Function at 0x140002b80
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rdi
push r13
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, rcx
mov edx, 1
mov ecx, 0x200000
call fcn.140009b88
mov qword [rsp + 0x68], rax
mov r13, rax
test rax, rax
je 0x14000313c
mov edx, dword [rdi]
mov dword [rax], edx
mov ecx, dword [rdi + 4]
mov qword [rsp + 0x2e8], rbx
mov qword [rsp + 0x2f0], rsi
call qword [sym.imp.WS2_32.dll_ntohl]
movsxd rsi, eax
mov edx, 1
lea ecx, [rsi + 1]
movsxd rcx, ecx
call fcn.140009b88
mov rbx, rax
test rax, rax
jne 0x140002c0d
mov rcx, r13
call fcn.14000a0b4
jmp 0x14000312c
mov r8, rsi
lea rdx, [rdi + 8]
mov rcx, rbx
call fcn.1400096b0
mov edx, 1
mov ecx, 0x5000
call fcn.140009b88
mov qword [rbp - 0x80], rax
mov rsi, rax
test rax, rax
jne 0x140002c4c
mov rcx, r13
call fcn.14000a0b4
mov rcx, rbx
call fcn.14000a0b4
jmp 0x14000312c
xor r9d, r9d
mov r8, rsi
mov edx, 0x5000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x140002c81
mov rcx, r13
call fcn.14000a0b4
mov rcx, rbx
call fcn.14000a0b4
mov rcx, rsi
call fcn.14000a0b4
jmp 0x14000312c
mov rcx, rbx
call fcn.14000a0b4
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140002c90
lea rcx, [r13 + 4]
mov r8d, edi
mov rdx, rsi
mov ebx, edi
call fcn.1400096b0
xor edx, edx
mov byte [rbx + r13 + 4], 0xa
mov r8d, 0x140
lea rcx, [rbp - 0x50]
call fcn.140008f40
lea rdx, [rbp - 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x78], rax
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140002d08
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r9d, r9d
lea ecx, [rbx + 0x35]
mov r8d, eax
mov rdx, rsi
call fcn.140005880
mov rcx, r13
call fcn.14000a0b4
mov rcx, rsi
call fcn.14000a0b4
jmp 0x14000312c
mov edx, 1
mov qword [rsp + 0x2b8], r14
mov ecx, 0x1400
call fcn.140009b88
mov r14, rax
test rax, rax
jne 0x140002d45
mov rcx, r13
call fcn.14000a0b4
mov rcx, rsi
call fcn.14000a0b4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x140003124
movzx eax, word [0x140022208]
add edi, 5
movaps xmm0, xmmword [str.44093009253032642f253032642f2530326420253032643a253032643a253032640925730a]
movaps xmm1, xmmword [0x1400221d0]
movaps xmmword [rbp + 0xf0], xmm0
movaps xmm0, xmmword [0x1400221e0]
movaps xmmword [rbp + 0x110], xmm0
movsd xmm0, qword [0x140022200]
movsd qword [rbp + 0x130], xmm0
movaps xmm0, xmmword [str.4609254936346409253032642f253032642f2530326420253032643a253032643a253032640925730a]
movaps xmmword [rbp + 0x100], xmm1
movaps xmm1, xmmword [0x1400221f0]
mov word [rbp + 0x138], ax
movzx eax, byte [0x14002220a]
movaps xmmword [rbp + 0x140], xmm0
movaps xmm0, xmmword [0x140022230]
movaps xmmword [rbp + 0x120], xmm1
movaps xmm1, xmmword [0x140022220]
mov byte [rbp + 0x13a], al
movzx eax, word [0x140022260]
movaps xmmword [rbp + 0x160], xmm0
movaps xmm0, xmmword [0x140022250]
movaps xmmword [rbp + 0x150], xmm1
movaps xmm1, xmmword [0x140022240]
mov word [rbp + 0x190], ax
movzx eax, byte [0x140022262]
mov qword [rsp + 0x2f8], r12
movaps xmmword [rbp + 0x180], xmm0
mov dword [rsp + 0x60], edi
movaps xmmword [rbp + 0x170], xmm1
mov byte [rbp + 0x192], al
mov qword [rsp + 0x2b0], r15
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x3c]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea r8, [rbp - 0x78]
xor ecx, ecx
lea rdx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
test byte [rbp - 0x50], 0x10
je 0x140002f62
lea rax, [rbp + 0xf0]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x140002e56
lea ecx, [rsi + 2]
mov edx, 1
call fcn.140009b88
mov r15, rax
test rax, rax
je 0x140003114
shr esi, 1
mov r12d, 0
je 0x140002ef6
mov r13, rax
nop word [rax + rax]
lea ebx, [r12 + r12]
movsx ecx, byte [rbp + rbx + 0xf0]
call fcn.140009fb0
sub al, 0x30
movzx edi, al
lea eax, [rbx + 1]
movsx ecx, byte [rbp + rax + 0xf0]
call fcn.140009fb0
sub al, 0x30
lea r13, [r13 + 1]
movzx r8d, al
cmp dil, 9
lea eax, [rdi - 7]
movzx edx, al
cmovle edx, edi
shl dl, 4
lea eax, [r8 - 7]
cmp r8b, 9
movzx ecx, al
cmovle ecx, r8d
inc r12d
add dl, cl
mov byte [r13 - 1], dl
cmp r12d, esi
jb 0x140002e90
mov r13, qword [rsp + 0x68]
mov edi, dword [rsp + 0x60]
movzx ecx, word [rbp - 0x6e]
lea r11, [rbp - 0x24]
movzx edx, word [rbp - 0x70]
movzx r8d, word [rbp - 0x78]
movzx r9d, word [rbp - 0x72]
movzx eax, word [rbp - 0x6c]
movzx r10d, word [rbp - 0x76]
mov qword [rsp + 0x50], r11
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ecx
mov rcx, r14
mov dword [rsp + 0x38], edx
mov edx, 0x1400
mov dword [rsp + 0x30], r8d
mov r8, 0xffffffffffffffff
mov dword [rsp + 0x28], r9d
mov r9, r15
mov dword [rsp + 0x20], r10d
call fcn.140001ec0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [r14 + r8], 0
jne 0x140002f53
jmp 0x14000308a
lea rax, [rbp + 0x140]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140002f70
lea ecx, [rbx + 2]
mov edx, 1
call fcn.140009b88
mov r15, rax
test rax, rax
je 0x140003114
shr ebx, 1
mov r12d, 0
je 0x140003006
mov r13, rax
nop
lea edi, [r12 + r12]
movsx ecx, byte [rbp + rdi + 0x140]
call fcn.140009fb0
sub al, 0x30
movzx esi, al
lea eax, [rdi + 1]
movsx ecx, byte [rbp + rax + 0x140]
call fcn.140009fb0
sub al, 0x30
lea r13, [r13 + 1]
movzx r8d, al
cmp sil, 9
lea eax, [rsi - 7]
movzx edx, al
cmovle edx, esi
shl dl, 4
lea eax, [r8 - 7]
cmp r8b, 9
movzx ecx, al
cmovle ecx, r8d
inc r12d
add dl, cl
mov byte [r13 - 1], dl
cmp r12d, ebx
jb 0x140002fa0
mov r13, qword [rsp + 0x68]
mov edi, dword [rsp + 0x60]
mov eax, dword [rbp - 0x30]
lea r11, [rbp - 0x24]
movzx ecx, word [rbp - 0x6e]
movzx edx, word [rbp - 0x70]
movzx r8d, word [rbp - 0x78]
movzx r9d, word [rbp - 0x72]
movzx r10d, word [rbp - 0x76]
mov qword [rsp + 0x58], r11
mov dword [rsp + 0x70], eax
mov eax, dword [rbp - 0x34]
mov dword [rsp + 0x74], eax
movzx eax, word [rbp - 0x6c]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x70]
mov dword [rsp + 0x48], ecx
mov rcx, r14
mov dword [rsp + 0x40], edx
mov edx, 0x1400
mov dword [rsp + 0x38], r8d
mov r8, 0xffffffffffffffff
mov dword [rsp + 0x30], r9d
mov r9, r15
mov dword [rsp + 0x28], r10d
mov qword [rsp + 0x20], rax
call fcn.140001ec0
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [r14 + r8], 0
jne 0x140003080
mov ecx, edi
mov rdx, r14
add rcx, r13
call fcn.1400096b0
mov rcx, r14
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400030a1
add edi, eax
mov rcx, r15
mov dword [rsp + 0x60], edi
call fcn.14000a0b4
xor edx, edx
mov r8d, 0x1400
mov rcx, r14
call fcn.140008f40
mov rbx, qword [rsp + 0x78]
lea rdx, [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140002e20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, r14
call fcn.14000a0b4
mov rcx, qword [rbp - 0x80]
call fcn.14000a0b4
mov r8d, 0x16
mov edx, edi
mov rcx, r13
call fcn.140004760
mov rcx, r13
call fcn.14000a0b4
mov r15, qword [rsp + 0x2b0]
mov r12, qword [rsp + 0x2f8]
mov r14, qword [rsp + 0x2b8]
mov rbx, qword [rsp + 0x2e8]
mov rsi, qword [rsp + 0x2f0]
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140007e30
add rsp, 0x2c0
pop r13
pop rdi
pop rbp
ret