Function at 0x14000edf0
Capabilities:
Enumerate files on windows
Enumerate files recursively
Hash data with md5

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x6e48]
mov eax, 0x6f48
call fcn.1400755f0
sub rsp, rax
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov rax, qword [0x1400c0140]
xor rax, rsp
mov qword [rbp + 0x6e30], rax
mov qword [rbp - 0x60], r9
mov qword [rbp - 0x80], r8
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x40], rdx
mov qword [rbp + 0x68], 7
xor eax, eax
mov qword [rbp + 0x60], rax
mov word [rbp + 0x50], ax
mov qword [rbp + 0xb8], 7
mov qword [rbp + 0xb0], rax
mov word [rbp + 0xa0], ax
mov qword [rbp + 0x90], 7
mov qword [rbp + 0x88], rax
mov word [rbp + 0x78], ax
mov qword [rbp + 0x30], 7
mov qword [rbp + 0x28], rax
mov word [rbp + 0x18], ax
mov qword [rbp - 0x20], 7
mov qword [rbp - 0x28], rax
mov word [rbp - 0x38], ax
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rax
mov word [rsp + 0x50], ax
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x50]
call fcn.1400015e0
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.140032f50
mov rdi, rax
lea rax, [rbp - 0x38]
cmp rax, rdi
je 0x14000ef48
cmp qword [rbp - 0x20], 8
jb 0x14000eeec
mov rcx, qword [rbp - 0x38]
call fcn.140063290
mov qword [rbp - 0x20], 7
xor ecx, ecx
mov qword [rbp - 0x28], rcx
mov word [rbp - 0x38], cx
cmp qword [rdi + 0x18], 8
jae 0x14000ef1f
mov r8, qword [rdi + 0x10]
inc r8
add r8, r8
mov rdx, rdi
lea rcx, [rbp - 0x38]
call fcn.1400632b0
xor ecx, ecx
jmp 0x14000ef29
mov rax, qword [rdi]
mov qword [rbp - 0x38], rax
mov qword [rdi], rcx
mov rax, qword [rdi + 0x10]
mov qword [rbp - 0x28], rax
mov rax, qword [rdi + 0x18]
mov qword [rbp - 0x20], rax
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rcx
mov word [rdi], cx
cmp qword [rbp + 8], 8
jb 0x14000ef58
mov rcx, qword [rbp - 0x10]
call fcn.140063290
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp + 0xa0]
call fcn.1400015e0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp + 0x50]
call fcn.1400015e0
mov r8d, 1
lea rdx, [0x14008f27c]
lea rcx, [rbp + 0x50]
call fcn.140015a00
lea rcx, [rbp + 0x50]
cmp qword [rbp + 0x68], 8
cmovae rcx, qword [rbp + 0x50]
lea rdx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdx, rax
mov qword [rsp + 0x78], rax
jmp 0x14000efc3
mov rdx, rdi
cmp rdx, 0xffffffffffffffff
je 0x14000f3af
lea rsi, [rbp + 0x1ac]
lea rdi, [0x14008f280]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x14000f3af
lea rsi, [rbp + 0x1ac]
lea rdi, [0x14008f284]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x14000f3af
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x18]
call fcn.1400015e0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1ac]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x1ac]
lea rcx, [rbp + 0x18]
call fcn.140015a00
test byte [rbp + 0x180], 0x10
je 0x14000f0ec
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x78]
call fcn.1400015e0
mov r8d, 1
lea rdx, [0x14008ef9c]
lea rcx, [rbp + 0x78]
call fcn.140015a00
lea rax, [rbp - 0x10]
mov qword [rbp - 0x78], rax
mov qword [rbp + 8], 7
xor esi, esi
mov qword [rbp], rsi
mov word [rbp - 0x10], si
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp - 0x10]
call fcn.1400015e0
nop
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rsi
mov word [rsp + 0x50], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x50]
call fcn.1400015e0
nop
mov r9, qword [rbp - 0x60]
mov r8, qword [rbp - 0x80]
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x50]
call fcn.14000edf0
jmp 0x14000f3b1
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rdx, qword [rbp - 0x38]
lea rcx, [rbp + 0x1ac]
call fcn.140063914
test eax, eax
jne 0x14000f3af
lea rdi, [rbp + 0x18]
cmp qword [rbp + 0x30], 8
cmovae rdi, qword [rbp + 0x18]
mov rcx, rbx
call fcn.140001770
mov rdx, rax
mov rcx, rdi
call fcn.140063914
test eax, eax
je 0x14000f3af
mov qword [rbp + 8], 7
xor eax, eax
mov qword [rbp], rax
mov word [rbp - 0x10], ax
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x194]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx edi, word [rbp + 0x48]
mov r8d, 2
lea rcx, [rbp - 0x10]
cmp di, 0xc
jbe 0x14000f189
sub di, 0xc
lea rdx, [0x140093284]
jmp 0x14000f190
lea rdx, [0x14009328c]
call fcn.140001780
lea rsi, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rsi, qword [rbp - 0x10]
movzx eax, word [rbp + 0x4a]
movzx ecx, di
movzx edx, word [rbp + 0x40]
movzx edi, word [rbp + 0x46]
movzx r9d, word [rbp + 0x42]
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edi
lea r8, str._02d__02d__d__02d:_02d__s
mov edx, 0x32
lea rcx, [rbp + 0x3d0]
call fcn.140003480
mov esi, dword [rbp + 0x19c]
shl rsi, 0x20
mov eax, dword [rbp + 0x1a0]
add rsi, rax
xor ecx, ecx
mov qword [rbp + 0x100], rcx
mov dword [rbp + 0xf0], 0x67452301
mov dword [rbp + 0xf4], 0xefcdab89
mov dword [rbp + 0xf8], 0x98badcfe
mov dword [rbp + 0xfc], 0x10325476
lea rax, [rsp + 0x50]
mov qword [rbp - 0x50], rax
lea rdx, [rbp + 0x18]
cmp qword [rbp + 0x30], 8
cmovae rdx, qword [rbp + 0x18]
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rcx
mov word [rsp + 0x50], cx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x50]
call fcn.140001780
nop
mov rdx, rsi
lea rcx, [rbp + 0xc8]
call fcn.14000f4f0
mov qword [rbp - 0x78], rax
lea rdx, [0x140093320]
mov rcx, qword [rbp - 0x80]
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x18]
call fcn.1400187c0
mov rcx, rax
lea rdx, [0x1400932e8]
call fcn.140018560
mov rsi, rax
test rax, rax
jne 0x14000f2ba
xor ecx, ecx
jmp 0x14000f2c4
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
and dword [rcx + 0x18], 0xffffefff
or dword [rcx + 0x18], 0x2000
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xf0]
call fcn.140003ff0
mov rdi, rax
mov rdx, qword [rbp - 0x78]
mov rcx, rsi
call fcn.1400187c0
mov rcx, rax
lea rdx, [0x1400932e8]
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x3d0]
call fcn.140018560
mov rcx, rax
lea rdx, [0x1400932e8]
call fcn.140018560
mov rcx, rax
mov rdx, rdi
call fcn.140018f30
mov rcx, rax
lea rdx, str.__Pos_Repl__r_n
call fcn.140018560
mov rsi, rax
xor edi, edi
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14000f362
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove edi, eax
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test edi, edi
je 0x14000f388
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], 0
jne 0x14000f37f
or edx, 4
xor r8d, r8d
call fcn.140003090
nop
cmp qword [rbp + 0xe0], 8
jb 0x14000f39f
mov rcx, qword [rbp + 0xc8]
call fcn.140063290
nop
cmp qword [rbp + 8], 8
jb 0x14000f3af
mov rcx, qword [rbp - 0x10]
call fcn.140063290
xor esi, esi
lea rdx, [rbp + 0x180]
mov rdi, qword [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000efc0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
cmp qword [rbp - 0x20], 8
jb 0x14000f3e8
mov rcx, qword [rbp - 0x38]
call fcn.140063290
mov qword [rbp - 0x20], 7
mov qword [rbp - 0x28], rsi
mov word [rbp - 0x38], si
cmp qword [rbp + 0x30], 8
jb 0x14000f408
mov rcx, qword [rbp + 0x18]
call fcn.140063290
mov qword [rbp + 0x30], 7
mov qword [rbp + 0x28], rsi
mov word [rbp + 0x18], si
cmp qword [rbp + 0x90], 8
jb 0x14000f42b
mov rcx, qword [rbp + 0x78]
call fcn.140063290
mov qword [rbp + 0x90], 7
mov qword [rbp + 0x88], rsi
mov word [rbp + 0x78], si
cmp qword [rbp + 0xb8], 8
jb 0x14000f457
mov rcx, qword [rbp + 0xa0]
call fcn.140063290
mov qword [rbp + 0xb8], 7
mov qword [rbp + 0xb0], rsi
mov word [rbp + 0xa0], si
cmp qword [rbp + 0x68], 8
jb 0x14000f480
mov rcx, qword [rbp + 0x50]
call fcn.140063290
mov qword [rbp + 0x68], 7
mov qword [rbp + 0x60], rsi
mov word [rbp + 0x50], si
mov rdi, qword [rbp - 0x68]
cmp qword [rdi + 0x18], 8
jb 0x14000f4a3
mov rcx, qword [rdi]
call fcn.140063290
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rsi
mov word [rdi], si
cmp qword [rbx + 0x18], 8
jb 0x14000f4c1
mov rcx, qword [rbx]
call fcn.140063290
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov word [rbx], si
mov rcx, qword [rbp + 0x6e30]
xor rcx, rsp
call fcn.140063080
add rsp, 0x6f48
pop rdi
pop rsi
pop rbx
pop rbp
ret