Function at 0x140022f50
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x368], rbx
mov rax, qword [0x140104508]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov qword [rbp - 0x68], r8
mov r15, rdx
mov qword [rbp - 0x70], rdx
mov rbx, rcx
mov qword [rbp - 0x60], rcx
xor r13d, r13d
mov dword [rsp + 0x70], r13d
mov rax, qword [0x140104018]
mov qword [rbp - 0x78], rax
mov r8, qword [rdx + 8]
lea rdx, [0x1400d0a10]
lea rcx, [rbp - 0x78]
call fcn.1400086c0
mov rdx, qword [rbp - 0x78]
lea rdi, [rdx - 0xc]
mov qword [rbp - 0x80], rdi
cmp dword [rdi], r13d
jl 0x140022fe0
mov qword [rsp + 0x60], rdx
lock inc dword [rdi]
jmp 0x140022ff6
mov rax, qword [0x140104018]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
call fcn.140006470
lea rsi, [rbx + 0x5d8]
mov qword [rsp + 0x78], rsi
mov r9b, 1
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.140002330
lea rdx, [rbp - 0x50]
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x68], rax
mov r12d, 0xffffffff
cmp rax, 0xffffffffffffffff
jne 0x1400230bb
mov rax, qword [0x140104018]
mov qword [rsp + 0x50], rax
lea r14, [0x1400d0a70]
mov rax, r14
shr rax, 0x10
test ax, ax
jne 0x140023067
movzx edx, r14w
lea rcx, [rsp + 0x50]
call fcn.140001ff0
jmp 0x1400230a3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
test eax, eax
je 0x1400230a3
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.140001970
test eax, eax
je 0x1400230a3
mov r9, rbx
add r9, r9
lea eax, [rbx + 1]
movsxd rdx, eax
add rdx, rdx
mov r8, r14
mov rcx, qword [rsp + 0x50]
call fcn.1400029b0
mov r9b, 1
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140002330
jmp 0x140023664
mov edx, VarDateFromDisp
mov rcx, qword [r15 + 8]
call sub.VCRUNTIME140.dll_wcsrchr
test rax, rax
jne 0x1400230d3
mov eax, r12d
jmp 0x1400230da
sub rax, qword [r15 + 8]
sar rax, 1
mov edx, r13d
test eax, eax
cmovns edx, eax
mov rax, qword [r15 + 8]
mov ecx, dword [rax - 8]
mov eax, ecx
cmp edx, ecx
cmovle eax, edx
mov ebx, r13d
test ecx, ecx
cmovns ebx, eax
mov rax, qword [0x140104018]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x70], 1
test ebx, ebx
jne 0x140023117
mov qword [rsp + 0x58], rax
jmp 0x140023144
mov edx, ebx
lea rcx, [rsp + 0x58]
call fcn.140001970
test eax, eax
je 0x140023144
movsxd r9, ebx
add r9, r9
lea eax, [rbx + 1]
movsxd rdx, eax
add rdx, rdx
mov r8, qword [r15 + 8]
mov rcx, qword [rsp + 0x58]
call fcn.1400029b0
mov rbx, qword [rsp + 0x68]
nop dword [rax]
mov rcx, rsi
call fcn.140001fb0
test al, al
jne 0x14002362d
test byte [rbp - 0x50], 0x10
jne 0x140023618
lea r8, [0x1400cd944]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x20]
call fcn.140006a90
nop
lea rcx, [rbp - 0x24]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r14, eax
test eax, eax
je 0x1400232a3
mov rdi, qword [rsp + 0x20]
lea rsi, [rdi - 0xc]
cmp dword [rsi], 1
jg 0x1400231fe
movsxd r9, dword [rdi - 8]
mov eax, dword [rdi - 4]
lea ecx, [r9 + r14]
cmp ecx, eax
jg 0x1400231fe
mov r8, r14
inc eax
movsxd rdx, eax
add rdx, rdx
lea rcx, [rdi + r9*2]
add r8, r8
je 0x1400231e7
test rcx, rcx
je 0x14002372c
cmp rdx, r8
jb 0x140023714
lea rdx, [rbp - 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov rdi, qword [rsp + 0x20]
add dword [rdi - 8], r14d
mov rax, qword [rsp + 0x20]
movsxd rcx, dword [rax - 8]
mov word [rax + rcx*2], r13w
jmp 0x1400232a3
movsxd rbx, dword [rsi + 4]
lea r15d, [r14 + rbx]
cmp r15d, ebx
jl 0x1400232a8
cmp r15d, r14d
jl 0x1400232a8
test r15d, r15d
je 0x140023286
mov edx, r15d
lea rcx, [rsp + 0x20]
call fcn.140001970
test eax, eax
je 0x1400232a3
add rbx, rbx
lea eax, [r15 + 1]
movsxd rdx, eax
add rdx, rdx
mov r9, rbx
mov r8, rdi
mov rcx, qword [rsp + 0x20]
call fcn.1400029b0
mov r8, r14
lea eax, [r14 + 1]
movsxd rdx, eax
add rdx, rdx
mov rdi, qword [rsp + 0x20]
lea rcx, [rbx + rdi]
add r8, r8
je 0x140023286
test rcx, rcx
je 0x1400236c5
cmp rdx, r8
jb 0x1400236ad
lea rdx, [rbp - 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov rdi, qword [rsp + 0x20]
cmp rsi, qword [0x140104010]
je 0x1400232a8
mov eax, r12d
lock xadd dword [rsi], eax
sub eax, 1
jg 0x1400232a3
mov rcx, rsi
call fcn.1400bf5e4
mov rdi, qword [rsp + 0x20]
mov rsi, qword [0x140104018]
mov qword [rsp + 0x28], rsi
mov r15, rsi
mov qword [rsp + 0x30], rsi
mov r14, rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], 0
cmp rsi, rdi
je 0x1400233b2
lea rcx, [rsi - 0xc]
mov eax, dword [rcx]
test eax, eax
jns 0x1400232ee
cmp rcx, qword [0x140104010]
jne 0x1400232f8
cmp dword [rdi - 0xc], 0
jge 0x140023380
movsxd r13, dword [rdi - 8]
cmp eax, 1
jg 0x140023307
cmp r13d, dword [rsi - 4]
jle 0x14002334d
cmp rcx, qword [0x140104010]
je 0x14002332d
mov eax, r12d
lock xadd dword [rcx], eax
sub eax, 1
jg 0x140023321
call fcn.1400bf5e4
mov rax, qword [0x140104018]
mov qword [rsp + 0x30], rax
mov edx, r13d
lea rcx, [rsp + 0x30]
call fcn.140001970
mov r14, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x28]
test eax, eax
je 0x14002337b
mov r15, qword [rsp + 0x30]
lea rbx, [r13*2]
lea eax, [r13 + 1]
movsxd rdx, eax
add rdx, rdx
mov r9, rbx
mov r8, rdi
mov rcx, r15
call fcn.1400029b0
mov dword [r15 - 8], r13d
xor r13d, r13d
mov word [r15 + rbx], r13w
jmp 0x1400233b2
xor r13d, r13d
jmp 0x1400233b2
cmp rcx, qword [0x140104010]
je 0x14002339f
mov eax, r12d
lock xadd dword [rcx], eax
sub eax, 1
jg 0x14002339a
call fcn.1400bf5e4
mov rdi, qword [rsp + 0x20]
mov qword [rsp + 0x30], rdi
lock inc dword [rdi - 0xc]
mov r14, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x28]
lea rcx, [rbp - 0x24]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
lea rcx, [rsi - 0xc]
cmp dword [rcx], 1
jg 0x1400233cd
cmp ebx, dword [rsi - 4]
jle 0x14002340d
cmp rcx, qword [0x140104010]
je 0x1400233f3
mov edx, r12d
lock xadd dword [rcx], edx
sub edx, 1
jg 0x1400233e7
call fcn.1400bf5e4
mov rax, qword [0x140104018]
mov qword [rsp + 0x28], rax
mov edx, ebx
lea rcx, [rsp + 0x28]
call fcn.140001970
mov r14, qword [rsp + 0x38]
test eax, eax
je 0x140023448
mov rsi, qword [rsp + 0x28]
lea rdi, [rbx + rbx]
lea eax, [rbx + 1]
movsxd r8, eax
add r8, r8
test rdi, rdi
je 0x140023440
test rsi, rsi
je 0x1400236f7
mov rcx, rsi
cmp r8, rdi
jb 0x1400236e2
mov r8, rdi
lea rdx, [rbp - 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov dword [rsi - 8], ebx
mov word [rsi + rdi], r13w
mov r15, qword [rbp - 0x70]
mov rsi, qword [r15 + 0x10]
cmp r14, rsi
je 0x140023504
lea rcx, [r14 - 0xc]
mov edx, dword [rcx]
mov rax, qword [0x140104010]
test edx, edx
jns 0x14002346f
cmp rcx, rax
jne 0x140023475
cmp dword [rsi - 0xc], 0
jge 0x1400234e1
movsxd rdi, dword [rsi - 8]
cmp edx, 1
jg 0x140023484
cmp edi, dword [r14 - 4]
jle 0x1400234bb
cmp rcx, rax
je 0x1400234a6
mov eax, r12d
lock xadd dword [rcx], eax
sub eax, 1
jg 0x14002349a
call fcn.1400bf5e4
mov rax, qword [0x140104018]
mov qword [rsp + 0x38], rax
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140001970
test eax, eax
je 0x140023504
mov r14, qword [rsp + 0x38]
lea rbx, [rdi + rdi]
lea eax, [rdi + 1]
movsxd rdx, eax
add rdx, rdx
mov r9, rbx
mov r8, rsi
mov rcx, r14
call fcn.1400029b0
mov dword [r14 - 8], edi
mov word [r14 + rbx], r13w
jmp 0x140023504
cmp rcx, rax
je 0x1400234f7
mov eax, r12d
lock xadd dword [rcx], eax
sub eax, 1
jg 0x1400234f7
call fcn.1400bf5e4
mov rax, qword [r15 + 0x10]
mov qword [rsp + 0x38], rax
lock inc dword [rax - 0xc]
mov eax, dword [r15 + 0x18]
mov dword [rsp + 0x40], eax
mov eax, dword [r15 + 0x1c]
mov dword [rsp + 0x44], eax
mov rdi, qword [rbp - 0x68]
mov rax, qword [rdi + 8]
cmp qword [rdi + 0x10], rax
je 0x140023536
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.140005990
add qword [rdi + 8], 0x28
jmp 0x140023546
lea r8, [rsp + 0x28]
mov rdx, rax
mov rcx, rdi
call fcn.140018bd0
lea rdx, [rsp + 0x28]
mov rcx, qword [rbp - 0x60]
call fcn.140023750
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140104010]
je 0x140023578
mov eax, r12d
lock xadd dword [rcx], eax
sub eax, 1
jg 0x140023578
call fcn.1400bf5e4
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140104010]
je 0x14002359b
mov eax, r12d
lock xadd dword [rcx], eax
sub eax, 1
jg 0x14002359b
call fcn.1400bf5e4
mov rcx, qword [rsp + 0x30]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140104010]
je 0x1400235be
mov eax, r12d
lock xadd dword [rcx], eax
sub eax, 1
jg 0x1400235be
call fcn.1400bf5e4
mov rcx, qword [rsp + 0x28]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140104010]
je 0x1400235e2
mov eax, r12d
lock xadd dword [rcx], eax
sub eax, 1
jg 0x1400235e2
call fcn.1400bf5e4
nop
mov rcx, qword [rsp + 0x20]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140104010]
je 0x14002360e
mov eax, r12d
lock xadd dword [rcx], eax
sub eax, 1
jg 0x14002360e
mov rcx, qword [rsp + 0x20]
add rcx, 0xfffffffffffffff4
call fcn.1400bf5e4
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
lea rdx, [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140023150
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140104010]
je 0x14002365a
mov eax, r12d
lock xadd dword [rcx], eax
sub eax, 1
jg 0x14002365a
call fcn.1400bf5e4
mov r13d, 1
mov rdi, qword [rbp - 0x80]
cmp rdi, qword [0x140104010]
je 0x140023680
lock xadd dword [rdi], r12d
sub r12d, 1
jg 0x140023680
mov rcx, rdi
call fcn.1400bf5e4
mov eax, r13d
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.1400bf680
mov rbx, qword [rsp + 0x368]
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8, rdx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
jmp 0x1400236d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], socket
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.140001ac0
nop
xor edx, edx
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
jmp 0x140023703
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], socket
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.140001ac0
nop
mov r8, rdx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
jmp 0x140023738
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], socket
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.140001ac0
int3