Function at 0x140204f40
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov rsi, rcx
mov rdi, rdx
test rdx, rdx
je 0x140205200
mov r12, qword [sym.imp.msvcrt.dll__errno]
call r12
mov rdx, qword [rsi]
mov dword [rax], 0
test rdx, rdx
je 0x140205050
mov rcx, qword [rdx + 0x250]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1402051a7
mov rbx, qword [rsi]
cmp word [rbx + 0x2c], 0
lea r8, [rbx + 0x2c]
je 0x140205248
xor eax, eax
jmp 0x140204fbc
cmp rax, 0xff
je 0x140205228
mov rdx, rax
add rax, 1
cmp word [rbx + rax*2 + 0x2c], 0
jne 0x140204fb0
lea rdi, [rdx + 2]
mov r9d, edi
lea rax, [rbx + 0x258]
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x140205025
mov rcx, qword [rsi]
xor eax, eax
nop
movzx edx, word [rbx + rax*2 + 0x2c]
mov byte [rcx + rax + 0x258], dl
add rax, 1
cmp rax, rdi
jne 0x140205010
mov rax, qword [rsi]
mov byte [rax + 0x357], 0
add rax, 0x258
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp byte [rdi], 0
je 0x140205238
mov rdx, rdi
xor eax, eax
jmp 0x14020506b
cmp eax, 0x80000000
je 0x140205238
add rdx, 1
add eax, 1
cmp byte [rdx], 0
jne 0x140205060
mov ebx, eax
and ebx, 0x7fffffff
lea rax, [rbx - 1]
cmp rax, 0x7ffffffb
ja 0x140205238
mov edx, 1
mov ecx, 0x358
call sub.msvcrt.dll_calloc
mov qword [rsi], rax
test rax, rax
je 0x1402052a3
lea r14, [rbx + 1]
mov ecx, 0xfde9
mov r8, rdi
xor edx, edx
mov dword [rsp + 0x28], 0
mov r15, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9d, r14d
mov qword [rsp + 0x20], 0
call r15
mov ecx, 0xfde9
mov r13d, eax
test eax, eax
jle 0x1402051b0
lea eax, [r13 + 2]
cdqe
lea rax, [rax + rax + 0xf]
and rax, 0xfffffffffffffff0
call fcn.1403423d0
xor edx, edx
sub rsp, rax
mov r9d, r14d
mov r8, rdi
lea r10, [rsp + 0x40]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r10
mov qword [rbp - 8], r10
call r15
mov r10, qword [rbp - 8]
test eax, eax
je 0x140205284
lea ecx, [r13 - 1]
movsxd rcx, ecx
add rcx, rcx
movzx eax, word [r10 + rcx - 2]
cmp ax, 0x2a
je 0x140205168
mov qword [rbp - 8], r10
add rcx, r10
cmp ax, 0x2f
je 0x140205213
cmp ax, 0x5c
je 0x140205213
lea rdx, [0x140432f82]
call sub.msvcrt.dll_wcscpy
mov r10, qword [rbp - 8]
mov rbx, qword [rsi]
mov rcx, r10
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbx + 0x250], rax
mov rbx, qword [rsi]
cmp qword [rbx + 0x250], 0xffffffffffffffff
jne 0x140204f98
mov rcx, rbx
call fcn.14034efb0
mov qword [rsi], 0
call r12
mov dword [rax], 0x16
xor eax, eax
jmp 0x140205035
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
je 0x140205258
lea eax, [r14 + 2]
cdqe
lea rax, [rax + rax + 0xf]
and rax, 0xfffffffffffffff0
call fcn.1403423d0
sub rsp, rax
lea r10, [rsp + 0x40]
xor eax, eax
nop
movsx dx, byte [rdi + rax]
mov word [r10 + rax*2], dx
mov rdx, rax
add rax, 1
cmp rdx, rbx
jne 0x1402051e0
mov r13d, r14d
jmp 0x140205127
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
xor eax, eax
jmp 0x140205035
lea rdx, [0x140432f88]
call sub.msvcrt.dll_wcscpy
mov r10, qword [rbp - 8]
jmp 0x140205168
mov r9d, 0x100
mov edi, 0x100
jmp 0x140204fd2
call r12
mov dword [rax], 2
xor eax, eax
jmp 0x140205035
mov r9d, 1
mov edi, 1
jmp 0x140204fd2
mov dword [rsp + 0x28], 0
mov r9d, r14d
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call r15
mov r13d, eax
test eax, eax
jle 0x1402052b3
xor ecx, ecx
jmp 0x1402050e6
mov rcx, qword [rsi]
call fcn.14034efb0
mov qword [rsi], 0
call r12
mov dword [rax], 0x16
xor eax, eax
jmp 0x140205035
call r12
mov dword [rax], 0xc
xor eax, eax
jmp 0x140205035
lea eax, [r14 + 2]
cdqe
add rax, rax
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.1403423d0
sub rsp, rax
lea r10, [rsp + 0x40]
jmp 0x1402051dd