Function at 0x1400e7040
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov r15, r8
mov r14, rdx
mov rsi, qword [r8]
mov rdi, qword [rsi + 8]
cmp byte [rdi + 0x19], 0
jne 0x1400e70c1
nop dword [rax]
nop word [rax + rax]
mov r8, qword [rdi + 0x10]
mov rdx, r15
mov rcx, r15
call fcn.1400caa40
mov rbx, rdi
mov rdi, qword [rdi]
lea rcx, [rbx + 0x20]
call fcn.1400166f0
mov edx, 0x40
mov rcx, rbx
call fcn.1402b5c4c
cmp byte [rdi + 0x19], 0
je 0x1400e7090
mov qword [rsi + 8], rsi
mov qword [rsi], rsi
mov qword [rsi + 0x10], rsi
xor r12d, r12d
mov qword [r15 + 8], r12
mov rdx, r14
lea rcx, [rbp - 0x70]
call fcn.140030a90
nop
lea edx, [r12 + 0x5c]
lea rcx, [rbp - 0x70]
call fcn.140099090
lea edx, [r12 + 0x2a]
lea rcx, [rbp - 0x70]
call fcn.140099090
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x50]
call fcn.1400b9ae0
cmp qword [rax + 0x18], 7
jbe 0x1400e7114
mov rax, qword [rax]
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
lea rcx, [rsp + 0x50]
call fcn.1400166f0
cmp rsi, 0xffffffffffffffff
je 0x1400e730c
lea r14, [0x140429348]
movabs r13, 0x3ffffffffffffff
nop dword [rax]
mov ebx, dword [rbp - 0x50]
mov edi, ebx
and edi, 0x10
and ebx, 0x400
lea rdx, [rbp - 0x24]
lea rcx, [rsp + 0x70]
call fcn.140030cb0
nop
lea r8, [rsp + 0x70]
mov r9, qword [rsp + 0x70]
mov r10, qword [rbp - 0x78]
cmp r10, 7
cmova r8, r9
mov r11, qword [rbp - 0x80]
cmp r11, 1
jne 0x1400e71b9
mov rdx, r11
lea rax, [0x1404132dc]
mov rcx, rax
sub r8, rax
nop dword [rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x1400e71b9
add rcx, 2
sub rdx, 1
jne 0x1400e71a0
lea eax, [rdx + 1]
jmp 0x1400e71f1
lea r8, [rsp + 0x70]
cmp r10, 7
cmova r8, r9
cmp r11, 2
jne 0x1400e71ee
mov rdx, r11
mov rcx, r14
sub r8, r14
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x1400e71ee
add rcx, 2
sub rdx, 1
jne 0x1400e71d5
lea eax, [rdx + 1]
jmp 0x1400e71f1
mov eax, r12d
test edi, edi
je 0x1400e72e4
test ebx, ebx
jne 0x1400e72e4
test eax, eax
jne 0x1400e72e4
mov rdi, qword [r15]
mov r9, qword [rdi + 8]
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x28], r12d
mov rbx, rdi
cmp byte [r9 + 0x19], al
jne 0x1400e7267
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x20], r9
lea rcx, [r9 + 0x20]
lea rdx, [rsp + 0x70]
call fcn.1400a9db0
test al, al
jns 0x1400e7252
mov dword [rsp + 0x28], r12d
mov r9, qword [r9 + 0x10]
jmp 0x1400e7260
mov dword [rsp + 0x28], 1
mov rbx, r9
mov r9, qword [r9]
cmp byte [r9 + 0x19], 0
je 0x1400e7230
cmp byte [rbx + 0x19], 0
jne 0x1400e727f
lea rdx, [rbx + 0x20]
lea rcx, [rsp + 0x70]
call fcn.1400a9db0
test al, al
jns 0x1400e72e4
cmp qword [r15 + 8], r13
je 0x1400e734a
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r12
mov ecx, 0x40
call fcn.1402b5c5c
mov rbx, rax
mov qword [rsp + 0x48], rax
lea rcx, [rax + 0x20]
lea rdx, [rsp + 0x70]
call fcn.140030a90
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov word [rbx + 0x18], 0
mov qword [rsp + 0x48], r12
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.140021930
nop
lea rcx, [rsp + 0x70]
call fcn.1400166f0
lea rdx, [rbp - 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400e7150
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp qword [r15 + 8], 0
setne bl
lea rcx, [rbp - 0x70]
call fcn.1400166f0
movzx eax, bl
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.1402b5c00
mov rbx, qword [rsp + 0x350]
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14002aa00
nop
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rsp + 0xa0]
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140030a90
nop
mov edx, 0x5c
lea rcx, [rsp + 0x20]
call fcn.140099090
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x1400e73a4
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14002ac00
mov rax, qword [rdi]
lea r9, [rsp + 0x20]
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call qword [rax + 0xa8]
nop
lea rcx, [rsp + 0x20]
call fcn.1400166f0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402b5c00
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret