Function at 0x14002ae5a
Capabilities:
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x328
movaps xmmword [rsp + 0x310], xmm6
mov rbx, r8
mov rdi, rdx
mov qword [rsp + 0x48], rcx
mov rax, qword [0x1401ea088]
xor rax, rsp
mov qword [rsp + 0x308], rax
lea rcx, [rsp + 0xb8]
mov r8d, 0x250
mov dl, 0xaa
call fcn.1401615d0
mov rdx, qword [rdi]
test rdx, rdx
je 0x14002aecc
mov r8, qword [rdi + 8]
xorps xmm0, xmm0
lea rcx, [rsp + 0x90]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.140002d20
jmp 0x14002aeef
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], reloc.WS2_32.dll_ntohs
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
lea rbx, [rsp + 0x90]
mov rcx, rbx
call fcn.140003cac
lea rdx, [0x14019c8d4]
mov r8d, 1
mov rcx, rbx
call fcn.140003cac
mov r14, qword [rbx + 0x10]
test r14, r14
je 0x14002afba
cmp qword [rsp + 0xa8], 0x10
cmovae rbx, qword [rsp + 0x90]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rsi, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, r14d
call rsi
mov ebp, eax
movsxd r8, eax
xorps xmm0, xmm0
lea r15, [rsp + 0x70]
movaps xmmword [r15], xmm0
movaps xmmword [r15 + 0x10], xmm0
mov rcx, r15
xor edx, edx
call fcn.140008ac6
cmp qword [r15 + 0x18], 8
mov rax, r15
jb 0x14002af90
mov rax, qword [rsp + 0x70]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, r14d
call rsi
cmp qword [rsp + 0x88], 8
jb 0x14002afd6
mov r15, qword [rsp + 0x70]
jmp 0x14002afd6
xorps xmm0, xmm0
lea r15, [rsp + 0x70]
movaps xmmword [r15], xmm0
mov qword [r15 + 0x10], 0
mov qword [r15 + 0x18], 7
lea rdx, [rsp + 0xb8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
mov rax, qword [rsp + 0x88]
cmp rax, 8
jb 0x14002b00a
mov rcx, qword [rsp + 0x70]
lea rdx, [rax*2 + 2]
call fcn.140002b34
xorps xmm6, xmm6
mov rax, qword [rsp + 0x48]
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
cmp rbx, 0xffffffffffffffff
je 0x14002b1ec
lea r14, [rsp + 0xe4]
lea r15, [rsp + 0x50]
lea r12, [rsp + 0x70]
mov rsi, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdx, qword [rdi]
test rdx, rdx
je 0x14002b063
mov r8, qword [rdi + 8]
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
mov rcx, r12
call fcn.140002d20
jmp 0x14002b080
movaps xmmword [rsp + 0x70], xmm6
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], reloc.WS2_32.dll_ntohs
mov rcx, r14
call fcn.14018303c
test rax, rax
je 0x14002b118
mov rbp, rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, ebp
call rsi
mov r13d, eax
movsxd r8, eax
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x60], xmm6
mov rcx, r15
xor edx, edx
call fcn.140004cb2
cmp qword [rsp + 0x68], 0x10
mov rax, r15
jb 0x14002b0e3
mov rax, qword [rsp + 0x50]
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, ebp
call rsi
mov r8, qword [rsp + 0x60]
cmp qword [rsp + 0x68], 0x10
mov rdx, r15
jb 0x14002b135
mov rdx, qword [rsp + 0x50]
jmp 0x14002b135
movaps xmmword [rsp + 0x50], xmm6
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
xor r8d, r8d
mov rdx, r15
mov rcx, r12
call fcn.140003cac
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14002b155
mov rcx, qword [rsp + 0x50]
inc rdx
call fcn.140002b34
movaps xmm0, xmmword [rsp + 0x70]
movaps xmm1, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x88], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x80], 0
mov byte [rsp + 0x70], 0
mov rcx, qword [rsp + 0x48]
mov rdx, r15
call fcn.140011f4c
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14002b1ae
mov rcx, qword [rsp + 0x50]
inc rdx
call fcn.140002b34
mov rdx, qword [rsp + 0x88]
cmp rdx, 0x10
jb 0x14002b1c9
mov rcx, qword [rsp + 0x70]
inc rdx
call fcn.140002b34
mov rcx, rbx
lea rdx, [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x14002b040
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x14002b20a
mov rcx, qword [rsp + 0x90]
inc rdx
call fcn.140002b34
mov rcx, qword [rsp + 0x308]
xor rcx, rsp
call fcn.14015c2e0
mov rax, qword [rsp + 0x48]
movaps xmm6, xmmword [rsp + 0x310]
add rsp, 0x328
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret