp + 0x140]
bt eax, 0xd
jae 0x14001e275
mov r8d, 8
lea rdx, str.indexed
lea rcx, [rsp + 0xc0]
call fcn.14003b690
mov eax, dword [rsp + 0x140]
test al, al
jns 0x14001e293
mov r8d, 5
lea rdx, str.norm
lea rcx, [rsp + 0xc0]
call fcn.14003b690
mov r8d, 1
lea rdx, [0x140074870]
lea rcx, [rsp + 0xc0]
call fcn.14003b690
mov qword [rsp + 0x130], 7
mov qword [rsp + 0x128], rbp
mov word [rsp + 0x118], bp
mov qword [rsp + 0x108], send
mov qword [rsp + 0x100], rbp
mov byte [rsp + 0xf0], 0
mov eax, dword [rsp + 0x144]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x148]
mov dword [rsp + 0x5c], eax
mov rax, r13
mul qword [rsp + 0x58]
shr rdx, 0x17
sub rdx, r14
mov qword [rsp + 0x48], rdx
lea rcx, [rsp + 0x48]
call fcn.140045224
mov r9, rax
lea r8, str._d._m._Y__H:_M:_S
mov edx, 0x20
lea rcx, [rsp + 0x390]
call fcn.140047874
mov qword [rsp + 0x40], send
mov qword [rsp + 0x38], rbp
mov byte [rsp + 0x28], 0
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x390]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x390]
lea rcx, [rsp + 0x20]
call fcn.14003afb0
nop
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xe8]
call fcn.140039420
nop
cmp qword [rsp + 0x40], 0x10
jb 0x14001e39c
mov rcx, qword [rsp + 0x28]
call fcn.140044814
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x110]
call fcn.14000da50
lea r8, [0x140074870]
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x68]
call fcn.14003dc60
nop
mov r9, r12
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.14003b540
nop
cmp qword [rsp + 0x88], 8
jb 0x14001e3f7
mov rcx, qword [rsp + 0x70]
call fcn.140044814
mov eax, dword [rsp + 0x14c]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x64], eax
mov rax, r13
mul qword [rsp + 0x60]
shr rdx, 0x17
sub rdx, r14
mov qword [rsp + 0x48], rdx
lea rcx, [rsp + 0x48]
call fcn.140045224
mov r9, rax
lea r8, str._d._m._Y__H:_M:_S
mov edx, 0x20
lea rcx, [rsp + 0x390]
call fcn.140047874
mov qword [rsp + 0x40], send
mov qword [rsp + 0x38], rbp
mov byte [rsp + 0x28], 0
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x390]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x390]
lea rcx, [rsp + 0x20]
call fcn.14003afb0
nop
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xe8]
call fcn.140039420
nop
cmp qword [rsp + 0x40], 0x10
jb 0x14001e4ae
mov rcx, qword [rsp + 0x28]
call fcn.140044814
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x110]
call fcn.14000da50
lea r8, [0x140074870]
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x68]
call fcn.14003dc60
nop
mov r9, r12
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.14003b540
nop
cmp qword [rsp + 0x88], 8
jb 0x14001e509
mov rcx, qword [rsp + 0x70]
call fcn.140044814
mov eax, dword [rsp + 0x154]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x158]
mov dword [rsp + 0x54], eax
mov rax, r13
mul qword [rsp + 0x50]
shr rdx, 0x17
sub rdx, r14
mov qword [rsp + 0x48], rdx
lea rcx, [rsp + 0x48]
call fcn.140045224
mov r9, rax
lea r8, str._d._m._Y__H:_M:_S
mov edx, 0x20
lea rcx, [rsp + 0x390]
call fcn.140047874
mov qword [rsp + 0x40], send
mov qword [rsp + 0x38], rbp
mov byte [rsp + 0x28], 0
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x390]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x390]
lea rcx, [rsp + 0x20]
call fcn.14003afb0
nop
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xe8]
call fcn.140039420
nop
cmp qword [rsp + 0x40], 0x10
jb 0x14001e5c0
mov rcx, qword [rsp + 0x28]
call fcn.140044814
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x110]
call fcn.14000da50
lea r8, [0x140074870]
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x68]
call fcn.14003dc60
nop
mov r9, r12
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.14003b540
nop
cmp qword [rsp + 0x88], 8
jb 0x14001e61b
mov rcx, qword [rsp + 0x70]
call fcn.140044814
mov r8d, 2
lea rdx, [0x1400738d0]
lea rcx, [rsp + 0xc0]
call fcn.14003b690
nop
cmp qword [rsp + 0x108], 0x10
jb 0x14001e64e
mov rcx, qword [rsp + 0xf0]
call fcn.140044814
mov qword [rsp + 0x108], send
mov qword [rsp + 0x100], rbp
mov byte [rsp + 0xf0], 0
cmp qword [rsp + 0x130], 8
jb 0x14001e682
mov rcx, qword [rsp + 0x118]
call fcn.140044814
lea rdx, [rsp + 0x140]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001ddf0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rbp
mov word [rbx + 8], bp
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0xc0]
mov rcx, rbx
call fcn.140039eb0
nop
cmp qword [rsp + 0xe0], 8
jb 0x14001e6e3
mov rcx, qword [rsp + 0xc8]
call fcn.140044814
mov rax, rbx
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.140044830
lea r11, [rsp + 0x13c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret