Function at 0x1400c1570
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x7a8]
sub rsp, 0x870
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x1402a7d08]
xor rax, rsp
mov qword [rbp + 0x740], rax
mov edi, r8d
mov rbx, rdx
mov r12, rcx
mov qword [rbp - 0x18], rcx
xor esi, esi
mov dword [rsp + 0x30], esi
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp + 0x370]
call fcn.140132a80
lea rcx, [rbp + 0x370]
call fcn.140035020
nop
mov r8, rbx
mov rdx, r12
lea rcx, [rbp + 0x370]
call fcn.140035270
test al, al
jne 0x1400c1632
lea r13, [0x1402aa8a0]
mov rcx, qword [0x1402aa8a0]
cmp rcx, r13
je 0x1400c1628
test byte [rcx + 0x44], 2
je 0x1400c1628
cmp byte [rcx + 0x41], 4
jb 0x1400c1628
lea edx, [rsi + 0x29]
mov r9, rbx
lea r8, [0x140234238]
mov rcx, qword [rcx + 0x38]
call fcn.140034f00
mov esi, 0x57
jmp 0x1400c2147
mov ecx, 0x20af0
mov r15d, 0xb0
test edi, edi
cmovne r15d, ecx
add r15, r12
mov qword [rbp - 0x28], r15
lea rcx, [r15 + 0x6f0]
call fcn.14009e4b0
lea rcx, [rbp + 0x370]
call fcn.140035790
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], 7
mov word [rbp + 0x18], si
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400c1680
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.140007240
nop
lea r13, [0x1402aa8a0]
mov rcx, qword [0x1402aa8a0]
cmp rcx, r13
je 0x1400c16db
test byte [rcx + 0x44], 2
je 0x1400c16db
cmp byte [rcx + 0x41], 4
jb 0x1400c16db
lea r9, [rbp + 0x18]
cmp qword [rbp + 0x30], 8
cmovae r9, qword [rbp + 0x18]
mov edx, 0x2a
lea r8, [0x140234238]
mov rcx, qword [rcx + 0x38]
call fcn.140033560
nop
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], si
mov dword [rsp + 0x30], 2
mov rdx, qword [rbp + 0x28]
add rdx, 2
lea rcx, [rsp + 0x58]
call fcn.140033b60
lea r9, [rbp + 0x18]
cmp qword [rbp + 0x30], 8
cmovae r9, qword [rbp + 0x18]
mov rdi, qword [rbp + 0x28]
mov r14, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
sub rax, r14
cmp rdi, rax
ja 0x1400c1761
lea rax, [r14 + rdi]
mov qword [rsp + 0x68], rax
lea rbx, [rsp + 0x58]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x58]
lea r8, [rdi + rdi]
lea rcx, [rbx + r14*2]
mov rdx, r9
call fcn.140132e10
lea rax, [r14 + rdi]
mov word [rbx + rax*2], si
jmp 0x1400c177a
lfence
mov rdx, qword [rbp + 0x28]
mov qword [rsp + 0x20], rdx
xor r8d, r8d
lea rcx, [rsp + 0x58]
call fcn.14001c380
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rax, r8
sub rax, rdx
cmp rax, 2
jb 0x1400c17b5
lea rcx, [rdx + 2]
mov qword [rsp + 0x68], rcx
lea rax, [rsp + 0x58]
cmp r8, 8
cmovae rax, qword [rsp + 0x58]
mov dword [rax + rdx*2], 0x2a005c
mov word [rax + rcx*2], si
jmp 0x1400c17d9
lfence
mov qword [rsp + 0x20], 2
lea r9, [0x140234410]
xor r8d, r8d
lea edx, [r8 + 2]
lea rcx, [rsp + 0x58]
call fcn.14001c380
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
lea rdx, [rbp + 0x4f0]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov rdi, rax
mov qword [rbp - 0x20], rax
mov ebx, esi
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1400c1842
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c183d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c218f
call fcn.14013ff64
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], si
cmp rdi, 0xffffffffffffffff
je 0x1400c20fb
mov rcx, qword [0x1402aa8a0]
cmp rcx, r13
je 0x1400c188c
test byte [rcx + 0x44], 2
je 0x1400c188c
cmp byte [rcx + 0x41], 4
jb 0x1400c188c
mov edx, 0x2b
lea r8, [0x140234238]
mov rcx, qword [rcx + 0x38]
call fcn.140024300
lea r14, [0x140234418]
nop dword [rax]
nop word [rax + rax]
mov qword [rbp + 8], rsi
mov qword [rbp + 0x10], 7
mov word [rbp - 8], si
lea rax, [rbp + 0x51c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1400c18c0
lea rdx, [rbp + 0x51c]
lea rcx, [rbp - 8]
call fcn.140007240
nop
lea r8, [rbp - 8]
mov r9, qword [rbp - 8]
mov r10, qword [rbp + 0x10]
cmp r10, 8
cmovae r8, r9
mov r11, qword [rbp + 8]
cmp r11, 1
jne 0x1400c1929
mov rdx, r11
lea rax, [0x140261e14]
mov rcx, rax
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x1400c1929
add rcx, 2
sub rdx, 1
jne 0x1400c1910
jmp 0x1400c2079
lea r8, [rbp - 8]
cmp r10, 8
cmovae r8, r9
cmp r11, 2
jne 0x1400c195c
mov rdx, r11
mov rcx, r14
sub r8, r14
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x1400c195c
add rcx, 2
sub rdx, 1
jne 0x1400c1944
mov al, 1
jmp 0x1400c195e
xor al, al
test al, al
jne 0x1400c2079
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], si
mov r8d, 1
lea rdx, [0x14025b700]
lea rcx, [rsp + 0x78]
call fcn.140007240
nop
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], si
or ebx, 4
mov dword [rsp + 0x30], ebx
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [r12 + rcx*2 + 0x68], 0
jne 0x1400c19b0
mov rdx, qword [rbp + 0x28]
add rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.140033b60
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [r12 + rdx*2 + 0x68], 0
jne 0x1400c19d4
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x50]
sub rax, rcx
lfence
cmp rdx, rax
ja 0x1400c1a2b
mov rdi, qword [rsp + 0x48]
add rdi, rdx
mov qword [rsp + 0x48], rdi
lea rbx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rbx, qword [rsp + 0x38]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
lea rdx, [r12 + 0x68]
call fcn.140132e10
mov word [rbx + rdi*2], si
jmp 0x1400c1a42
mov qword [rsp + 0x20], rdx
lea r9, [r12 + 0x68]
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.14001c380
lea r9, [rbp + 0x18]
cmp qword [rbp + 0x30], 8
cmovae r9, qword [rbp + 0x18]
mov rdi, qword [rbp + 0x28]
mov r14, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
sub rax, r14
cmp rdi, rax
ja 0x1400c1a9b
lea rax, [r14 + rdi]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x38]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x38]
lea r8, [rdi + rdi]
lea rcx, [rbx + r14*2]
mov rdx, r9
call fcn.140132e10
lea rax, [r14 + rdi]
mov word [rbx + rax*2], si
jmp 0x1400c1ab4
lfence
mov rdx, qword [rbp + 0x28]
mov qword [rsp + 0x20], rdx
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.14001c380
mov rcx, qword [rsp + 0x50]
mov rax, rcx
mov r12, qword [rsp + 0x48]
sub rax, r12
mov r9, qword [rbp - 0x70]
mov r8, qword [rbp - 0x78]
cmp r8, rax
jbe 0x1400c1bac
mov rax, r9
sub rax, r8
cmp rax, r12
jb 0x1400c1bac
lea r14, [rsp + 0x38]
cmp rcx, 8
cmovae r14, qword [rsp + 0x38]
lfence
cmp r12, rax
ja 0x1400c1b8b
mov rdi, qword [rsp + 0x48]
add qword [rbp - 0x78], rdi
lea r15, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae r15, qword [rsp + 0x78]
lea rcx, [rdi + rdi]
lea rax, [r14 + rcx]
cmp rax, r15
jbe 0x1400c1b41
lea rax, [r15 + r8*2]
cmp r14, rax
ja 0x1400c1b41
cmp r15, r14
ja 0x1400c1b38
mov rdi, rsi
jmp 0x1400c1b41
mov rdi, r15
sub rdi, r14
sar rdi, 1
lea r8, [r8*2 + 2]
add rcx, r15
mov rdx, r15
call fcn.140132e10
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, r14
mov rcx, r15
call fcn.140132e10
mov r8, r12
sub r8, rdi
add r8, r8
lea rax, [rdi + r12]
lea rdx, [r14 + rax*2]
lea rcx, [rbx + r15]
call fcn.140132e10
lea rax, [rsp + 0x78]
mov r15, qword [rbp - 0x28]
jmp 0x1400c1bc5
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.14007d990
jmp 0x1400c1bc5
lea rdx, [rsp + 0x78]
cmp r9, 8
cmovae rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.14001b5a0
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
mov ebx, dword [rsp + 0x30]
movups xmm1, xmmword [rax + 0x10]
or ebx, 8
movups xmmword [rbp - 0x58], xmm1
mov dword [rsp + 0x30], ebx
mov word [rax], si
mov qword [rax + 0x18], 7
mov qword [rax + 0x10], rsi
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rdx, qword [rbp - 8]
mov r8, qword [rbp + 8]
lea rcx, [rbp - 0x68]
call fcn.14001b5a0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
or ebx, 0x10
lea rcx, [rbp - 8]
call fcn.140007180
movups xmmword [rbp - 8], xmm6
movups xmmword [rbp + 8], xmm7
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x1400c1c7b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c1c76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c219b
call fcn.14013ff64
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], si
and ebx, 0xfffffffb
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x1400c1cd0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c1ccb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c21a1
call fcn.14013ff64
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], si
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x1400c1d24
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c1d1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c21a7
call fcn.14013ff64
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp + 0x1f0]
call fcn.140132a80
lea rcx, [rbp + 0x1f0]
call fcn.140035020
nop
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rdx, qword [rbp - 8]
xor r8d, r8d
lea rcx, [rbp + 0x1f0]
call fcn.140035890
test al, al
je 0x1400c201a
mov rcx, qword [0x1402aa8a0]
cmp rcx, r13
je 0x1400c1da5
test byte [rcx + 0x44], 2
je 0x1400c1da5
cmp byte [rcx + 0x41], 4
jb 0x1400c1da5
lea r9, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae r9, qword [rbp - 8]
mov edx, 0x2c
lea r8, [0x140234238]
mov rcx, qword [rcx + 0x38]
call fcn.140033560
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0x40]
call fcn.14009bb60
lea rax, vtable.MigratingFile.0
mov qword [rbp + 0x40], rax
mov dword [rbp + 0xb8], esi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xc0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xd0], xmm1
mov qword [rbp + 0xe0], r15
lea rax, vtable.SparseFragmentsFilter.0
mov qword [rbp + 0x38], rax
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x40]
call fcn.14009bbc0
mov r8b, 1
lea rdx, [rbp + 0x40]
mov rcx, r15
call fcn.14009fc80
test eax, eax
je 0x1400c1fc4
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0xf0]
call fcn.140132a80
mov edx, 3
lea r8d, [rdx - 2]
lea rcx, [rbp + 0xf0]
call fcn.140005bf0
nop
lea rdx, str.File
lea rcx, [rbp + 0x100]
call fcn.1400085f0
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rdx, qword [rbp - 8]
mov r8, qword [rbp + 8]
mov rcx, rax
call fcn.140015080
mov rcx, rax
lea rdx, str._cannot
call fcn.1400085f0
lea rdx, str.be_placed__n
lea rcx, [rbp + 0x100]
call fcn.1400085f0
mov rcx, qword [0x1402aa8a0]
cmp rcx, r13
je 0x1400c1f6b
test byte [rcx + 0x44], 2
je 0x1400c1f6b
cmp byte [rcx + 0x41], 5
jb 0x1400c1f6b
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], si
or ebx, 0x40
mov dword [rsp + 0x30], ebx
mov edx, dword [rbp + 0x178]
test dl, 2
jne 0x1400c1efe
mov rax, qword [rbp + 0x148]
mov r8, qword [rax]
test r8, r8
je 0x1400c1efe
mov rax, qword [rbp + 0x128]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0x170]
cmovb r8, qword [rbp + 0x170]
sub r8, rdx
jmp 0x1400c1f2f
test dl, 4
jne 0x1400c1f42
mov rax, qword [rbp + 0x140]
mov r9, qword [rax]
test r9, r9
je 0x1400c1f42
mov rax, qword [rbp + 0x120]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x158]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, r9
sar r8, 1
lea rcx, [rbp - 0x48]
call fcn.140007240
mov rcx, qword [0x1402aa8a0]
and ebx, 0xffffffbf
or ebx, 0x21
lea r9, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae r9, qword [rbp - 0x48]
mov edx, 0x2d
lea r8, [0x140234238]
mov rcx, qword [rcx + 0x38]
call fcn.140033560
test bl, 1
je 0x1400c1fb7
and ebx, 0xfffffffe
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x1400c1fb3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c1fae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c21ad
call fcn.14013ff64
mov word [rbp - 0x48], si
lea rcx, [rbp + 0xf0]
call fcn.140005020
nop
lea rcx, [rbp + 0xd8]
call fcn.140034400
lea rcx, [rbp + 0xd0]
call fcn.140034400
lea rcx, [rbp + 0xc8]
call fcn.140034400
lea rcx, [rbp + 0xc0]
call fcn.140034400
lea rcx, [rbp + 0x78]
call fcn.1400348c0
lea rcx, [rbp + 0x68]
call fcn.1400348c0
lea rcx, [rbp + 0x58]
call fcn.1400348c0
lea rcx, [rbp + 0x48]
call fcn.1400348c0
jmp 0x1400c2056
mov rcx, qword [0x1402aa8a0]
cmp rcx, r13
je 0x1400c2056
test byte [rcx + 0x44], 2
je 0x1400c2056
cmp byte [rcx + 0x41], 4
jb 0x1400c2056
lea r9, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae r9, qword [rbp - 8]
mov edx, 0x2e
lea r8, [0x140234238]
mov rcx, qword [rcx + 0x38]
call fcn.140033560
nop
lea rcx, [rbp + 0x1f0]
call fcn.140037090
mov r10, qword [rbp + 0x10]
mov r9, qword [rbp - 8]
mov rdi, qword [rbp - 0x20]
mov r12, qword [rbp - 0x18]
lea r14, [0x140234418]
cmp r10, 8
jb 0x1400c20b4
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x1400c20ac
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c2189
mov rcx, r9
call fcn.14013ff64
lea rdx, [rbp + 0x4f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_FindNextFileW]
cmp eax, 1
je 0x1400c18a0
mov rcx, qword [0x1402aa8a0]
cmp rcx, r13
je 0x1400c20fb
test byte [rcx + 0x44], 2
je 0x1400c20fb
cmp byte [rcx + 0x41], 4
jb 0x1400c20fb
mov edx, 0x2f
lea r8, [0x140234238]
mov rcx, qword [rcx + 0x38]
call fcn.140024300
nop
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x1400c2137
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c2132
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c2195
call fcn.14013ff64
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], 7
mov word [rbp + 0x18], si
lea rcx, [rbp + 0x370]
call fcn.140037090
mov eax, esi
mov rcx, qword [rbp + 0x740]
xor rcx, rsp
call fcn.140140100
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400e0284
nop
call fcn.1400e0284
nop
call fcn.1400e0284
nop
call fcn.1400e0284
nop
call fcn.1400e0284
nop
call fcn.1400e0284
nop
call fcn.1400e0284
int3