Function at 0x1400192c0
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x350
mov r14, rcx
xor r15d, r15d
mov rcx, qword [rcx + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 2
jb 0x140019e30
mov r9, r14
cmp qword [r14 + 0x18], 7
jbe 0x140019305
mov r9, qword [r14]
mov qword [rsp + 0x30], 2
lea rax, [0x140057328]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x40]
call fcn.140008a80
nop
mov rbx, qword [0x14006a148]
mov rdi, qword [0x14006a150]
nop dword [rax + rax]
cmp rbx, rdi
je 0x140019454
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140019356
mov rdx, qword [rbx]
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x14001944b
cmp qword [rbx + 0x18], 7
jbe 0x140019380
mov rbx, qword [rbx]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rdx, qword [rsp + 0x40]
mov r8, rbx
lea rcx, str.____Scan__Skip_directory:__s__found__s_n
call fcn.140001e00
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400193e3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400193de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019e7e
call fcn.140024d64
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r15w
mov rdx, qword [r14 + 0x18]
cmp rdx, 7
jbe 0x140019436
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140019431
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140019e4e
mov rcx, r8
call fcn.140024d64
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], 7
mov word [r14], r15w
jmp 0x140019e17
add rbx, 0x20
jmp 0x140019340
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x100]
call fcn.140047180
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rcx, qword [rsp + 0x40]
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rsp + 0x100]
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov r13, rax
mov qword [rsp + 0x398], rax
cmp rax, 0xffffffffffffffff
jne 0x140019582
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rdx, qword [rsp + 0x40]
mov r8d, eax
lea rcx, str.____Scan__Can_t_open_directory__s__error_0x_X_n
call fcn.140001e00
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14001951a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019515
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019e7e
call fcn.140024d64
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r15w
mov rdx, qword [r14 + 0x18]
cmp rdx, 7
jbe 0x14001956d
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140019568
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140019e4e
mov rcx, r8
call fcn.140024d64
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], 7
mov word [r14], r15w
jmp 0x140019e17
lea rdx, [0x1400573e0]
movabs rbx, 0x7fffffffffffffff
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rsp + 0x12c]
movzx eax, word [rsp + 0x12e]
cmp cx, 0x2e
jne 0x1400195d9
cmp ax, cx
jne 0x1400195ca
cmp word [rsp + 0x130], 0
je 0x140019d48
cmp cx, 0x2e
jne 0x1400195d9
test ax, ax
je 0x140019d48
mov rcx, qword [r14 + 0x10]
movabs r12, 0x7ffffffffffffffe
mov rax, r12
sub rax, rcx
cmp rax, 1
jb 0x140019e36
mov r9, r14
cmp qword [r14 + 0x18], 7
jbe 0x140019604
mov r9, qword [r14]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x98]
call fcn.140008a80
nop
lea rax, [rsp + 0x12c]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140019634
lea rdx, [rsp + 0x12c]
lea rcx, [rsp + 0x98]
call fcn.140006450
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400196c7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400196b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019e3c
call fcn.140024d64
movups xmm0, xmmword [rsp + 0x80]
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm1
mov rdx, qword [rsp + 0xb0]
cmp rdx, 7
jbe 0x140019719
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019714
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019e42
call fcn.140024d64
mov rax, qword [0x140062cd0]
cmp qword [0x140062cc8], rax
je 0x1400198c8
lea rdx, str.Program_Files
lea rcx, [rsp + 0x12c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140019763
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x12c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400198c8
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rcx, qword [rsp + 0x40]
lea rdx, str.Program_Files_
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x1400197ad
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rcx, qword [rsp + 0x40]
lea rdx, str.Program_Files__x86__
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x1400198c8
mov rbx, qword [0x140062cc8]
mov rdi, qword [0x140062cd0]
cmp rbx, rdi
je 0x1400197f6
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1400197cd
mov rdx, qword [rbx]
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x1400198be
add rbx, 0x20
cmp rbx, rdi
jne 0x1400197c0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rdx, qword [rsp + 0x40]
lea rcx, str.____Scan__Skip:__s_n
call fcn.140001e00
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140019856
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019851
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019e7e
call fcn.140024d64
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r15w
mov rdx, qword [r14 + 0x18]
cmp rdx, 7
jbe 0x1400198a9
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400198a4
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140019e4e
mov rcx, r8
call fcn.140024d64
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], 7
mov word [r14], r15w
jmp 0x140019e17
movabs rbx, 0x7fffffffffffffff
test byte [rsp + 0x100], 0x10
je 0x140019a14
lea rdx, [0x140062d68]
cmp qword [0x140062d80], 7
cmova rdx, qword [0x140062d68]
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140019d48
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov rdi, qword [rsp + 0x50]
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rsi, qword [rsp + 0x40]
cmp rdi, r12
ja 0x140019e48
mov qword [rsp + 0x78], 7
cmp rdi, 7
ja 0x14001995f
mov qword [rsp + 0x70], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x60], xmm0
jmp 0x140019a05
mov rax, rdi
or rax, 7
cmp rax, r12
jbe 0x140019971
lea rcx, [rbx + rbx]
jmp 0x1400199a2
cmp rax, 0xa
mov ecx, 0xa
cmovb rax, rcx
lea rbx, [rax + 1]
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140019e54
lea rcx, [rbx + rbx]
cmp rcx, 0x1000
jb 0x1400199d1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140019e59
mov rcx, rax
call fcn.140024d6c
mov rcx, rax
test rax, rax
je 0x140019e5e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400199e0
test rcx, rcx
je 0x1400199dd
call fcn.140024d6c
jmp 0x1400199e0
mov rax, r15
dec rbx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rbx
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.140046ae0
lea rcx, [rsp + 0x60]
call fcn.1400192c0
jmp 0x140019d48
mov eax, dword [rsp + 0x120]
mov dword [rsp + 0x3a0], eax
mov eax, dword [rsp + 0x11c]
mov dword [rsp + 0x3a4], eax
mov rbx, qword [rsp + 0x3a0]
cmp rbx, 0x3e8
jl 0x140019d48
lea rdx, [0x140062c90]
cmp qword [0x140062ca8], 7
cmova rdx, qword [0x140062c90]
lea rcx, [rsp + 0x12c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140019d48
lea rcx, [0x140062d48]
cmp qword [0x140062d60], 7
cmova rcx, qword [0x140062d48]
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
cmp rdx, qword [0x140062d58]
jne 0x140019acd
test rdx, rdx
je 0x140019d48
sub r8, rcx
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140019acd
add rcx, 2
sub rdx, 1
jne 0x140019ab4
jmp 0x140019d48
lea rcx, [rsp + 0x12c]
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov r12, rax
mov rdi, qword [0x140062dc0]
mov rsi, qword [0x140062dc8]
cmp rdi, rsi
je 0x140019b18
mov rdx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140019afe
mov rdx, qword [rdi]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140019d48
add rdi, 0x20
cmp rdi, rsi
jne 0x140019af1
lea rdx, [0x140062df8]
cmp qword [0x140062e10], 7
cmova rdx, qword [0x140062df8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140019d48
mov edx, dword [rsp + 0x100]
test dl, 1
je 0x140019b93
and edx, 0xfffffffe
mov dword [rsp + 0x100], edx
lea rcx, [rsp + 0x12c]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140019b93
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rdx, qword [rsp + 0x40]
mov r8d, eax
lea rcx, str.____Scan__Can_t_unset_attributes_for:__s__error:_0x_X_n
call fcn.140001e00
jmp 0x140019d48
mov ecx, 0x28
call fcn.140024d6c
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
xor eax, eax
mov qword [rsi + 0x20], rax
lea rax, [rsp + 0x40]
cmp rsi, rax
je 0x140019c16
mov rdx, qword [rsp + 0x50]
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova r9, qword [rsp + 0x40]
mov rax, qword [rsi + 0x18]
cmp rdx, rax
ja 0x140019c0e
mov r12, rsi
cmp rax, 7
jbe 0x140019bf1
mov r12, qword [rsi]
mov qword [rsi + 0x10], rdx
lea rdi, [rdx + rdx]
mov r8, rdi
mov rdx, r9
mov rcx, r12
call fcn.140046ae0
mov word [r12 + rdi], r15w
jmp 0x140019c16
mov rcx, rsi
call fcn.1400076b0
mov qword [rsi + 0x20], rbx
mov r13, qword [0x14006a080]
test r13, r13
je 0x140019d38
lea rax, vtable.std::_Func_impl_no_alloc_class__void___cdecl_ScanDirectory_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___::_60::_lambda_1___void___.0
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rsi
lea rax, [rsp + 0xb8]
mov qword [rsp + 0xf0], rax
lea rbx, [r13 + 0x40]
mov qword [rsp + 0x3a8], rbx
mov rcx, rbx
call fcn.140024aac
test eax, eax
jne 0x140019e64
mov eax, dword [rbx + 0x4c]
cmp eax, 0x7fffffff
je 0x140019e6e
mov rax, qword [r13 + 0x38]
inc rax
cmp qword [r13 + 0x28], rax
ja 0x140019c91
lea rcx, [r13 + 0x18]
call fcn.14001ebc0
mov rdx, qword [r13 + 0x28]
dec rdx
mov rcx, rdx
and rcx, qword [r13 + 0x30]
mov qword [r13 + 0x30], rcx
add rcx, qword [r13 + 0x38]
and rdx, rcx
lea rsi, [rdx*8]
mov rax, qword [r13 + 0x20]
cmp qword [rsi + rax], 0
jne 0x140019ccf
mov ecx, 0x40
call fcn.140024d6c
mov rcx, qword [r13 + 0x20]
mov qword [rsi + rcx], rax
mov rax, qword [r13 + 0x20]
mov rsi, qword [rsi + rax]
mov qword [rsp + 0x80], rsi
mov qword [rsi + 0x38], r15
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x140019cfc
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax]
mov qword [rsi + 0x38], rax
inc qword [r13 + 0x38]
mov rcx, rbx
call fcn.140024ad0
lea rcx, [r13 + 0x90]
call fcn.14002334c
nop
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x140019d40
mov rax, qword [rcx]
lea rdx, [rsp + 0xb8]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140019d40
mov rcx, rsi
call fcn.1400180c0
mov r13, qword [rsp + 0x398]
lea rdx, [rsp + 0x100]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
movabs rbx, 0x7fffffffffffffff
lea rdx, [0x1400573e0]
jne 0x1400195a0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140019dbf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019db9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019e7e
call fcn.140024d64
nop
jmp 0x140019dcc
mov rdx, qword [r14 + 0x18]
cmp rdx, 7
jbe 0x140019e07
lea rdx, [rdx*2 + 2]
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x140019e02
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140019e2a
mov rcx, r8
call fcn.140024d64
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], 7
mov word [r14], r15w
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.1400360b4
nop
call fcn.1400016e0
nop
call fcn.1400016e0
nop
call fcn.1400360b4
nop
call fcn.1400360b4
int3
call fcn.1400016e0
nop
call fcn.1400360b4
nop
call fcn.140001640
call fcn.140001640
call fcn.1400360b4
nop
mov ecx, 5
call fcn.140024a10
dec eax
mov dword [rbx + 0x4c], eax
mov ecx, 6
call fcn.140024a10
nop
call fcn.1400360b4
int3