Function at 0x409380
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov r11, rsp
sub rsp, 0x368
mov rax, qword [0x0042baf8]
mov qword [rsp + 0x340], rax
mov qword [r11 + 0x18], rbx
mov rbx, rcx
mov qword [r11 + 0x20], rbp
mov qword [r11 - 0x10], rdi
mov rcx, rdx
mov rdi, rdx
call fcn.00410890
test rax, rax
mov rbp, rax
je 0x409ce2
mov dx, 0x5c
mov rcx, rax
call fcn.004109d0
test rax, rax
je 0x4093d5
mov word [rax], 0
mov r8, qword [rbx + 0x2b0]
xor edx, edx
mov r9, rdi
mov r8, qword [r8 + 0xb8]
lea ecx, [rdx + 3]
call qword [rbx + 0x298]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
jne 0x409427
mov qword [rsp + 0xd0], 0
jmp 0x40944a
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xdc]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0xd0], rax
lea rdx, [rsp + 0xf0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
mov qword [rsp + 0x30], rax
jne 0x409476
mov rcx, rbp
call fcn.004109b0
jmp 0x409ce2
mov qword [rsp + 0x360], rsi
nop
mov rax, qword [rbx + 8]
cmp dword [rax], 0
jne 0x409cc9
lea rsi, [rsp + 0x11c]
lea rdi, [0x0042669c]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x409cab
lea rsi, [rsp + 0x11c]
lea rdi, [0x00422320]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x409cab
bt dword [rsp + 0xf0], 0xa
jb 0x409cab
mov rcx, rbx
call fcn.00406470
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x11c]
not rcx
lea rdx, [rcx - 1]
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
lea rdi, [rdx + rcx + 1]
lea rcx, [rdi + rdi]
call fcn.00410900
test rax, rax
mov qword [rsp + 0x60], rax
je 0x409d0f
lea rcx, [rsp + 0x11c]
lea r8, str._s_s
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rdx, rdi
call fcn.0040f7a0
lea rcx, [rsp + 0x11c]
call fcn.00410890
lea rcx, [rsp + 0x11c]
lea rdi, [rsp + 0x324]
mov rsi, rax
mov qword [rsp + 0x58], rax
sub rdi, rcx
nop
movzx eax, word [rcx]
movzx edx, word [rcx + rdi]
sub eax, edx
jne 0x409583
add rcx, 2
test edx, edx
jne 0x409570
test eax, eax
jne 0x409598
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rax
jmp 0x409613
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x324]
not rcx
lea rdx, [rcx - 1]
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
lea rdi, [rdx + rcx + 1]
lea rcx, [rdi + rdi]
call fcn.00410900
test rax, rax
mov qword [rsp + 0x70], rax
je 0x409d0f
lea rcx, [rsp + 0x324]
lea r8, str._s_s
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rdx, rdi
call fcn.0040f7a0
lea rcx, [rsp + 0x324]
call fcn.00410890
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x110]
mov ecx, dword [rsp + 0x10c]
mov edx, 1
shl rcx, 0x20
add rcx, rax
test byte [rsp + 0xf0], 0x10
mov qword [rsp + 0x78], rcx
mov ecx, 0
mov eax, ecx
mov dword [rsp + 0xc4], ecx
mov dword [rsp + 0xc8], ecx
cmovne eax, edx
mov dword [rsp + 0xcc], ecx
mov qword [rsp + 0x88], rcx
cmp eax, edx
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0x98], rcx
mov dword [rsp + 0xc0], eax
mov qword [rsp + 0xa8], rcx
jne 0x409701
inc qword [rbx + 0x218]
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x11c]
not rcx
lea rdx, [rcx - 1]
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
lea rsi, [rdx + rcx + 3]
lea rcx, [rsi + rsi]
call fcn.00410900
test rax, rax
mov rdi, rax
je 0x409701
lea rax, [rsp + 0x11c]
lea r8, [0x00422310]
mov r9, rbp
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.0040f7a0
mov rdx, rdi
mov rcx, rbx
call fcn.00409380
mov rcx, rdi
call fcn.004109b0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.00406b80
test rax, rax
mov rsi, rax
jne 0x409751
mov rcx, qword [rsp + 0x70]
cmp rcx, qword [rsp + 0x60]
je 0x409727
call fcn.004109b0
mov rcx, qword [rsp + 0x68]
cmp rcx, qword [rsp + 0x58]
je 0x409738
call fcn.004109b0
mov rcx, qword [rsp + 0x60]
call fcn.004109b0
mov rcx, qword [rsp + 0x58]
call fcn.004109b0
jmp 0x409cab
lea rdx, [rsp + 0x40]
mov r8, rax
mov rcx, rbx
call fcn.00406d20
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x4097ab
mov rcx, qword [rsp + 0x70]
cmp rcx, qword [rsp + 0x60]
je 0x409781
call fcn.004109b0
mov rcx, qword [rsp + 0x68]
cmp rcx, qword [rsp + 0x58]
je 0x409792
call fcn.004109b0
mov rcx, qword [rsp + 0x60]
call fcn.004109b0
mov rcx, qword [rsp + 0x58]
call fcn.004109b0
jmp 0x409cab
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
inc qword [rbx + 0x220]
add qword [rbx + 0x230], rsi
add qword [rbx + 0x240], rdi
lea rcx, [rsp + 0x40]
mov r8, rdi
xor edx, edx
call sym.JkDefragCmd64.exe_IsFragmented
cmp eax, 1
jne 0x4097f6
inc qword [rbx + 0x228]
add qword [rbx + 0x238], rsi
add qword [rbx + 0x248], rdi
add qword [rbx + 0x258], rdi
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [rbx + 0x290]
cmp qword [rsp + 0x80], 0
je 0x409c75
cmp qword [rsp + 0xa8], 0
je 0x409c75
mov r10, qword [rbx + 0x188]
test r10, r10
je 0x409899
cmp qword [r10], 0
je 0x4098a0
mov r8, qword [rsp + 0x70]
mov r9, qword [rsp + 0x60]
xor edi, edi
nop
nop
nop
mov rsi, qword [rdi + r10]
mov rcx, r9
mov rdx, rsi
call sym.JkDefragCmd64.exe_MatchMask
cmp eax, 1
je 0x40988b
cmp r8, r9
je 0x409879
mov rdx, rsi
mov rcx, r8
call sym.JkDefragCmd64.exe_MatchMask
cmp eax, 1
je 0x40988b
add rdi, 8
cmp qword [rdi + r10], 0
jne 0x409850
mov esi, 1
jmp 0x4098a5
mov esi, 1
mov dword [rsp + 0xc8], esi
jmp 0x4098a5
mov esi, 1
jmp 0x4098a5
mov esi, 1
lea rdx, str.jkdefrag.log
lea rcx, [rsp + 0x11c]
call fcn.00410100
test eax, eax
je 0x4098ed
lea rdx, str.jkdefragcmd.log
lea rcx, [rsp + 0x11c]
call fcn.00410100
test eax, eax
je 0x4098ed
lea rdx, str.jkdefragscreensaver.log
lea rcx, [rsp + 0x11c]
call fcn.00410100
test eax, eax
jne 0x4098f4
mov dword [rsp + 0xc8], esi
mov r9, qword [rsp + 0x60]
lea rdx, str._safeboot.fs
mov rcx, r9
call sym.JkDefragCmd64.exe_MatchMask
mov edi, dword [rsp + 0xc4]
lea rdx, str._:_bootwiz.sys
cmp eax, 1
mov rcx, r9
cmove edi, esi
mov dword [rsp + 0xc4], edi
call sym.JkDefragCmd64.exe_MatchMask
lea rdx, str.BOOTWIZ
cmp eax, 1
mov rcx, r9
cmove edi, esi
mov dword [rsp + 0xc4], edi
call sym.JkDefragCmd64.exe_MatchMask
lea rdx, str._:BootAuth_.sys
cmp eax, 1
mov rcx, r9
cmove edi, esi
mov dword [rsp + 0xc4], edi
call sym.JkDefragCmd64.exe_MatchMask
cmp eax, 1
cmove edi, esi
cmp dword [rsp + 0xc0], 0
mov dword [rsp + 0xc4], edi
jne 0x409a22
mov r10, qword [rbx + 0x190]
test r10, r10
je 0x409a22
cmp qword [rsp + 0x78], 0x3200000
jbe 0x4099a5
mov dword [rsp + 0xcc], esi
jmp 0x409a22
cmp dword [rbx + 0x18], 1
jne 0x4099d3
mov rax, qword [rsp + 0xa0]
movabs rcx, 0x1792f8648000
add rcx, rax
cmp rcx, qword [rsp + 0xd0]
jae 0x4099d3
mov dword [rsp + 0xcc], esi
jmp 0x409a22
cmp qword [r10], 0
je 0x409a22
mov r8, qword [rsp + 0x70]
xor edi, edi
mov rsi, qword [rdi + r10]
mov rcx, r9
mov rdx, rsi
call sym.JkDefragCmd64.exe_MatchMask
cmp eax, 1
je 0x409a16
cmp r8, r9
je 0x409a09
mov rdx, rsi
mov rcx, r8
call sym.JkDefragCmd64.exe_MatchMask
cmp eax, 1
je 0x409a16
add rdi, 8
cmp qword [rdi + r10], 0
jne 0x4099e0
jmp 0x409a22
mov eax, 1
mov dword [rsp + 0xcc], eax
mov rax, qword [rbx + 0x10]
cmp dword [rax], 0
jne 0x409a48
lea rdx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x20], 0
call sym.JkDefragCmd64.exe_ColorizeItem
jmp 0x409a50
mov rcx, rbx
call sym.JkDefragCmd64.exe_ShowDiskmap
mov rax, qword [rsp + 0xa8]
test rax, rax
je 0x409a6f
nop
cmp qword [rax], 0xffffffffffffffff
jne 0x409a73
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x409a60
xor ecx, ecx
jmp 0x409a76
mov rcx, qword [rax]
mov r8, qword [rbx + 0x2b0]
mov rax, qword [rsp + 0x78]
mov r9, qword [rsp + 0x80]
mov r8, qword [r8 + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x40]
mov ecx, 4
call qword [rbx + 0x298]
mov edx, dword [rsp + 0xf0]
bt edx, 0xb
jae 0x409add
mov r8, qword [rbx + 0x2b0]
lea rdx, [rsp + 0x40]
mov ecx, 4
mov r8, qword [r8 + 0x88]
call qword [rbx + 0x298]
mov edx, dword [rsp + 0xf0]
bt edx, 0xe
jae 0x409b08
mov r8, qword [rbx + 0x2b0]
lea rdx, [rsp + 0x40]
mov ecx, 4
mov r8, qword [r8 + 0x90]
call qword [rbx + 0x298]
mov edx, dword [rsp + 0xf0]
bt edx, 0xc
jae 0x409b33
mov r8, qword [rbx + 0x2b0]
lea rdx, [rsp + 0x40]
mov ecx, 4
mov r8, qword [r8 + 0x98]
call qword [rbx + 0x298]
mov edx, dword [rsp + 0xf0]
test dl, 1
je 0x409b5d
mov r8, qword [rbx + 0x2b0]
lea rdx, [rsp + 0x40]
mov ecx, 4
mov r8, qword [r8 + 0xa0]
call qword [rbx + 0x298]
mov edx, dword [rsp + 0xf0]
bt edx, 9
jae 0x409b88
mov r8, qword [rbx + 0x2b0]
lea rdx, [rsp + 0x40]
mov ecx, 4
mov r8, qword [r8 + 0xa8]
call qword [rbx + 0x298]
mov edx, dword [rsp + 0xf0]
bt edx, 8
jae 0x409bac
mov r8, qword [rbx + 0x2b0]
lea rdx, [rsp + 0x40]
mov ecx, 4
mov r8, qword [r8 + 0xb0]
call qword [rbx + 0x298]
mov ecx, 0x90
call fcn.00410900
test rax, rax
mov rdx, rax
je 0x409cab
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x30], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x28], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x38], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x40], rcx
mov rax, qword [rsp + 0x88]
mov rcx, rbx
mov qword [rdx + 0x48], rax
mov rax, qword [rsp + 0xa0]
mov qword [rdx + 0x60], rax
mov rax, qword [rsp + 0x98]
mov qword [rdx + 0x58], rax
mov rax, qword [rsp + 0xa8]
mov qword [rdx + 0x68], rax
mov eax, dword [rsp + 0xc0]
mov qword [rsp + 0xa8], 0
mov dword [rdx + 0x80], eax
mov eax, dword [rsp + 0xc4]
mov dword [rdx + 0x84], eax
mov eax, dword [rsp + 0xc8]
mov dword [rdx + 0x88], eax
mov eax, dword [rsp + 0xcc]
mov dword [rdx + 0x8c], eax
call sym.JkDefragCmd64.exe_TreeInsert
jmp 0x409cab
mov rcx, qword [rsp + 0x70]
cmp rcx, qword [rsp + 0x60]
je 0x409c86
call fcn.004109b0
mov rcx, qword [rsp + 0x68]
cmp rcx, qword [rsp + 0x58]
je 0x409c97
call fcn.004109b0
mov rcx, qword [rsp + 0x60]
call fcn.004109b0
mov rcx, qword [rsp + 0x58]
call fcn.004109b0
mov rdi, qword [rsp + 0x30]
lea rdx, [rsp + 0xf0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409480
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbp
call fcn.004109b0
mov rsi, qword [rsp + 0x360]
mov rdi, qword [rsp + 0x358]
mov rbp, qword [rsp + 0x388]
mov rbx, qword [rsp + 0x380]
mov rcx, qword [rsp + 0x340]
call fcn.0041e010
add rsp, 0x368
ret
mov rcx, qword [rsp + 0x30]
jmp 0x409ccc