Function at 0x14002274c
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x14003e018]
xor rax, rsp
mov qword [rbp + 0x1b8], rax
xor r12d, r12d
mov qword [rsp + 0x50], rdx
mov r15, rcx
or rdx, rdx
jne 0x14002222c
call fcn.140017d48
lea ebx, [r12 + 0x16]
mov dword [rax], ebx
call fcn.14001b264
mov eax, ebx
jmp 0x140022584
xorps xmm0, xmm0
mov qword [rdx], r12
mov rax, qword [rcx]
movdqu xmmword [rsp + 0x30], xmm0
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x40], r12
or rax, rax
je 0x14002245c
lea rdx, [rbp + 0x1b0]
mov dword [rbp + 0x1b0], 0x3f002a
nop
push rax
pop rcx
mov word [rbp + 0x1b4], r12w
movabs rbx, 0x200000000801
call fcn.14001fd00
mov r14, qword [r15]
push rax
nop
pop rcx
or rax, rax
jne 0x1400222b4
lea r9, [rsp + 0x30]
sub r8d, r8d
sub edx, edx
mov rcx, r14
call fcn.1400225c4
mov rdi, qword [rsp + 0x30]
mov esi, eax
or eax, eax
jne 0x140022405
mov rsi, qword [rsp + 0x38]
jmp 0x1400223f9
cmp rax, r14
je 0x1400222d8
movzx eax, word [rcx]
sub ax, 0x2f
cmp ax, 0x2d
ja 0x1400222cf
movzx eax, ax
bt rbx, rax
jb 0x1400222d8
sub rcx, 2
cmp rcx, r14
jne 0x1400222b9
movzx edx, word [rcx]
cmp dx, 0x3a
jne 0x1400222ea
lea rax, [r14 + 2]
cmp rcx, rax
jne 0x140022339
sub dx, 0x2f
cmp dx, 0x2d
ja 0x1400222ff
movzx eax, dx
bt rbx, rax
mov al, 1
jb 0x140022302
mov al, r12b
sub rcx, r14
mov dword [rsp + 0x28], r12d
sar rcx, 1
lea r8, [rsp + 0x60]
inc rcx
mov qword [rsp + 0x20], r12
neg al
sbb r13, r13
sub r9d, r9d
and r13, rcx
sub edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
push rax
pop rbx
nop
cmp rax, 0xffffffffffffffff
jne 0x140022365
lea r9, [rsp + 0x30]
mov r8, r12
mov rdx, r12
mov rcx, r14
call fcn.1400225c4
mov esi, eax
or eax, eax
jne 0x140022434
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
jmp 0x1400223f9
sub rsi, rdi
sar rsi, 3
mov r12, rsi
sub edi, edi
cmp word [rbp - 0x74], 0x2e
jne 0x14002238d
movzx eax, word [rbp - 0x72]
test ax, ax
je 0x1400223ab
cmp ax, 0x2e
jne 0x14002238d
cmp word [rbp - 0x70], di
je 0x1400223ab
lea r9, [rsp + 0x30]
mov r8, r13
mov rdx, r14
lea rcx, [rbp - 0x74]
call fcn.1400225c4
mov esi, eax
or eax, eax
jne 0x14002242b
lea rdx, [rsp + 0x60]
nop
push rbx
pop rcx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
or eax, eax
jne 0x140022371
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
push rsi
nop
pop rdx
sub rdx, rdi
sar rdx, 3
cmp r12, rdx
je 0x1400223ed
sub rdx, r12
lea rcx, [rdi + r12*8]
lea r9, [0x1400221c0]
lea r8d, [rax + 8]
call fcn.140028000
push rbx
pop rcx
nop
call qword [sym.imp.KERNEL32.dll_FindClose]
xor r12d, r12d
add r15, 8
mov rax, qword [r15]
jmp 0x14002224a
push rdi
pop rbx
nop
cmp rdi, qword [rsp + 0x38]
je 0x1400224d7
mov rcx, qword [rbx]
call fcn.14001b2cc
add rbx, 8
cmp rbx, qword [rsp + 0x38]
jne 0x140022413
jmp 0x1400224d7
push rbx
pop rcx
nop
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdi, qword [rsp + 0x30]
nop
push rdi
pop rbx
cmp rdi, qword [rsp + 0x38]
je 0x1400224d7
mov rcx, qword [rbx]
call fcn.14001b2cc
add rbx, 8
cmp rbx, qword [rsp + 0x38]
jne 0x140022447
jmp 0x1400224d7
mov r14, rsi
mov rdx, r12
sub r14, rdi
mov qword [rsp + 0x48], rdx
sar r14, 3
push rdi
pop rax
nop
inc r14
cmp rdi, rsi
je 0x14002249e
mov r9, qword [rax]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r9 + rcx*2], r12w
jne 0x140022480
inc rdx
add rax, 8
add rdx, rcx
cmp rax, rsi
jne 0x140022479
mov qword [rsp + 0x48], rdx
mov r8d, 2
mov rcx, r14
call fcn.140019908
push rax
nop
pop rbx
or rax, rax
jne 0x1400224e6
sub ecx, ecx
call fcn.14001b2cc
nop
push rdi
pop rbx
cmp rdi, rsi
je 0x1400224d4
mov rcx, qword [rbx]
call fcn.14001b2cc
add rbx, 8
cmp rbx, rsi
jne 0x1400224c3
or esi, 0xffffffff
push rdi
pop rcx
nop
call fcn.14001b2cc
mov eax, esi
jmp 0x140022584
lea rcx, [rax + r14*8]
mov r14, rdi
mov qword [rbp + 0x1b0], rcx
mov r12, rcx
cmp rdi, rsi
je 0x140022552
mov r13, rbx
sub r13, rdi
mov r8, qword [r14]
or r15, 0xffffffffffffffff
sub eax, eax
inc r15
cmp word [r8 + r15*2], ax
jne 0x14002250b
mov rdx, qword [rsp + 0x48]
mov rax, r12
sub rax, rcx
inc r15
sar rax, 1
mov r9, r15
sub rdx, rax
mov rcx, r12
call fcn.1400220c0
sub ecx, ecx
or eax, eax
jne 0x1400225ae
mov rcx, qword [rbp + 0x1b0]
mov qword [r14 + r13], r12
add r14, 8
lea r12, [r12 + r15*2]
cmp r14, rsi
jne 0x140022502
mov rax, qword [rsp + 0x50]
sub ecx, ecx
mov qword [rax], rbx
call fcn.14001b2cc
push rdi
nop
pop rbx
cmp rdi, rsi
je 0x14002257a
mov rcx, qword [rbx]
call fcn.14001b2cc
add rbx, 8
cmp rbx, rsi
jne 0x140022569
nop
push rdi
pop rcx
call fcn.14001b2cc
sub eax, eax
mov rcx, qword [rbp + 0x1b8]
xor rcx, rsp
call fcn.14000b290
mov rbx, qword [rsp + 0x310]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
sub r9d, r9d
mov qword [rsp + 0x20], rcx
sub r8d, r8d
sub edx, edx
call fcn.14001b284
int3
jmp 0x1400221d4