Function at 0x140030560
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x610
mov rax, qword [0x140125350]
xor rax, rsp
mov qword [rsp + 0x600], rax
mov qword [rsp + 0x630], r12
xor r12d, r12d
lea rcx, [rsp + 0x3e1]
mov esi, r12d
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x3e0], sil
call fcn.14008ca20
lea rcx, [rsp + 0x2d1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x2d0], sil
call fcn.14008ca20
mov rcx, qword [0x1401279e8]
lea rbx, [0x1400e6000]
mov rdx, rbx
call fcn.140001519
mov rbp, rax
test rax, rax
je 0x1400307cf
lea ecx, [r12 + 0x24]
mov r9d, 0x80000000
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x638], r14
mov qword [rsp + 0x640], r15
call fcn.14000167c
xor edx, edx
xor r9d, r9d
lea ecx, [rdx + 0x24]
or r8d, 0xffffffff
mov r15, rax
call fcn.14000167c
xor edx, edx
xor r9d, r9d
lea ecx, [rdx + 0x24]
or r8d, 0xffffffff
mov rdi, rax
call fcn.14000167c
cmp dword [reloc.WSOCK32.dll_accept], 4
mov qword [rsp + 0x40], r12
mov r14, rax
jl 0x140030699
test dword [0x140124900], 0x200
je 0x140030699
lea rax, [rsp + 0x2d0]
lea r9, str.....esif_uf_dspmgr.c
lea r8, str.esif_dsp_file_scan
mov qword [rsp + 0x38], rax
lea rax, str.SCAN_CONFIG_For_DSP_Files_NameSpace___s__Pattern__s
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea edx, [r12 + 4]
mov ecx, 0x200
mov dword [rsp + 0x20], 0x34d
call fcn.140001a41
test r15, r15
je 0x1400307a7
test rdi, rdi
je 0x1400307a7
test r14, r14
je 0x1400307a7
lea r9, [rsp + 0x40]
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.1400012b7
mov esi, eax
test eax, eax
jne 0x1400307a7
mov eax, dword [rdi + 0x10]
cmp eax, 5
jb 0x140030746
mov ecx, eax
mov rax, qword [rdi + 4]
lea rdx, [0x1400e6bb8]
add rax, 0xfffffffffffffffb
add rcx, rax
call fcn.14008d268
test eax, eax
jne 0x140030746
mov ecx, 0x104
call fcn.14008c958
mov rbx, rax
test rax, rax
je 0x140030718
xor edx, edx
mov r8d, 0x104
mov rcx, rax
call fcn.14008ca20
mov r8, qword [rdi + 4]
or r9, 0xffffffffffffffff
mov edx, 0x104
mov rcx, rbx
call fcn.14008cdb8
mov rcx, rbx
call fcn.14002ef90
test eax, eax
je 0x140030746
test rbx, rbx
je 0x140030746
mov rcx, rbx
call fcn.14008c8c8
xor r8d, r8d
or r9d, 0xffffffff
mov rcx, rdi
lea edx, [r8 + 0x24]
mov dword [rsp + 0x20], r12d
call fcn.140001456
xor r8d, r8d
or r9d, 0xffffffff
lea edx, [r8 + 0x24]
mov rcx, r14
mov dword [rsp + 0x20], r12d
call fcn.140001456
lea r9, [rsp + 0x40]
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.140001325
mov esi, eax
test eax, eax
je 0x1400306d1
lea rcx, [rsp + 0x40]
call fcn.140001271
cmp esi, 0x3ed
cmove esi, r12d
mov rcx, r15
call fcn.140001771
mov rcx, rdi
call fcn.140001771
mov rcx, r14
call fcn.140001771
mov r15, qword [rsp + 0x640]
mov r14, qword [rsp + 0x638]
xor r9d, r9d
lea rcx, [rsp + 0x3e0]
mov edx, 0x104
lea r8d, [r9 + 9]
mov qword [rsp + 0x20], r12
call fcn.140001b59
lea r8, str..edp
lea rcx, [rsp + 0x2d0]
or r9, 0xffffffffffffffff
mov edx, 0x104
call fcn.14008cdb8
cmp dword [reloc.WSOCK32.dll_accept], 4
mov r12, qword [rsp + 0x630]
jl 0x140030872
test dword [0x140124900], 0x200
je 0x140030872
lea rax, [rsp + 0x2d0]
lea r9, str.....esif_uf_dspmgr.c
lea r8, str.esif_dsp_file_scan
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x3e0]
mov edx, 4
mov qword [rsp + 0x30], rax
lea rax, str.SCAN_File_System_For_DSP_Files_Path___s__Pattern__s
mov ecx, 0x200
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x36c
call fcn.140001a41
mov ecx, 0x104
call fcn.14008c958
mov rbx, rax
test rax, rax
je 0x140030894
xor edx, edx
mov r8d, 0x104
mov rcx, rax
call fcn.14008ca20
test rbx, rbx
jne 0x1400308e7
cmp dword [reloc.WSOCK32.dll_accept], 1
jl 0x1400308dd
test dword [0x1401248cd], 0x200
je 0x1400308dd
lea rax, str.Fail_to_allocate_esif_ccb_file_n
lea r9, str.....esif_uf_dspmgr.c
lea r8, str.esif_dsp_file_scan
mov qword [rsp + 0x28], rax
lea edx, [rbx + 1]
mov ecx, 0x200
mov dword [rsp + 0x20], 0x370
call fcn.140001a41
mov eax, 0x708
jmp 0x1400309f8
lea rax, [rsp + 0x2d0]
lea r9, [rsp + 0x3e0]
lea r8, [0x1400dd480]
mov qword [rsp + 0x28], rax
lea rax, [0x1400dd47c]
lea rdx, [rsp + 0x4f0]
mov ecx, 0x104
mov qword [rsp + 0x20], rax
call fcn.14002ebc0
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400309e4
lea r8, [rsp + 0x1bc]
or r9, 0xffffffffffffffff
mov edx, 0x104
mov rcx, rbx
call fcn.14008cdb8
nop dword [rax]
test rbp, rbp
je 0x140030976
mov rcx, qword [rbp + 0x58]
mov rdx, rbx
call fcn.140001280
test rax, rax
jne 0x1400309ac
mov rcx, rbx
call fcn.14002ef90
test eax, eax
je 0x14003098a
mov rcx, rbx
call fcn.14008c8c8
mov ecx, 0x104
call fcn.14008c958
mov rbx, rax
test rax, rax
je 0x1400309ac
xor edx, edx
mov r8d, 0x104
mov rcx, rax
call fcn.14008ca20
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1400309d9
lea r8, [rsp + 0x7c]
or r9, 0xffffffffffffffff
mov edx, 0x104
mov rcx, rbx
call fcn.14008cdb8
test rbx, rbx
jne 0x140030960
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1400309e9
mov esi, 0x3eb
test rbx, rbx
je 0x1400309f6
mov rcx, rbx
call fcn.14008c8c8
mov eax, esi
mov rcx, qword [rsp + 0x600]
xor rcx, rsp
call fcn.14008d900
mov rbx, qword [rsp + 0x648]
add rsp, 0x610
pop rdi
pop rsi
pop rbp
ret