Function at 0x7ff6bcbd5080
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x3c0
mov rax, qword [0x7ff6bccbe500]
xor rax, rsp
mov qword [rsp + 0x3b8], rax
mov rbx, rcx
xor r14d, r14d
mov edi, r14d
mov dword [rsp + 0x50], r14d
movsd xmm0, qword [0x7ff6bcca2b50]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [0x7ff6bcca2b58]
mov ecx, 0x5c
mov word [rsp + 0x20], cx
xor word [rsp + 0x22], 0x32
xor word [rsp + 0x24], 0x33
xor word [rsp + 0x26], 0x34
xor ax, 0x35
mov word [rsp + 0x28], ax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], di
jne 0x7ff6bcbd5110
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.7ff6bcbd4b50
nop
lea r8, [rsp + 0x58]
mov rdx, rbx
lea rcx, [rsp + 0x138]
call fcn.7ff6bcbda440
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x7ff6bcbd5182
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6bcbd517d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6bcbd5743
call fcn.7ff6bcc49cc0
movdqa xmm0, xmmword [0x7ff6bcca3b40]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r14w
lea rcx, [rsp + 0x138]
cmp qword [rsp + 0x150], 7
cmova rcx, qword [rsp + 0x138]
lea rdx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x7ff6bcbd5239
mov rdx, qword [rsp + 0x150]
cmp rdx, 7
jbe 0x7ff6bcbd520f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6bcbd520a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6bcbd573d
call fcn.7ff6bcc49cc0
mov rcx, qword [rsp + 0x3b8]
xor rcx, rsp
call fcn.7ff6bcc49ca0
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
nop dword [rax]
test byte [rsp + 0x160], 0x10
je 0x7ff6bcbd544e
movzx ecx, word [rsp + 0x18c]
movzx eax, word [rsp + 0x18e]
cmp cx, 0x2e
jne 0x7ff6bcbd5286
test ax, ax
je 0x7ff6bcbd56cf
cmp cx, cx
jne 0x7ff6bcbd5286
cmp ax, cx
jne 0x7ff6bcbd5286
cmp word [rsp + 0x190], 0
je 0x7ff6bcbd56cf
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
mov r8d, 1
lea rdx, [0x7ff6bcca29d0]
lea rcx, [rsp + 0x30]
call fcn.7ff6bcbd4b50
nop
lea r8, [rsp + 0x30]
mov rdx, rbx
lea rcx, [rsp + 0x98]
call fcn.7ff6bcbda440
nop
lea rcx, [rsp + 0x18c]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], 0
jne 0x7ff6bcbd52d5
lea rdx, [rsp + 0x18c]
mov rcx, rax
call fcn.7ff6bcbd86b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x118], xmm0
mov qword [rsp + 0x128], r14
mov qword [rsp + 0x130], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x118], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x128], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
or edi, 2
mov rdx, qword [rsp + 0xb0]
cmp rdx, 7
jbe 0x7ff6bcbd537d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6bcbd5378
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6bcbd5749
call fcn.7ff6bcc49cc0
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb0], 7
mov word [rsp + 0x98], r14w
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x7ff6bcbd53dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6bcbd53d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6bcbd574f
call fcn.7ff6bcc49cc0
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r14w
lea rcx, [rsp + 0x118]
call fcn.7ff6bcbd5080
nop
mov rdx, qword [rsp + 0x130]
cmp rdx, 7
jbe 0x7ff6bcbd56cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6bcbd56ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6bcbd5755
jmp 0x7ff6bcbd56ca
xorps xmm0, xmm0
movups xmmword [rsp + 0xf8], xmm0
mov qword [rsp + 0x108], r14
mov qword [rsp + 0x110], r14
lea rax, [rsp + 0x18c]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x7ff6bcbd5480
lea rdx, [rsp + 0x18c]
lea rcx, [rsp + 0xf8]
call fcn.7ff6bcbd4b50
nop
lea rcx, [rsp + 0xf8]
call fcn.7ff6bcbd4c80
test al, al
je 0x7ff6bcbd5687
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r14
mov r8d, 1
lea rdx, [0x7ff6bcca29d0]
lea rcx, [rsp + 0x78]
call fcn.7ff6bcbd4b50
nop
lea r8, [rsp + 0x78]
mov rdx, rbx
lea rcx, [rsp + 0xd8]
call fcn.7ff6bcbda440
nop
lea rdx, [rsp + 0xf8]
cmp qword [rsp + 0x110], 7
cmova rdx, qword [rsp + 0xf8]
mov r8, qword [rsp + 0x108]
mov rcx, rax
call fcn.7ff6bcbd86b0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xb8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xc8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
or edi, 1
mov rdx, qword [0x7ff6bccc8980]
cmp rdx, qword [0x7ff6bccc8988]
je 0x7ff6bcbd557f
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rsp + 0xb8], r14w
add qword [0x7ff6bccc8980], 0x20
jmp 0x7ff6bcbd559b
lea r8, [rsp + 0xb8]
lea rcx, [0x7ff6bccc8978]
call fcn.7ff6bcbdb4b0
mov rdx, qword [rsp + 0xd0]
cmp rdx, 7
jbe 0x7ff6bcbd55dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6bcbd55d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6bcbd575b
call fcn.7ff6bcc49cc0
nop
mov rdx, qword [rsp + 0xf0]
cmp rdx, 7
jbe 0x7ff6bcbd5624
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6bcbd561f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6bcbd5761
call fcn.7ff6bcc49cc0
mov qword [rsp + 0xe8], r14
mov qword [rsp + 0xf0], 7
mov word [rsp + 0xd8], r14w
mov rdx, qword [rsp + 0x90]
cmp rdx, 7
jbe 0x7ff6bcbd5687
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6bcbd5681
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6bcbd5767
call fcn.7ff6bcc49cc0
nop
mov rdx, qword [rsp + 0x110]
cmp rdx, 7
jbe 0x7ff6bcbd56cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6bcbd56ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6bcbd576d
call fcn.7ff6bcc49cc0
lea rdx, [rsp + 0x160]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x7ff6bcbd5240
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rsp + 0x150]
cmp rdx, 7
jbe 0x7ff6bcbd520f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6bcbd520a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff6bcbd520a
call fcn.7ff6bcc5a000
nop
call fcn.7ff6bcc5a000
nop
call fcn.7ff6bcc5a000
nop
call fcn.7ff6bcc5a000
nop
call fcn.7ff6bcc5a000
nop
call fcn.7ff6bcc5a000
nop
call fcn.7ff6bcc5a000
nop
call fcn.7ff6bcc5a000
nop
call fcn.7ff6bcc5a000
int3