Function at 0x1400024a0
Capabilities:
Enumerate files on windows
Enumerate files recursively
Write file on windows

Disassembly:
push rbp
push rbx
push rdi
push r12
push r14
lea rbp, [rsp - 0x5b0]
sub rsp, 0x6b0
movzx r9d, word [rcx]
mov r14, rcx
mov word [rbp + 0x150], r9w
mov rdx, rcx
test r9w, r9w
je 0x140002500
lea r8, [rbp + 0x150]
sub r8, rcx
nop dword [rax]
movzx eax, word [rdx + 2]
lea rdx, [rdx + 2]
mov word [r8 + rdx], ax
test ax, ax
jne 0x1400024e0
xor ecx, ecx
inc ecx
cmp word [r14 + rcx*2], 0
jne 0x1400024f4
jmp 0x140002502
xor ecx, ecx
movsxd rax, ecx
cmp word [r14 + rax*2 - 2], 0x5c
jne 0x14000252c
xor ecx, ecx
test r9w, r9w
je 0x140002520
inc ecx
cmp word [r14 + rcx*2], 0
jne 0x140002516
movsxd rax, ecx
cmp word [r14 + rax*2 - 2], 0x2f
je 0x140002563
lea rcx, [rbp + 0x150]
lea rdx, [0x1400066b0]
nop word [rax + rax]
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x140002540
sub rcx, 4
movzx eax, word [rdx]
lea rcx, [rcx + 2]
mov word [rcx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x140002550
xor ecx, ecx
mov dword [rbp + 0x5e0], 0
cmp word [rbp + 0x150], cx
je 0x14000258d
nop dword [rax + rax]
inc ecx
cmp word [rbp + rcx*2 + 0x150], 0
jne 0x140002580
mov r8, qword [section..data]
xor edx, edx
cmp word [r8], dx
je 0x1400025aa
nop dword [rax]
inc edx
cmp word [r8 + rdx*2], 0
jne 0x1400025a0
lea eax, [rdx + rcx]
lea ebx, [rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
movzx ecx, word [rbp + 0x150]
lea rdx, [rbp + 0x150]
mov rbx, rax
mov word [rax], cx
test cx, cx
je 0x140002601
lea rax, [rbp + 0x150]
mov rcx, rbx
sub rcx, rax
nop
movzx eax, word [rdx + 2]
lea rdx, [rdx + 2]
mov word [rcx + rdx], ax
test ax, ax
jne 0x1400025f0
mov rdx, qword [section..data]
mov rcx, rbx
nop dword [rax + rax]
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x140002610
sub rcx, 4
movzx eax, word [rdx]
lea rcx, [rcx + 2]
mov word [rcx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x140002620
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
test rax, rax
je 0x1400026ac
mov rdx, qword [0x140008008]
xor r8d, r8d
cmp byte [rdx], r8b
je 0x14000268a
nop word [rax + rax]
inc r8d
cmp byte [r8 + rdx], 0
jne 0x140002680
lea r9, [rbp + 0x5e0]
mov qword [rsp + 0x20], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rbp + 0x150]
lea rdx, [0x1400066b8]
nop
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x1400026d0
sub rcx, 4
movzx eax, word [rdx]
lea rcx, [rcx + 2]
mov word [rcx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x1400026e0
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140002b81
mov qword [rsp + 0x6e8], rsi
mov qword [rsp + 0x6f0], r13
lea r13, [0x140000000]
nop dword [rax + rax]
xor r8d, r8d
movzx ecx, word [r8 + r13 + 0x66c0]
movzx r9d, word [rbp + r8 + 0x38c]
lea eax, [rcx - 0x41]
cmp eax, 0x19
lea edx, [rcx + 0x20]
lea eax, [r9 - 0x41]
cmova edx, ecx
cmp eax, 0x19
lea ecx, [r9 + 0x20]
cmova ecx, r9d
cmp ecx, edx
jne 0x140002774
test r9w, r9w
je 0x140002b50
add r8, 2
jmp 0x140002733
xor r8d, r8d
movzx ecx, word [r8 + r13 + 0x66c4]
movzx r9d, word [rbp + r8 + 0x38c]
lea eax, [rcx - 0x41]
cmp eax, 0x19
lea edx, [rcx + 0x20]
lea eax, [r9 - 0x41]
cmova edx, ecx
cmp eax, 0x19
lea ecx, [r9 + 0x20]
cmova ecx, r9d
cmp ecx, edx
jne 0x1400027b8
test r9w, r9w
je 0x140002b50
add r8, 2
jmp 0x140002777
mov eax, dword [rbp + 0x360]
bt eax, 0xa
jb 0x140002b50
test al, 0x10
je 0x140002922
lea rcx, [0x140008070]
call qword [0x140008080]
xor ebx, ebx
mov edi, eax
test eax, eax
jle 0x140002850
nop word [rax + rax]
mov edx, ebx
lea rcx, [0x140008070]
call qword [0x1400080a0]
lea r10, [rbp + 0x38c]
sub r10, rax
nop dword [rax]
movzx edx, word [rax]
movzx r9d, word [r10 + rax]
lea ecx, [rdx - 0x41]
cmp ecx, 0x19
lea r8d, [rdx + 0x20]
lea ecx, [r9 - 0x41]
cmova r8d, edx
cmp ecx, 0x19
lea edx, [r9 + 0x20]
cmova edx, r9d
cmp edx, r8d
jne 0x14000284a
test r9w, r9w
je 0x140002b50
add rax, 2
jmp 0x140002810
inc ebx
cmp ebx, edi
jl 0x1400027f0
movzx eax, word [r14]
mov rcx, r14
mov word [rsp + 0x40], ax
test ax, ax
je 0x140002881
lea rdx, [rsp + 0x40]
sub rdx, r14
nop dword [rax]
movzx eax, word [rcx + 2]
lea rcx, [rcx + 2]
mov word [rdx + rcx], ax
test ax, ax
jne 0x140002870
mov rcx, r14
call fcn.1400011c0
movsxd rcx, eax
cmp word [r14 + rcx*2 - 2], 0x5c
jne 0x1400028a9
mov rcx, r14
call fcn.1400011c0
movsxd rcx, eax
cmp word [r14 + rcx*2 - 2], 0x2f
je 0x1400028e3
lea rcx, [rsp + 0x40]
lea rdx, [0x1400066b0]
nop word [rax + rax]
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x1400028c0
sub rcx, 4
movzx eax, word [rdx]
lea rcx, [rcx + 2]
mov word [rcx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x1400028d0
lea rcx, [rsp + 0x40]
lea rdx, [rbp + 0x38c]
nop
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x1400028f0
sub rcx, 4
movzx eax, word [rdx]
lea rcx, [rcx + 2]
mov word [rcx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x140002900
lea rcx, [rsp + 0x40]
call fcn.1400024a0
jmp 0x140002b50
test al, 4
jne 0x140002b50
lea rcx, [rbp + 0x38c]
call fcn.140001540
lea rcx, [0x1400080c0]
mov rsi, rax
call qword [0x1400080d0]
xor ebx, ebx
mov edi, eax
test eax, eax
jle 0x1400029b1
nop
mov edx, ebx
lea rcx, [0x1400080c0]
call qword [0x1400080f0]
mov r11, rsi
mov r9, rax
sub r11, rax
nop dword [rax + rax]
movzx edx, word [r9]
movzx r10d, word [r11 + r9]
lea ecx, [rdx - 0x41]
cmp ecx, 0x19
lea r8d, [rdx + 0x20]
lea eax, [r10 - 0x41]
cmova r8d, edx
lea ecx, [r10 + 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp ecx, r8d
jne 0x1400029ab
test r10w, r10w
je 0x140002b50
add r9, 2
jmp 0x140002970
inc ebx
cmp ebx, edi
jl 0x140002950
mov rdx, qword [0x1400080b8]
lea rcx, [rbp + 0x38c]
call fcn.1400015e0
test rax, rax
jne 0x140002b50
movzx eax, word [r14]
lea rcx, [rsp + 0x40]
mov word [rsp + 0x40], ax
test ax, ax
je 0x140002a01
lea rax, [rsp + 0x40]
mov rdx, r14
sub rdx, rax
nop dword [rax + rax]
movzx eax, word [rdx + rcx + 2]
lea rcx, [rcx + 2]
mov word [rcx], ax
test ax, ax
jne 0x1400029f0
mov rcx, r14
call fcn.1400011c0
movsxd rcx, eax
cmp word [r14 + rcx*2 - 2], 0x5c
jne 0x140002a29
mov rcx, r14
call fcn.1400011c0
movsxd rcx, eax
cmp word [r14 + rcx*2 - 2], 0x2f
je 0x140002a63
lea rcx, [rsp + 0x40]
lea rdx, [0x1400066b0]
nop word [rax + rax]
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x140002a40
sub rcx, 4
movzx eax, word [rdx]
lea rcx, [rcx + 2]
mov word [rcx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x140002a50
lea rcx, [rsp + 0x40]
lea rdx, [rbp + 0x38c]
nop
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x140002a70
sub rcx, 4
movzx eax, word [rdx]
lea rcx, [rcx + 2]
mov word [rcx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x140002a80
mov rcx, qword [0x140008010]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140002ab8
mov rcx, qword [0x140008010]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, [0x140008020]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp word [rsp + 0x40], di
je 0x140002ada
nop
inc edi
cmp word [rsp + rdi*2 + 0x40], 0
jne 0x140002ad0
lea edi, [rdi*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, edi
lea rdx, [rsp + 0x40]
mov rcx, rax
mov rbx, rax
call fcn.1400011e0
movsxd rdx, dword [0x140008058]
mov rcx, qword [0x140008050]
mov qword [rcx + rdx*8], rbx
lea rcx, [0x140008020]
mov eax, dword [0x140008058]
inc eax
cdq
idiv dword [0x140008048]
mov dword [0x140008058], edx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x140008018]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea rdx, [rbp + 0x360]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140002730
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r13, qword [rsp + 0x6f0]
mov rsi, qword [rsp + 0x6e8]
add rsp, 0x6b0
pop r14
pop r12
pop rdi
pop rbx
pop rbp
ret