Function at 0x4ad20110
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x2d8
mov rax, qword [0x4ad2e1c8]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov rbp, qword [rsp + 0x320]
mov rdi, rcx
mov qword [rsp + 0x30], rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov qword [rsp + 0x60], r8
repne scasw ax, word [rdi]
xor r8d, r8d
mov dword [rsp + 0x40], r9d
lea r9d, [r8 + 1]
not rcx
mov qword [rsp + 0x50], rdx
sub rcx, r9
mov qword [rsp + 0x48], rbp
movzx esi, r8w
mov rdi, rcx
mov rdx, rbp
cmp word [rbp], r8w
je 0x4ad20454
mov rcx, rdx
movzx eax, word [rdx]
add rdx, 2
cmp ax, r8w
jne 0x4ad20180
mov rax, rdx
sub rax, rcx
sar rax, 1
add ax, di
add si, ax
cmp word [rdx], r8w
jne 0x4ad2017d
cmp r8w, si
je 0x4ad20454
add si, r9w
movzx ebx, si
lea ecx, [rbx + rbx]
call fcn.4ad016dc
xor ecx, ecx
mov rsi, rax
cmp rax, rcx
jne 0x4ad201cf
mov eax, 1
jmp 0x4ad20456
mov qword [rsp + 0x38], rbp
mov rbp, rax
mov rax, qword [rsp + 0x48]
cmp word [rax], cx
je 0x4ad20249
mov r8, qword [rsp + 0x30]
mov eax, ebx
mov rcx, rbp
sub rcx, rsi
sar rcx, 1
sub eax, ecx
mov rcx, rbp
movsxd rdi, eax
mov rdx, rdi
call fcn.4ad01744
mov r8, qword [rsp + 0x38]
mov rdx, rdi
mov rcx, rbp
call fcn.4ad01ac0
mov rdx, qword [rsp + 0x38]
or r8, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
mov rcx, r8
repne scasw ax, word [rdi]
mov rdi, rbp
not rcx
lea rdx, [rdx + rcx*2]
mov rcx, r8
repne scasw ax, word [rdi]
mov qword [rsp + 0x38], rdx
not rcx
lea rbp, [rbp + rcx*2]
xor ecx, ecx
cmp word [rdx], cx
jne 0x4ad201e1
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x60]
mov word [rbp], cx
mov rcx, qword [rsp + 0x50]
mov r9, rsi
mov dword [rsp + 0x20], 1
call fcn.4ad0e198
mov rcx, rsi
mov ebp, eax
call fcn.4ad01040
mov rdi, qword [rsp + 0x30]
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
lea rsi, [rcx + 1]
mov qword [rsp + 0x38], rsi
lea ecx, [rsi + rsi]
call fcn.4ad016dc
mov rbx, rax
xor eax, eax
cmp rbx, rax
je 0x4ad201c5
mov r8, qword [rsp + 0x30]
movsxd rdi, esi
mov rcx, rbx
mov rdx, rdi
call fcn.4ad01744
xor edx, edx
mov rcx, rbx
mov rax, rbx
cmp word [rbx], dx
je 0x4ad202d2
mov rax, rcx
add rcx, 2
cmp word [rcx], dx
jne 0x4ad202c6
lea rsi, [rax + 2]
lea r8, [0x4ad299b0]
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x58], rsi
call fcn.4ad01ac0
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor ecx, ecx
mov qword [rsp + 0x30], rax
mov word [rsi], cx
cmp rax, 0xffffffffffffffff
je 0x4ad20448
test byte [rsp + 0x70], 0x10
je 0x4ad2041a
lea rsi, [rsp + 0x9c]
lea rdi, [0x4ad29788]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x4ad2041a
lea rsi, [rsp + 0x9c]
lea rdi, [0x4ad2978c]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x4ad2041a
mov rsi, qword [rsp + 0x38]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x9c]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
lea edi, [rdx + rcx + 1]
cmp edi, esi
jle 0x4ad203c0
lea edx, [rdi + rdi]
mov rcx, rbx
call fcn.4ad02db8
xor edx, edx
cmp rax, rdx
je 0x4ad20438
mov esi, edi
mov rbx, rax
mov rcx, rax
mov qword [rsp + 0x38], rsi
jmp 0x4ad203b2
mov rcx, rax
add rax, 2
cmp word [rax], dx
jne 0x4ad203ab
lea rax, [rcx + 2]
mov qword [rsp + 0x58], rax
movsxd rdi, esi
lea r8, [rsp + 0x9c]
mov rcx, rbx
mov rdx, rdi
call fcn.4ad01ac0
lea r8, [0x4ad29784]
mov rdx, rdi
mov rcx, rbx
call fcn.4ad01ac0
mov rax, qword [rsp + 0x48]
mov r9d, dword [rsp + 0x40]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.4ad20110
xor ecx, ecx
mov ebp, eax
mov rax, qword [rsp + 0x58]
mov word [rax], cx
mov rax, qword [rsp + 0x30]
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor ecx, ecx
cmp eax, ecx
je 0x4ad2043d
mov rax, qword [rsp + 0x30]
jmp 0x4ad2030f
mov ebp, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call fcn.4ad01040
mov eax, ebp
jmp 0x4ad20456
xor eax, eax
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.4ad01000
add rsp, 0x2d8
pop rdi
pop rsi
pop rbp
pop rbx
ret