Function at 0x14017cc04
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x140412700]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rsi, rdx
mov r15, rcx
xor r12d, r12d
mov edi, r12d
mov dword [rsp + 0x20], r12d
mov r8, rdx
lea rdx, [0x1403a1370]
lea rcx, [rsp + 0x48]
call fcn.14006e1d0
nop
mov r8, rax
mov rdx, r15
lea rcx, [rbp - 0x78]
call fcn.14017b720
nop
lea rcx, [rsp + 0x48]
call fcn.14000dd24
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 7
cmova rcx, qword [rbp - 0x78]
lea rdx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14017ce63
test byte [rbp - 0x50], 0x10
jne 0x14017ce44
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
lea rax, [rbp - 0x24]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r12w
jne 0x14017ccbf
lea rdx, [rbp - 0x24]
lea rcx, [rsp + 0x48]
call fcn.140013184
nop
lea r8, [rsp + 0x48]
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.14017b720
mov rbx, rax
lea rax, [rbp - 0x78]
cmp rax, rbx
je 0x14017cd21
lea rcx, [rbp - 0x78]
call fcn.14000dd24
mov r8d, 0x20
mov rdx, rbx
lea rcx, [rbp - 0x78]
call fcn.1402bec40
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
lea rcx, [rsp + 0x68]
call fcn.14000dd24
nop
lea rcx, [rsp + 0x48]
call fcn.14000dd24
mov rcx, qword [rbp - 0x68]
sub rcx, qword [rsi + 0x10]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r12
mov rax, qword [rbp - 0x68]
cmp rax, rcx
jb 0x14017ce97
sub rax, rcx
or r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rax, [rbp - 0x78]
cmp qword [rbp - 0x60], 7
cmova rax, qword [rbp - 0x78]
lea rdx, [rax + rcx*2]
lea rcx, [rsp + 0x28]
call fcn.140013184
or edi, 1
mov dword [rsp + 0x20], edi
mov rcx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x14017cd9b
mov rcx, qword [rsi]
lea r8, [rsp + 0x28]
cmp qword [rsp + 0x40], 7
cmova r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x38]
cmp rdx, qword [rsi + 0x10]
jne 0x14017cdd7
test rdx, rdx
je 0x14017cdd3
sub r8, rcx
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14017cdd7
add rcx, 2
sub rdx, 1
jne 0x14017cdbf
mov bl, 1
jmp 0x14017cdda
mov bl, r12b
and edi, 0xfffffffe
mov dword [rsp + 0x20], edi
lea rcx, [rsp + 0x28]
call fcn.14000dd24
test bl, bl
je 0x14017ce44
mov rax, qword [0x140447398]
cmp rax, qword [0x1404473a0]
je 0x14017ce31
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 7
cmova rdx, qword [rbp - 0x78]
mov r8, qword [rbp - 0x68]
mov rcx, rax
call fcn.140038e84
add qword [0x140447398], 0x20
jmp 0x14017ce44
lea r8, [rbp - 0x78]
mov rdx, rax
lea rcx, [0x140447390]
call fcn.140081938
lea rdx, [rbp - 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14017cc9b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rbp - 0x78]
call fcn.14000dd24
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.1402194b0
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140038e70
nop
int3