Function at 0x140108460
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 0x250], rax
xor esi, esi
mov r14d, esi
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x68], rsi
mov rax, qword [0x14068a770]
test rax, rax
jne 0x1401084ee
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1401084dd
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14068a770], rax
jmp 0x1401084e4
mov rax, qword [0x14068a770]
test rax, rax
jne 0x1401084ee
xor r13b, r13b
jmp 0x140108500
lea rcx, [rsp + 0x68]
call qword [case.0x1401cd220.0]
cmp eax, 1
sete r13b
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
mov qword [rbp - 0x28], rsi
call fcn.1401d45f0
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
xor edx, edx
lea rcx, [rbp - 0x38]
call fcn.1400e7440
call fcn.1401d4560
mov qword [rsp + 0x40], rax
mov rcx, qword [rbp - 0x30]
cmp rcx, qword [rbp - 0x28]
je 0x140108547
mov qword [rcx], rax
add rcx, 8
mov qword [rbp - 0x30], rcx
jmp 0x14010855c
lea r8, [rsp + 0x40]
mov rdx, rcx
lea rcx, [rbp - 0x38]
call fcn.1400e7440
mov rcx, qword [rbp - 0x30]
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
mov qword [rbp - 0x40], rsi
mov r12, qword [rbp - 0x38]
cmp r12, rcx
je 0x140108a5d
mov r15d, 1
lea r8, str.MacromedFlash
mov rdx, qword [r12]
lea rcx, [rbp - 0x20]
call fcn.1401d48a0
nop
lea rdi, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdi, qword [rbp - 0x20]
test rdi, rdi
je 0x14010866a
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401085b0
mov qword [rsp + 0x70], rsi
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], si
or r14d, 4
mov dword [rsp + 0x30], r14d
test rbx, rbx
je 0x140108689
lfence
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x1401085f0
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.1400739a0
cmp word [rdi + rbx*2 - 2], 0x5c
je 0x140108689
mov rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x78]
mov rax, r8
sub rax, rdx
cmp rax, 1
jb 0x14010864c
lea rcx, [rdx + 1]
mov qword [rbp - 0x80], rcx
lea rax, [rsp + 0x70]
cmp r8, 8
cmovae rax, qword [rsp + 0x70]
mov r8d, 0x5c
mov word [rax + rdx*2], r8w
mov word [rax + rcx*2], si
jmp 0x140108689
lfence
mov qword [rsp + 0x20], r15
lea r9, [0x1405e45bc]
mov rdx, r15
lea rcx, [rsp + 0x70]
call fcn.1400735a0
jmp 0x140108689
mov qword [rsp + 0x70], rsi
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], si
or r14d, 4
mov dword [rsp + 0x30], r14d
mov rcx, qword [rbp - 0x80]
mov rax, qword [rbp - 0x78]
sub rax, rcx
lfence
cmp rax, 0x16
jb 0x1401086d5
mov rdi, qword [rbp - 0x80]
add rdi, 0x16
mov qword [rbp - 0x80], rdi
lea rbx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rbx, qword [rsp + 0x70]
lea rcx, [rbx + rcx*2]
mov r8d, 0x2c
lea rdx, str.FlashPlayerPlugin.exe
call fcn.14035bc80
mov word [rbx + rdi*2], si
jmp 0x1401086f5
mov qword [rsp + 0x20], 0x16
lea r9, str.FlashPlayerPlugin.exe
mov edx, 0x16
lea rcx, [rsp + 0x70]
call fcn.1400735a0
nop
mov r14d, dword [rsp + 0x30]
and r14d, 0xfffffffb
or r14d, 2
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rcx, qword [rsp + 0x70]
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1401089a9
nop dword [rax]
test byte [rbp], 0x10
jne 0x14010898a
lea rsi, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rsi, qword [rbp - 0x20]
test rsi, rsi
je 0x1401087d9
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x140108760
lea rax, [rbp + 0x2c]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140108775
xor edx, edx
mov qword [rbp - 0x70], rdx
mov r10d, edx
mov qword [rbp - 0x60], rdx
mov r8d, 7
mov qword [rbp - 0x58], r8
mov word [rbp - 0x70], dx
or r14d, 0x10
mov dword [rsp + 0x30], r14d
test rdi, rdi
je 0x140108819
lfence
mov r8, 0xffffffffffffffff
inc r8
cmp word [rsi + r8*2], dx
jne 0x1401087b2
mov rdx, rsi
lea rcx, [rbp - 0x70]
call fcn.1400739a0
mov r8, qword [rbp - 0x58]
mov r10, qword [rbp - 0x60]
mov r14d, dword [rsp + 0x30]
xor edx, edx
jmp 0x140108819
xor edx, edx
mov edi, edx
mov qword [rbp - 0x70], rdx
mov r10d, edx
mov qword [rbp - 0x60], rdx
mov r8d, 7
mov qword [rbp - 0x58], r8
mov word [rbp - 0x70], dx
or r14d, 0x10
mov dword [rsp + 0x30], r14d
lea rax, [rbp + 0x2c]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], dx
jne 0x140108810
test rbx, rbx
je 0x14010890e
test rdi, rdi
je 0x140108888
cmp word [rsi + rdi*2 - 2], 0x5c
je 0x140108888
mov rax, r8
sub rax, r10
cmp rax, 1
jb 0x140108861
lea rcx, [r10 + 1]
mov qword [rbp - 0x60], rcx
lea rax, [rbp - 0x70]
cmp r8, 8
cmovae rax, qword [rbp - 0x70]
mov r8d, 0x5c
mov word [rax + r10*2], r8w
mov word [rax + rcx*2], dx
jmp 0x140108880
lfence
mov eax, 1
mov qword [rsp + 0x20], rax
lea r9, [0x1405e45bc]
mov edx, eax
lea rcx, [rbp - 0x70]
call fcn.1400735a0
mov r10, qword [rbp - 0x60]
mov r8, qword [rbp - 0x58]
xor esi, esi
mov eax, esi
cmp word [rbp + 0x2c], 0x5c
mov ecx, 1
cmove eax, ecx
lea r9, [rbp + 0x2c]
lea r9, [r9 + rax*2]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [r9 + rdx*2], si
jne 0x1401088b0
sub r8, r10
lfence
cmp rdx, r8
ja 0x1401088f9
mov rdi, qword [rbp - 0x60]
add rdi, rdx
mov qword [rbp - 0x60], rdi
lea rbx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rbx, qword [rbp - 0x70]
lea rcx, [rbx + r10*2]
lea r8, [rdx + rdx]
mov rdx, r9
call fcn.14035bc80
mov word [rbx + rdi*2], si
mov r14d, dword [rsp + 0x30]
jmp 0x140108910
mov qword [rsp + 0x20], rdx
lea rcx, [rbp - 0x70]
call fcn.1400735a0
mov r14d, dword [rsp + 0x30]
jmp 0x140108910
xor esi, esi
and r14d, 0xffffffef
or r14d, 8
mov rax, qword [rbp - 0x48]
cmp rax, qword [rbp - 0x40]
je 0x140108935
lea rdx, [rbp - 0x70]
mov rcx, rax
call fcn.1400733c0
add qword [rbp - 0x48], 0x20
jmp 0x140108946
lea r8, [rbp - 0x70]
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140081280
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x140108986
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140108981
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140108c2f
call fcn.140359090
mov word [rbp - 0x70], si
lea rdx, [rbp]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140108730
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1401089ea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401089e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140108c35
call fcn.140359090
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], si
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x140108a3b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140108a36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140108c3b
call fcn.140359090
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], 7
mov word [rbp - 0x20], si
add r12, 8
cmp r12, qword [rbp - 0x30]
jne 0x140108575
mov r12, qword [rbp - 0x38]
test r13b, r13b
je 0x140108ab3
mov rbx, qword [rsp + 0x68]
mov rax, qword [0x14068a778]
test rax, rax
jne 0x140108aaa
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140108a9e
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14068a778], rax
jmp 0x140108aa5
mov rax, qword [0x14068a778]
test rax, rax
je 0x140108ab3
mov rcx, rbx
call qword [case.0x1401cd220.0]
mov rbx, qword [rbp - 0x50]
mov rdi, qword [rbp - 0x48]
cmp rbx, rdi
je 0x140108b5c
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], si
mov r8d, 7
lea rdx, str.Plugins
lea rcx, [rsp + 0x48]
call fcn.1400739a0
nop
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140100de0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140108b47
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140108b42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140108c47
call fcn.140359090
add rbx, 0x20
cmp rbx, rdi
jne 0x140108ac4
mov rdi, qword [rbp - 0x48]
mov rbx, qword [rbp - 0x50]
test rbx, rbx
je 0x140108bbf
cmp rbx, rdi
je 0x140108b7b
mov rcx, rbx
call fcn.140073b90
add rbx, 0x20
cmp rbx, rdi
jne 0x140108b66
mov rbx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x40]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x140108bab
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140108c41
mov rcx, rbx
call fcn.140359090
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rsi
test r12, r12
je 0x140108bf9
mov rdx, qword [rbp - 0x28]
sub rdx, r12
and rdx, 0xfffffffffffffff8
mov rax, r12
cmp rdx, 0x1000
jb 0x140108bf1
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140108c29
mov rcx, r12
call fcn.140359090
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.140359070
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
int3