Function at 0x2d9e3b5e30
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x9f0]
sub rsp, 0xaf0
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rbp + 0x9e0], rax
mov rdi, rdx
mov qword [rsp + 0x38], rcx
mov rsi, rcx
xor edx, edx
lea rcx, [rbp + 0x5d0]
mov r8d, 0x410
call fcn.2d9e3e3840
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdx, eax
lea rcx, [0x2d9e406058]
lea rax, [0x2d9e407858]
mov r8, rdi
cmp word [rdi + rdx*2 - 2], 0x5c
lea rdx, [0x2d9e4078a0]
cmove rax, rcx
lea rcx, [rbp + 0x5d0]
mov r9, rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x2d9e3b5eda
xor al, al
jmp 0x2d9e3b61bf
mov al, 1
mov qword [rsp + 0xb20], rbx
mov byte [rsp + 0x30], al
xor ebx, ebx
nop word [rax + rax]
movzx ecx, word [rbp - 0x64]
cmp cx, word [0x2d9e407870]
movzx eax, word [rbp - 0x62]
jne 0x2d9e3b5f0e
cmp ax, word [0x2d9e407872]
je 0x2d9e3b6083
cmp cx, word [0x2d9e407874]
jne 0x2d9e3b5f31
cmp ax, word [0x2d9e407876]
jne 0x2d9e3b5f31
movzx eax, word [rbp - 0x60]
cmp ax, word [0x2d9e407878]
je 0x2d9e3b6083
test byte [rsp + 0x70], 0x10
lea rax, [rbp - 0x64]
mov r9, qword [rsp + 0x40]
lea rdx, [0x2d9e4078b0]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x1c0]
mov byte [rsp + 0x30], bl
mov r8, rdi
je 0x2d9e3b5f75
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp + 0x1c0]
mov rcx, rsi
call fcn.2d9e3b5e30
jmp 0x2d9e3b6083
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
cmp word [rbp + 0x1c0], bx
jne 0x2d9e3b5f9c
mov r8, rbx
jmp 0x2d9e3b5fba
lea rax, [rbp + 0x1c0]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x2d9e3b5fb0
lea rdx, [rbp + 0x1c0]
lea rcx, [rsp + 0x50]
call fcn.2d9e3b3b50
mov rsi, qword [rsi + 0x18]
lea r9, [rsp + 0x50]
mov rdx, rsi
mov r8, qword [rsi + 8]
call fcn.2d9e3b6940
mov r8, qword [rsp + 0x38]
movabs rcx, 0x555555555555554
mov rdx, qword [r8 + 0x20]
sub rcx, rdx
cmp rcx, 1
jb 0x2d9e3b6211
lea rcx, [rdx + 1]
mov qword [r8 + 0x20], rcx
mov qword [rsi + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x68]
cmp rax, 8
jb 0x2d9e3b6080
mov rcx, qword [rsp + 0x50]
inc rax
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
ja 0x2d9e3b61fe
add rax, rax
cmp rax, 0x1000
jb 0x2d9e3b6074
test cl, 0x1f
jne 0x2d9e3b61f8
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x2d9e3b61f2
sub rcx, rax
cmp rcx, 8
jb 0x2d9e3b61ec
cmp rcx, 0x27
ja 0x2d9e3b61e6
mov rcx, rax
call fcn.2d9e3da86c
mov rsi, qword [rsp + 0x38]
jmp 0x2d9e3b6083
mov rsi, r8
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x2d9e3b5ef0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FindClose]
movzx eax, byte [rsp + 0x30]
test al, al
je 0x2d9e3b61b5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
cmp word [rdi + rcx*2 - 2], 0x5c
jne 0x2d9e3b6131
cmp word [rdi], bx
je 0x2d9e3b60ed
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x2d9e3b60e3
mov r8, rbx
lea rcx, [rsp + 0x50]
mov rdx, rdi
call fcn.2d9e3b3b50
mov rbx, qword [rsi + 0x18]
lea r9, [rsp + 0x50]
mov rdx, rbx
mov r8, qword [rbx + 8]
call fcn.2d9e3b6940
mov rcx, rax
movabs rdx, 0x555555555555554
mov rax, qword [rsi + 0x20]
sub rdx, rax
cmp rdx, 1
jae 0x2d9e3b6199
jmp 0x2d9e3b61d9
cmp word [rdi], bx
je 0x2d9e3b614a
or rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x2d9e3b6140
mov r8, rbx
lea rcx, [rsp + 0x50]
mov rdx, rdi
call fcn.2d9e3b3b50
mov r8d, 1
lea rcx, [rsp + 0x50]
call fcn.2d9e3b6690
mov rbx, qword [rsi + 0x18]
lea r9, [rsp + 0x50]
mov rdx, rbx
mov r8, qword [rbx + 8]
call fcn.2d9e3b6940
mov rcx, rax
movabs rdx, 0x555555555555554
mov rax, qword [rsi + 0x20]
sub rdx, rax
cmp rdx, 1
jb 0x2d9e3b6204
inc rax
mov qword [rsi + 0x20], rax
mov qword [rbx + 8], rcx
mov rax, qword [rcx + 8]
mov qword [rax], rcx
lea rcx, [rsp + 0x50]
call fcn.2d9e3b39e0
mov rbx, qword [rsp + 0xb20]
mov al, 1
mov rcx, qword [rbp + 0x9e0]
xor rcx, rsp
call fcn.2d9e3da7d0
add rsp, 0xaf0
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x2d9e4078c0]
call fcn.2d9e3dba2c
int3
call fcn.2d9e3e4358
int3
call fcn.2d9e3e4358
int3
call fcn.2d9e3e4358
int3
call fcn.2d9e3e4358
int3
call fcn.2d9e3e4358
int3
lea rcx, [0x2d9e4078c0]
call fcn.2d9e3dba2c
int3
lea rcx, [0x2d9e4078c0]
call fcn.2d9e3dba2c
int3