Function at 0x140012ca0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x300
mov rdi, rcx
xor r14d, r14d
mov rcx, qword [rcx + 0x10]
movabs r13, 0x7ffffffffffffffe
mov rax, r13
sub rax, rcx
cmp rax, 2
jb 0x14001337c
mov r9, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140012cf0
mov r9, qword [rdi]
mov qword [rsp + 0x30], 2
lea rax, [0x1400497b0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x40]
call fcn.140005650
nop
mov rbx, qword [0x140057808]
mov rsi, qword [0x140057810]
cmp rbx, rsi
je 0x140012e37
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140012d39
mov rdx, qword [rbx]
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x140012e2e
cmp qword [rbx + 0x18], 7
jbe 0x140012d63
mov rbx, qword [rbx]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rdx, qword [rsp + 0x40]
mov r8, rbx
lea rcx, str.____Scan__Skip_directory:__s__found__s_n
call fcn.140001b80
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140012dc6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012dc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001339a
call fcn.140019450
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r14w
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x140012e19
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140012e14
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140013388
mov rcx, r8
call fcn.140019450
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 7
mov word [rdi], r14w
jmp 0x140013359
add rbx, 0x20
jmp 0x140012d23
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0xb0]
call fcn.14003b810
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rcx, qword [rsp + 0x40]
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [rsp + 0xb0]
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x140012f5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rdx, qword [rsp + 0x40]
mov r8d, eax
lea rcx, str.____Scan__Can_t_open_directory__s__error_0x_X_n
call fcn.140001b80
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140012ef5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012ef0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001339a
call fcn.140019450
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r14w
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x140012f48
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140012f43
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140013388
mov rcx, r8
call fcn.140019450
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 7
mov word [rdi], r14w
jmp 0x140013359
lea rdx, [0x140049870]
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [rsp + 0xdc]
movzx eax, word [rsp + 0xde]
cmp cx, 0x2e
jne 0x140012fa9
cmp ax, cx
jne 0x140012f9a
cmp word [rsp + 0xe0], 0
je 0x140013294
cmp cx, 0x2e
jne 0x140012fa9
test ax, ax
je 0x140013294
mov rcx, qword [rdi + 0x10]
mov rax, r13
sub rax, rcx
cmp rax, 1
jb 0x140013382
mov r9, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140012fca
mov r9, qword [rdi]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x60]
call fcn.140005650
nop
lea rax, [rsp + 0xdc]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140013000
lea rdx, [rsp + 0xdc]
lea rcx, [rsp + 0x60]
call fcn.140003820
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x98], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140013096
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013081
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001338e
call fcn.140019450
movups xmm0, xmmword [rsp + 0x88]
movups xmm1, xmmword [rsp + 0x98]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm1
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1400130e2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400130dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013394
call fcn.140019450
test byte [rsp + 0xb0], 0x10
je 0x14001313f
lea rdx, [0x140051b58]
cmp qword [0x140051b70], 7
cmova rdx, qword [0x140051b58]
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140013294
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140001e70
mov rcx, rax
call fcn.140012ca0
jmp 0x140013294
lea rcx, [rsp + 0xdc]
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
lea rdx, [0x140051b78]
cmp qword [0x140051b90], 7
cmova rdx, qword [0x140051b78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140013294
lea ecx, [rax + 0x48]
call fcn.140019458
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
movups xmmword [rax + 0x20], xmm0
mov qword [rax + 0x30], r14
mov qword [rax + 0x38], 7
mov word [rax + 0x20], r14w
lea rax, [rsp + 0x40]
cmp rsi, rax
je 0x140013205
mov rdx, qword [rsp + 0x50]
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova r9, qword [rsp + 0x40]
mov rax, qword [rsi + 0x18]
cmp rdx, rax
ja 0x1400131fd
mov r15, rsi
cmp rax, 7
jbe 0x1400131e0
mov r15, qword [rsi]
mov qword [rsi + 0x10], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, r15
call fcn.14003b170
mov word [r15 + rbx], r14w
jmp 0x140013205
mov rcx, rsi
call fcn.140004400
lea rcx, [rsi + 0x20]
lea rax, [rsp + 0x40]
cmp rcx, rax
je 0x140013260
mov rdx, qword [rsp + 0x50]
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova r9, qword [rsp + 0x40]
mov rax, qword [rcx + 0x18]
cmp rdx, rax
ja 0x14001325b
mov r15, rcx
cmp rax, 7
jbe 0x14001323e
mov r15, qword [rcx]
mov qword [rcx + 0x10], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, r15
call fcn.14003b170
mov word [r15 + rbx], r14w
jmp 0x140013260
call fcn.140004400
lea rcx, [rsi + 0x20]
cmp qword [rcx + 0x18], 7
jbe 0x14001326e
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov word [rax], r14w
mov eax, dword [rsp + 0xd0]
mov dword [rsi + 0x40], eax
mov eax, dword [rsp + 0xcc]
mov dword [rsi + 0x44], eax
mov rcx, rsi
call fcn.140012380
lea rdx, [rsp + 0xb0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
lea rdx, [0x140049870]
jne 0x140012f70
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140013301
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400132fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001339a
call fcn.140019450
nop
jmp 0x14001330e
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x140013349
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140013344
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140013376
mov rcx, r8
call fcn.140019450
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 7
mov word [rdi], r14w
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14002a6d4
nop
call fcn.1400014c0
nop
call fcn.1400014c0
nop
call fcn.14002a6d4
nop
call fcn.14002a6d4
nop
call fcn.14002a6d4
nop
call fcn.14002a6d4
int3