Function at 0x140005810
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x400]
sub rsp, 0x500
mov rax, qword [0x140038020]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
mov r14, rcx
mov qword [rbp + 0xf0], rcx
xor r13d, r13d
mov r15d, r13d
mov dword [rsp + 0x30], r13d
mov qword [rbp + 0x138], r13
mov qword [rbp + 0x148], r13
mov qword [rbp + 0x150], 7
mov word [rbp + 0x138], r13w
mov ecx, 0x208
call fcn.14000b170
mov rbx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r8d, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [r13 + 0x5c]
mov rcx, rbx
call fcn.14000cc6c
test rax, rax
jne 0x1400058c3
mov rcx, rbx
call fcn.14000ae0c
mov ebx, r13d
jmp 0x1400058c7
mov word [rax], r13w
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400058d1
mov rdx, rbx
lea rcx, [rbp + 0x138]
call fcn.140009ad0
mov rcx, qword [rbp + 0x148]
mov rdx, qword [rbp + 0x150]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x140005940
lea rdi, [rcx + 6]
mov qword [rbp + 0x148], rdi
lea rbx, [rbp + 0x138]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x138]
lea rcx, [rbx + rcx*2]
mov r8d, 0xc
lea rdx, [0x140032748]
call fcn.14000ce20
mov word [rbx + rdi*2], r13w
jmp 0x140005961
mov qword [rsp + 0x20], 6
lea r9, [0x140032748]
mov edx, 6
lea rcx, [rbp + 0x138]
call fcn.140007e90
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp + 0x1a0]
call fcn.14000d570
lea rcx, [rbp + 0x138]
cmp qword [rbp + 0x150], 8
cmovae rcx, qword [rbp + 0x138]
lea rdx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
cmp rax, rsi
jne 0x140005a53
mov qword [r14], r13
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], 7
mov word [r14], r13w
nop dword [rax + rax]
inc rsi
cmp word [r13 + rsi*2], 0
jne 0x1400059c0
mov r8, rsi
xor edx, edx
mov rcx, r14
call fcn.140009ad0
nop
mov rdx, qword [rbp + 0x150]
cmp rdx, 8
jb 0x140005a20
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006448
call fcn.14000ae0c
mov rax, r14
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.14000adc0
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rbp + 0xf8], r13
mov qword [rbp + 0x108], r13
mov qword [rbp + 0x110], 0xf
mov byte [rbp + 0xf8], 0
mov r8d, 5
lea rdx, str.0.0.0
lea rcx, [rbp + 0xf8]
call fcn.140009cb0
nop
lea r8, [rbp + 0xf8]
lea rdx, [rbp - 0x68]
call fcn.140002a70
nop
mov rdx, qword [rbp + 0x110]
cmp rdx, 0x10
jb 0x140005adf
inc rdx
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ada
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006454
call fcn.14000ae0c
mov qword [rbp + 0x178], r13
mov qword [rbp + 0x188], r13
mov qword [rbp + 0x190], 7
mov word [rbp + 0x178], r13w
mov qword [rbp + 0x118], r13
mov qword [rbp + 0x128], r13
mov qword [rbp + 0x130], 7
mov word [rbp + 0x118], r13w
lea rax, [rbp + 0x1cc]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140005b30
lea rdx, [rbp + 0x1cc]
lea rcx, [rbp + 0x118]
call fcn.140009ad0
nop
mov qword [rbp + 0xf8], r13
mov qword [rbp + 0x108], r13
mov qword [rbp + 0x110], 7
mov rax, qword [rbp + 0x128]
cmp rax, 4
jb 0x14000644e
add rax, 0xfffffffffffffffc
mov r8, rsi
cmp rax, rsi
cmovb r8, rax
lea rdx, [rbp + 0x118]
cmp qword [rbp + 0x130], 8
cmovae rdx, qword [rbp + 0x118]
add rdx, 8
lea rcx, [rbp + 0xf8]
call fcn.140009ad0
or r15d, 2
mov rdx, qword [rbp + 0x130]
cmp rdx, 8
jb 0x140005bf8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005bf3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006466
call fcn.14000ae0c
movups xmm0, xmmword [rbp + 0xf8]
movups xmmword [rbp + 0x118], xmm0
movups xmm1, xmmword [rbp + 0x108]
movups xmmword [rbp + 0x128], xmm1
test byte [rbp + 0x1a0], 0x10
jne 0x140005c3a
mov rdx, qword [rbp + 0x110]
cmp rdx, 8
jb 0x140005eb8
mov rcx, qword [rbp + 0xf8]
jmp 0x140005e86
lea rcx, [rbp + 0x118]
mov rax, qword [rbp + 0x108]
cmp qword [rbp + 0x110], 8
jb 0x140005c5f
mov rdi, qword [rbp + 0xf8]
lea rbx, [rdi + rax*2]
jmp 0x140005c6a
lea rbx, [rcx + rax*2]
lea rdi, [rbp + 0x118]
mov qword [rbp + 0x158], r13
mov rcx, r13
mov qword [rbp + 0x168], rcx
mov edx, 0xf
mov qword [rbp + 0x170], rdx
mov byte [rbp + 0x158], cl
mov rax, rbx
sub rax, rdi
sar rax, 1
cmp rax, 0x10
jb 0x140005cbc
mov rdx, rax
lea rcx, [rbp + 0x158]
call fcn.1400089f0
mov rcx, r13
mov qword [rbp + 0x168], rcx
mov rdx, qword [rbp + 0x170]
lea rax, [rbp + 0x158]
mov qword [rbp - 0x20], rax
cmp rdi, rbx
je 0x140005d27
nop dword [rax]
movzx r9d, byte [rdi]
cmp rcx, rdx
jae 0x140005d02
lea rax, [rcx + 1]
mov qword [rbp + 0x168], rax
lea rax, [rbp + 0x158]
cmp rdx, 0x10
cmovae rax, qword [rbp + 0x158]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140005d0e
lea rcx, [rbp + 0x158]
call fcn.140004b40
add rdi, 2
cmp rdi, rbx
je 0x140005d27
mov rdx, qword [rbp + 0x170]
mov rcx, qword [rbp + 0x168]
jmp 0x140005cd0
lea r8, [rbp + 0x158]
lea rdx, [rsp + 0x48]
call fcn.140002a70
nop
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x68]
call fcn.1400016d0
cmp eax, 0xffffffff
jne 0x140005db2
mov eax, dword [rsp + 0x48]
mov dword [rbp - 0x68], eax
mov eax, dword [rsp + 0x4c]
mov dword [rbp - 0x64], eax
mov eax, dword [rsp + 0x50]
mov dword [rbp - 0x60], eax
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
lea rcx, [rbp - 0x58]
call fcn.140008790
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
lea rcx, [rbp - 0x40]
call fcn.1400085a0
lea rdx, [rbp + 0x118]
cmp qword [rbp + 0x130], 8
cmovae rdx, qword [rbp + 0x118]
mov r8, qword [rbp + 0x128]
lea rcx, [rbp + 0x178]
call fcn.140009ad0
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140005e0d
mov rdx, qword [rsp + 0x78]
call fcn.140004cb0
mov rdx, qword [rbp - 0x80]
mov rcx, qword [rsp + 0x70]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005dfb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006460
call fcn.14000ae0c
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
lea rcx, [rsp + 0x58]
call fcn.1400042b0
nop
mov rdx, qword [rbp + 0x170]
cmp rdx, 0x10
jb 0x140005e59
inc rdx
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006466
call fcn.14000ae0c
mov qword [rbp + 0x168], r13
mov qword [rbp + 0x170], 0xf
mov byte [rbp + 0x158], 0
mov rdx, qword [rbp + 0x130]
cmp rdx, 8
jb 0x140005eb8
mov rcx, qword [rbp + 0x118]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140005eb3
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000646c
call fcn.14000ae0c
lea rdx, [rbp + 0x1a0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140005b00
mov qword [rbp + 0xf8], r13
mov qword [rbp + 0x108], r13
mov qword [rbp + 0x110], 0xf
mov byte [rbp + 0xf8], al
lea r8d, [rax + 5]
lea rdx, str.0.0.0
lea rcx, [rbp + 0xf8]
call fcn.140009cb0
nop
lea r8, [rbp + 0xf8]
lea rdx, [rsp + 0x48]
call fcn.140002a70
nop
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x68]
call fcn.1400016d0
test eax, eax
sete bl
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140005f87
mov rdx, qword [rsp + 0x78]
call fcn.140004cb0
mov rdx, qword [rbp - 0x80]
mov rcx, qword [rsp + 0x70]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000645a
call fcn.14000ae0c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
lea rcx, [rsp + 0x58]
call fcn.1400042b0
nop
mov rdx, qword [rbp + 0x110]
cmp rdx, 0x10
jb 0x140005fd3
inc rdx
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005fce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006472
call fcn.14000ae0c
test bl, bl
je 0x1400060cf
mov qword [r14], r13
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], 7
mov word [r14], r13w
nop
inc rsi
cmp word [r13 + rsi*2], 0
jne 0x140005ff0
mov r8, rsi
xor edx, edx
mov rcx, r14
call fcn.140009ad0
nop
mov rdx, qword [rbp + 0x190]
cmp rdx, 8
jb 0x140006050
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000604b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006478
call fcn.14000ae0c
mov qword [rbp + 0x188], r13
mov qword [rbp + 0x190], 7
mov word [rbp + 0x178], r13w
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1400060c1
mov rdx, qword [rbp - 0x38]
call fcn.140004cb0
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x40]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400060b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006442
call fcn.14000ae0c
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r13
lea rcx, [rbp - 0x58]
call fcn.1400042b0
jmp 0x1400059da
mov ecx, 0x208
call fcn.14000b170
mov rbx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r8d, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x5c
mov rcx, rbx
call fcn.14000cc6c
test rax, rax
jne 0x140006115
mov rcx, rbx
call fcn.14000ae0c
mov rbx, r13
jmp 0x140006120
mov word [rax], r13w
nop dword [rax]
inc rsi
cmp word [rbx + rsi*2], 0
jne 0x140006120
mov r8, rsi
mov rdx, rbx
lea rcx, [rbp + 0x138]
call fcn.140009ad0
lea rax, [0x1400328f8]
mov qword [rbp - 0x10], rax
lea rax, [0x1400328f0]
mov qword [rbp], rax
mov qword [rbp + 0x90], r13
mov qword [rbp + 0xb8], r13
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xc0], xmm0
lea rax, vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + 0x88], rax
or r15d, 4
mov dword [rsp + 0x30], r15d
lea rdx, [rbp + 8]
lea rcx, [rbp - 0x10]
call fcn.140007850
nop
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx - 0x10], rax
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx - 0x14], edx
lea rax, vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + 8], rax
mov ecx, 0x10
call fcn.14000b134
mov rbx, rax
mov cl, 1
call fcn.14000a3fc
mov qword [rbx + 8], rax
mov qword [rbp + 0x68], rbx
lea rax, [rbp + 0x10]
mov qword [rbp + 0x20], rax
lea rax, [rbp + 0x18]
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x38]
mov qword [rbp + 0x48], rax
lea rax, [rbp + 0x50]
mov qword [rbp + 0x58], rax
lea rax, [rbp + 0x54]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x30], r13
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + 8], rax
mov qword [rbp + 0x70], r13
mov dword [rbp + 0x78], r13d
lea rdx, [rbp + 0x138]
cmp qword [rbp + 0x150], 8
cmovae rdx, qword [rbp + 0x138]
mov r8, qword [rbp + 0x148]
lea rcx, [rbp]
call fcn.140008300
mov rcx, rax
call fcn.140007c00
lea rdx, [rbp + 0x178]
cmp qword [rbp + 0x190], 8
cmovae rdx, qword [rbp + 0x178]
mov r8, qword [rbp + 0x188]
mov rcx, rax
call fcn.140008300
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov qword [r14], r13
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], 7
mov word [r14], r13w
or r15d, 0x10
mov dword [rsp + 0x30], r15d
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
mov ecx, dword [rbp + 0x78]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x1400062e8
mov rax, qword [rbp + 0x48]
mov r8, qword [rax]
test r8, r8
je 0x1400062e8
mov rax, qword [rbp + 0x28]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0x70]
cmovb r8, qword [rbp + 0x70]
sub r8, rdx
sar r8, 1
jmp 0x140006323
test cl, 4
jne 0x140006315
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140006315
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x58]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
jmp 0x140006323
mov r8, qword [rbp + 0x120]
mov rdx, qword [rbp + 0x118]
test rdx, rdx
je 0x140006331
mov rcx, r14
call fcn.140009ad0
nop
lea rcx, [rbp - 0x10]
call fcn.140006500
nop
mov rdx, qword [rbp + 0x190]
cmp rdx, 8
jb 0x140006381
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000637c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006478
call fcn.14000ae0c
mov qword [rbp + 0x188], r13
mov qword [rbp + 0x190], 7
mov word [rbp + 0x178], r13w
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1400063ee
mov rdx, qword [rbp - 0x38]
call fcn.140004cb0
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x40]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400063dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006442
call fcn.14000ae0c
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r13
lea rcx, [rbp - 0x58]
call fcn.1400042b0
nop
mov rdx, qword [rbp + 0x150]
cmp rdx, 8
jb 0x140005a20
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006448
jmp 0x140005a1b
call fcn.140012290
nop
call fcn.140012290
nop
call fcn.140007be0
nop
call fcn.140012290
nop
call fcn.140012290
nop
call fcn.140012290
nop
call fcn.140012290
nop
call fcn.140012290
int3
call fcn.140012290
nop
call fcn.140012290
int3