Function at 0x14002bc90
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x610
mov rax, qword [0x1401b89e8]
xor rax, rsp
mov qword [rsp + 0x600], rax
xor r15d, r15d
lea rcx, [rsp + 0x3e0]
xor edx, edx
mov r8d, 0x104
mov esi, r15d
call fcn.14008b040
xor edx, edx
lea rcx, [rsp + 0x2d0]
mov r8d, 0x104
call fcn.14008b040
lea r12, [0x1400f862c]
mov r9d, 0x80000000
mov rdx, r12
lea ecx, [r15 + 0x24]
xor r8d, r8d
call fcn.14000c280
xor edx, edx
xor r9d, r9d
or r8d, 0xffffffff
mov r14, rax
lea ecx, [rdx + 0x24]
call fcn.14000c280
xor edx, edx
xor r9d, r9d
or r8d, 0xffffffff
mov rdi, rax
lea ecx, [rdx + 0x24]
call fcn.14000c280
cmp dword [0x1401b83f0], 4
mov rbp, rax
mov qword [rsp + 0x40], r15
jl 0x14002bd96
test dword [0x1401b846c], 0x100
je 0x14002bd96
lea rax, [rsp + 0x2d0]
mov ecx, 0x100
mov qword [rsp + 0x38], rax
lea r9, str.....esif_uf_dspmgr.c
lea rax, str.SCAN_CONFIG_For_DSP_Files_NameSpace___s__Pattern__s
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rax
lea r8, str.esif_dsp_file_scan
lea edx, [r15 + 4]
mov dword [rsp + 0x20], 0x363
call fcn.140067120
test r14, r14
je 0x14002bea6
test rdi, rdi
je 0x14002bea6
test rbp, rbp
je 0x14002bea6
lea r9, [rsp + 0x40]
mov r8, rbp
mov rdx, rdi
mov rcx, r14
call fcn.14000a400
mov esi, eax
test eax, eax
jne 0x14002bea6
nop
mov eax, dword [rdi + 0x10]
cmp eax, 5
jb 0x14002be45
mov ecx, eax
lea rdx, [0x140100fd4]
mov rax, qword [rdi + 4]
add rax, 0xfffffffffffffffb
add rcx, rax
call fcn.1400af838
test eax, eax
jne 0x14002be45
mov ecx, 0x104
call fcn.140096ad4
mov rbx, rax
test rax, rax
je 0x14002be17
xor edx, edx
mov r8d, 0x104
mov rcx, rax
call fcn.14008b040
mov r8, qword [rdi + 4]
or r9, 0xffffffffffffffff
mov edx, 0x104
mov rcx, rbx
call fcn.140096ba0
mov rcx, rbx
call fcn.14002ab50
test eax, eax
je 0x14002be45
test rbx, rbx
je 0x14002be45
mov rcx, rbx
call fcn.140096ac0
xor r8d, r8d
mov dword [rsp + 0x20], r15d
or r9d, 0xffffffff
mov rcx, rdi
lea edx, [r8 + 0x24]
call fcn.14000ce70
xor r8d, r8d
mov dword [rsp + 0x20], r15d
or r9d, 0xffffffff
mov rcx, rbp
lea edx, [r8 + 0x24]
call fcn.14000ce70
lea r9, [rsp + 0x40]
mov r8, rbp
mov rdx, rdi
mov rcx, r14
call fcn.14000a410
mov esi, eax
test eax, eax
je 0x14002bdd0
lea rcx, [rsp + 0x40]
call fcn.14000a3d0
cmp esi, 0x3ed
cmove esi, r15d
mov rcx, r14
call fcn.14000c620
mov rcx, rdi
call fcn.14000c620
mov rcx, rbp
call fcn.14000c620
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov edx, 0x104
lea rcx, [rsp + 0x3e0]
lea r8d, [r9 + 9]
call fcn.140011e00
or r9, 0xffffffffffffffff
lea r8, str..edp
mov edx, 0x104
lea rcx, [rsp + 0x2d0]
call fcn.140096ba0
cmp dword [0x1401b83f0], 4
jl 0x14002bf59
test dword [0x1401b846c], 0x100
je 0x14002bf59
lea rax, [rsp + 0x2d0]
mov edx, 4
mov qword [rsp + 0x38], rax
lea r9, str.....esif_uf_dspmgr.c
lea rax, [rsp + 0x3e0]
mov ecx, 0x100
mov qword [rsp + 0x30], rax
lea r8, str.esif_dsp_file_scan
lea rax, str.SCAN_File_System_For_DSP_Files_Path___s__Pattern__s
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x380
call fcn.140067120
mov ecx, 0x104
call fcn.140096ad4
mov rbx, rax
test rax, rax
je 0x14002bf7b
xor edx, edx
mov r8d, 0x104
mov rcx, rax
call fcn.14008b040
test rbx, rbx
jne 0x14002bfce
cmp dword [0x1401b83f0], 1
jl 0x14002bfc4
test dword [0x1401b8424], 0x100
je 0x14002bfc4
lea rax, str.Fail_to_allocate_esif_ccb_file_n
mov ecx, 0x100
mov qword [rsp + 0x28], rax
lea r9, str.....esif_uf_dspmgr.c
lea r8, str.esif_dsp_file_scan
mov dword [rsp + 0x20], 0x384
lea edx, [rbx + 1]
call fcn.140067120
mov eax, 0x708
jmp 0x14002c0d7
lea rax, [rsp + 0x2d0]
mov ecx, 0x104
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3e0]
lea rax, [0x1400f8380]
lea r8, [0x1400f8384]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x4f0]
call fcn.14002a8d0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x4f0]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14002c0c3
or r9, 0xffffffffffffffff
lea r8, [rsp + 0x7c]
mov edx, 0x104
mov rcx, rbx
call fcn.140096ba0
nop
mov rdx, rbx
mov rcx, r12
call fcn.140004420
test al, al
jne 0x14002c085
mov rcx, rbx
call fcn.14002ab50
test eax, eax
je 0x14002c063
mov rcx, rbx
call fcn.140096ac0
mov ecx, 0x104
call fcn.140096ad4
mov rbx, rax
test rax, rax
je 0x14002c085
xor edx, edx
mov r8d, 0x104
mov rcx, rax
call fcn.14008b040
lea rdx, [rsp + 0x190]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileA]
test eax, eax
je 0x14002c0b8
or r9, 0xffffffffffffffff
lea r8, [rsp + 0x1bc]
mov edx, 0x104
mov rcx, rbx
call fcn.140096ba0
test rbx, rbx
jne 0x14002c040
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
jmp 0x14002c0c8
mov esi, 0x3eb
test rbx, rbx
je 0x14002c0d5
mov rcx, rbx
call fcn.140096ac0
mov eax, esi
mov rcx, qword [rsp + 0x600]
xor rcx, rsp
call fcn.1400897c0
lea r11, [rsp + 0x610]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret